Russian hospital faces multi-day shutdown as pro-Ukraine group claims cyberattack
Lecardo Clinic, a private hospital in Chuvashia, Russia, experienced a multi-day operational shutdown due to a cyberattack attributed to the pro-Ukraine hacker group 4B1D.
Fancy Bear campaign sought emails of high-level Ukrainians and their military suppliers
A cyber-espionage campaign by Fancy Bear (APT28), linked to Russia’s GRU, has targeted Ukrainian government and military entities, as well as international defense contractors.
Defending Against UNC3944: Cybercrime Hardening Guidance from the Frontlines
A new wave of ransomware and extortion attacks is targeting the US retail sector, with threat intelligence suggesting the involvement of the advanced threat actor group Scattered Spider (UNC3944).
Swan Vector APT: Targeting Taiwan & Japan with DLL Implants
A newly identified APT campaign, dubbed “Swan Vector,” has been targeting educational and mechanical engineering sectors in East Asia, particularly Taiwan and Japan. The campaign employs spearphishing emails with malicious ZIP attachments
Analysis of APT37 Attack Case Disguised as a Think Tank for National Security Strategy in South Korea (Operation. ToyBox Story)
APT37 (ScarCruft), a North Korean state-sponsored threat actor, has launched a sophisticated spear-phishing campaign dubbed “Operation: ToyBox Story,” targeting activists focused on North Korean issues.
Hackers now testing ClickFix attacks against Linux targets
A new ClickFix campaign by APT36 (Transparent Tribe), a Pakistan-linked threat actor, has expanded its targeting to include Linux systems alongside Windows and macOS. It impersonates India's Ministry of Defence to lure victims.
Iranian Cyber Actors Impersonate Model Agency in Suspected Espionage Operation
A newly uncovered cyberespionage campaign, attributed with high confidence to Iranian threat actors and with lower confidence to APT35 (Charming Kitten), involves a fake website impersonating the German Mega Model Agency.
Ngioweb Remains Active 7 Years Later
Ngioweb, a proxy server botnet first identified in 2017, remains active with minimal code changes. It has grown from 3,000 daily IPs in 2020 to nearly 30,000 in 2024. It targets residential ISP users, who make up over 75% of infected systems.
Threat Actors Target Critical National Infrastructure with New Malware and Tools
Between April and November 2024, attackers exfiltrated targeted email data and mapped virtualization infrastructure. Following containment efforts in late 2024, they escalated operations by deploying additional web shells, SystemBC and MeshCentral.
French BEC Threat Actor Targets Property Payments
TA2900, is targeting French-speaking individuals with fraudulent rental payment schemes. The campaigns are designed to steal funds by impersonating rental agencies and redirecting rent payments to attacker-controlled bank accounts.
Defend Against Threats with Cyber Fusion
Cyware is the leading provider of cyber fusion solutions that power threat intelligence sharing , end-to-end automation and 360-degree threat response.
Learn More
Trending Tags
