CVE-2015-1701

CVE-2015-1701 Win32k 特権昇格の脆弱性。 オリジナル情報 https://www.fireeye.com/blog/threat-research/2015/04/probableapt28useo.html 保護 修正プログラム MS15-051 を適用してください。 https://technet.microsoft.com/library/security/MS15-051 CVE 辞書エントリ: CVE-2015-1701 NVD 公開日: 04/21/2015 NVD 最終更新日: 05/14/2020 ソース: Microsoft Corporation...

CVE-2015-1701

CVE-2015-1701 Win32k 权限提升漏洞。 原始信息位于 https://www.fireeye.com/blog/threat-research/2015/04/probableapt28useo.html 防护措施 应用 MS15-051 修复程序。 https://technet.microsoft.com/library/security/MS15-051 作者 c 2015 CVE-2015-1701 项目 致谢 R136a1...

CVE-2026-21509-handler

CVE-2026-21509 Office Kill-Bit 管理器 用于检查、应用和测试 针对 CVE-2026-21509 Microsoft Office 零日漏洞（影响 Office 2016/2019/LTSC）的 Kill-Bit 保护的 PowerShell 脚本。 什么是 CVE-2026-21509？ Microsoft Office OLE/COM 处理中的严重 RCE 漏洞 （CVSS 9.8）。已被 APT28（Fancy Bear）通过恶意 RTF/DOC 文件积极利用，针对 Shell.Explorer COM 对象...

CVE-2026-21509

CVE-2026-21509 — Microsoft Office OLE 安全功能绕过 由 Sentinel AI Defense 撰写的研究报告。仅限防御性分析——对于这一已被积极利用的漏洞， 此处不发布任何可用的利用代码或 PoC。 Microsoft Office 中的一项安全功能绕过漏洞，允许特制文档加载本应被 OLE 缓解措施阻止的 COM 组件。 该漏洞已被 APT28 UAC-0001 针对乌克兰和东欧目标积极利用。 📄 完整报告：https://sentinelaidefense.com/posts/cve-2026-21509-ole-bypass 概述...

Cisco-IOS-Exploitation-JAGUAR_TOOTH-CVE-2017-6742-Reconstruction

= doi.org/10.5281/zenodo.18283540 = orcid.org/0009-0007-7728-256X README.md 🐆 JAGUARTOOTH 分析与研究 APT28 / Fancy Bear -blue?style=for-the-badge 📑 概述 对恶意软件 JAGUARTOOTH 的全面分析和技术重建，这是一种与威胁行为者 APT28（GRU 第 74455 部队）相关的非持久性网络间谍工具。本仓库致力于网络安全研究、威胁狩猎和关键基础设施防御开发。 --- 🛠 技术深度剖析 1. 初始访问向量 CVE-2017-6742 恶意软件利用...

APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations

Cybersecurity researchers have flagged a fresh set of campaigns targeting government and diplomatic organizations in Romania, Spain, and Türkiye between late September 2025 and early April 2026. These campaigns, per Recorded Future Insikt Group, have led to the deployment of a previously...

A Shortcut to Coercion: Incomplete Patch of APT28's Zero-Day Leads to CVE-2026-32202

...

CERT-UA Discovers LAMEHUG Malware Linked to APT28, Using LLM for Phishing Campaign

The Computer Emergency Response Team of Ukraine CERT-UA has disclosed details of a phishing campaign that's designed to deliver a malware codenamed LAMEHUG. "An obvious feature of LAMEHUG is the use of LLM large language model, used to generate commands based on their textual representation...

APT28 Uses Signal Chat to Deploy BEARDSHELL Malware and COVENANT in Ukraine

The Computer Emergency Response Team of Ukraine CERT-UA has warned of a new cyber attack campaign by the Russia-linked APT28 aka UAC-0001 threat actors using Signal chat messages to deliver two previously undocumented malware families dubbedd BEARDSHELL and COVENANT. BEARDSHELL, per CERT-UA, is...

Russian Hackers Exploit Email and VPN Vulnerabilities to Spy on Ukraine Aid Logistics

Russian cyber threat actors have been attributed to a state-sponsored campaign targeting Western logistics entities and technology companies since 2022. The activity has been assessed to be orchestrated by APT28 aka BlueDelta, Fancy Bear, or Forest Blizzard, which is linked to the Russian General...

Russia-Linked APT28 Exploited MDaemon Zero-Day to Hack Government Webmail Servers

A Russia-linked threat actor has been attributed to a cyber espionage operation targeting webmail servers such as Roundcube, Horde, MDaemon, and Zimbra via cross-site scripting XSS vulnerabilities, including a then-zero-day in MDaemon, according to new findings from ESET. The activity, which...

From TV5Monde to Govt: France Blames Russia’s APT28 for Cyberattacks

France accuses Russia's APT28 hacking group Fancy Bear of targeting French government entities in a cyber espionage campaign.…...

UAC-0063 Expands Cyber Attacks to European Embassies Using Stolen Documents

The advanced persistent threat APT group known as UAC-0063 has been observed leveraging legitimate documents obtained by infiltrating one victim to attack another target with the goal of delivering a known malware dubbed HATVIBE. "This research focuses on completing the picture of UAC-0063's...

Russian Spies Jumped From One Network to Another Via Wi-Fi in an Unprecedented Hack

In a first, Russia's APT28 hacking group appears to have remotely breached the Wi-Fi of an espionage target by hijacking a laptop in another building across the street...

APT28 Targets Diplomats with HeadLace Malware via Car Sale Phishing Lure

A Russia-linked threat actor has been linked to a new campaign that employed a car for sale as a phishing lure to deliver a modular Windows backdoor called HeadLace. "The campaign likely targeted diplomats and began as early as March 2024," Palo Alto Networks Unit 42 said in a report published...

Ukrainian Institutions Targeted Using HATVIBE and CHERRYSPY Malware

The Computer Emergency Response Team of Ukraine CERT-UA has alerted of a spear-phishing campaign that targeted a scientific research institution in the country with malware known as HATVIBE and CHERRYSPY. The agency attributed the attack to a threat actor it tracks under the name UAC-0063, which...

Russian Hackers Target Europe with HeadLace Malware and Credential Harvesting

The Russian GRU-backed threat actor APT28 has been attributed as behind a series of campaigns targeting networks across Europe with the HeadLace malware and credential-harvesting web pages. APT28, also known by the names BlueDelta, Fancy Bear, Forest Blizzard, FROZENLAKE, Iron Twilight, ITG05, Pa...

APT28’s Intricate Email Campaign Against Poland

...

Kremlin-Backed APT28 Targets Polish Institutions in Large-Scale Malware Campaign

Polish government institutions have been targeted as part of a large-scale malware campaign orchestrated by a Russia-linked nation-state actor called APT28. "The campaign sent emails with content intended to arouse the recipient's interest and persuade him to click on the link," the computer...

Microsoft Outlook Flaw Exploited by Russia's APT28 to Hack Czech, German Entities

Czechia and Germany on Friday revealed that they were the target of a long-term cyber espionage campaign conducted by the Russia-linked nation-state actor known as APT28, drawing condemnation from the European Union E.U., the North Atlantic Treaty Organization NATO, the U.K., and the U.S. The Cze...