Patchwork Targets Turkish Defense Firms with Spear-Phishing Using Malicious LNK Files

The threat actor known as Patchwork has been attributed to a new spear-phishing campaign targeting Turkish defense contractors with the goal of gathering strategic intelligence. "The campaign employs a five-stage execution chain delivered via malicious LNK files disguised as conference invitation...

Patchwork Targets Turkish Defense Firms with Spear-Phishing Using Malicious LNK Files

The threat actor known as Patchwork has been attributed to a new spear-phishing campaign targeting Turkish defense contractors with the goal of gathering strategic intelligence. "The campaign employs a five-stage execution chain delivered via malicious LNK files disguised as conference invitation...

Cyber Espionage Campaign Hits Russian Aerospace Sector Using EAGLET Backdoor

Russian aerospace and defense industries have become the target of a cyber espionage campaign that delivers a backdoor called EAGLET to facilitate data exfiltration. The activity, dubbed Operation CargoTalon , has been assigned to a threat cluster tracked as UNG0901 short for Unknown Group 901...

The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server lies in the incorrect path name restrictions for the restricted access catalog, allowing attackers to perform spear-phishing attacks.

The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server packages is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to perform spear-phishing attacks remotely...

The vulnerability of the JetBrains YouTrack project management and task management software, related to the lack of an authentication process that allows attackers to perform spear-phishing attacks.

The vulnerability of the JetBrains YouTrack project management and task management software is related to the absence of an authentication process. Exploiting this vulnerability allows a malicious actor to carry out spear-phishing attacks remotely...

UNG0002 Group Hits China, Hong Kong, Pakistan Using LNK Files and RATs in Twin Campaigns

Multiple sectors in China, Hong Kong, and Pakistan have become the target of a threat activity cluster tracked as UNG0002 aka Unknown Group 0002 as part of a broader cyber espionage campaign. "This threat entity demonstrates a strong preference for using shortcut files LNK, VBScript, and...

UNG0002 Group Hits China, Hong Kong, Pakistan Using LNK Files and RATs in Twin Campaigns

Multiple sectors in China, Hong Kong, and Pakistan have become the target of a threat activity cluster tracked as UNG0002 aka Unknown Group 0002 as part of a broader cyber espionage campaign. "This threat entity demonstrates a strong preference for using shortcut files LNK, VBScript, and...

Chinese Hackers Target Taiwan's Semiconductor Sector with Cobalt Strike, Custom Backdoors

The Taiwanese semiconductor industry has become the target of spear-phishing campaigns undertaken by three previously undocumented Chinese state-sponsored threat actors. "Targets of these campaigns ranged from organizations involved in the manufacturing, design, and testing of semiconductors and...

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and the Microsoft SharePoint Foundation software for electronic document management lies in authentication procedures that allow attackers to carry out spoofing attacks.

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and the Microsoft SharePoint Foundation software relates to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to carry out spear-phishing attacks remotely...

DoNot APT Hits European Ministry with New LoptikMod Malware

Trellix reveals how the India-linked DoNot APT group launched a sophisticated spear-phishing attack on a European foreign affairs…...

From Click to Compromise: Unveiling the Sophisticated Attack of DoNot APT Group on Southern European Government Entities

From Click to Compromise: Unveiling the Sophisticated Attack of DoNot APT Group on Southern European Government Entities By Aniket Choukde, Aparna Aripirala, Alisha Kadam, Pham Duy Phuc and Alex Lanstein · July 8, 2025 This blog was also written by Akhil Reddy Introduction The DoNot APT group, al...

The vulnerability of the container management system and the virtual machine manager Incus, related to deficiencies in the authentication mechanism, allows attackers to circumvent existing security restrictions and perform spear-phishing attacks.

The vulnerability of the container management system and the virtual machine manager Incus is related to deficiencies in the authentication mechanism, resulting from incorrect rule generation based on the access control list. Exploiting this vulnerability allows a malicious actor to bypass existi...

PUBLOAD and Pubshell Malware Used in Mustang Panda's Tibet-Specific Attack

A China-linked threat actor known as Mustang Panda has been attributed to a new cyber espionage campaign directed against the Tibetan community. The spear-phishing attacks leveraged topics related to Tibet, such as the 9th World Parliamentarians' Convention on Tibet WPCT, China's education policy...

PUBLOAD and Pubshell Malware Used in Mustang Panda's Tibet-Specific Attack

A China-linked threat actor known as Mustang Panda has been attributed to a new cyber espionage campaign directed against the Tibetan community. The spear-phishing attacks leveraged topics related to Tibet, such as the 9th World Parliamentarians' Convention on Tibet WPCT, China's education policy...

Iranian APT35 Hackers Targeting Israeli Tech Experts with AI-Powered Phishing Attacks

An Iranian state-sponsored hacking group associated with the Islamic Revolutionary Guard Corps IRGC has been linked to a spear-phishing campaign targeting journalists, high-profile cyber security experts, and computer science professors in Israel. "In some of those campaigns, Israeli technology a...

SonicWall NetExtender Trojan and ConnectWise Exploits Used in Remote Access Attacks

Unknown threat actors have been distributing a trojanized version of SonicWall's SSL VPN NetExtender application to steal credentials from unsuspecting users who may have installed it. "NetExtender enables remote users to securely connect and run applications on the company network," SonicWall...

The vulnerability of the Windows Security App antivirus program on the Windows operating system allows attackers to perform spear-phishing attacks.

The vulnerability of the Windows Security App antivirus program in the Windows operating system is related to improper external manipulation of the file name or path. Exploiting this vulnerability can allow attackers to perform spear-phishing attacks...

The vulnerability of the FileSystemAccess API programming interface of the Google Chrome browser, which allows attackers to perform spoofing attacks

The vulnerability of the FileSystemAccess API of the Google Chrome browser’s software interface is related to errors in information representation by the user interface. Exploiting this vulnerability allows a malicious actor to perform spear-phishing attacks using a specially created HTML page...

Researchers Detail Bitter APT's Evolving Tactics as Its Geographic Scope Expands

The threat actor known as Bitter has been assessed to be a state-backed hacking group that's tasked with gathering intelligence that aligns with the interests of the Indian government. That's according to new findings jointly published by Proofpoint and Threatray in an exhaustive two-part analysi...

Researchers Detail Bitter APT’s Evolving Tactics as Its Geographic Scope Expands

The threat actor known as Bitter has been assessed to be a state-backed hacking group that's tasked with gathering intelligence that aligns with the interests of the Indian government. That's according to new findings jointly published by Proofpoint and Threatray in an exhaustive two-part analysi...