The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server lies in the incorrect path name restrictions for the restricted access catalog, allowing attackers to perform spear-phishing attacks.

The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server packages is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to perform spear-phishing attacks remotely...

UNG0002 Group Hits China, Hong Kong, Pakistan Using LNK Files and RATs in Twin Campaigns

Multiple sectors in China, Hong Kong, and Pakistan have become the target of a threat activity cluster tracked as UNG0002 aka Unknown Group 0002 as part of a broader cyber espionage campaign. "This threat entity demonstrates a strong preference for using shortcut files LNK, VBScript, and...

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and the Microsoft SharePoint Foundation software for electronic document management lies in authentication procedures that allow attackers to carry out spoofing attacks.

The vulnerability of Microsoft SharePoint Server, Microsoft SharePoint Server Subscription Edition, and the Microsoft SharePoint Foundation software relates to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to carry out spear-phishing attacks remotely...

DoNot APT Hits European Ministry with New LoptikMod Malware

Trellix reveals how the India-linked DoNot APT group launched a sophisticated spear-phishing attack on a European foreign affairs…...

From Click to Compromise: Unveiling the Sophisticated Attack of DoNot APT Group on Southern European Government Entities

From Click to Compromise: Unveiling the Sophisticated Attack of DoNot APT Group on Southern European Government Entities By Aniket Choukde, Aparna Aripirala, Alisha Kadam, Pham Duy Phuc and Alex Lanstein · July 8, 2025 This blog was also written by Akhil Reddy Introduction The DoNot APT group, al...

The vulnerability of the container management system and the virtual machine manager Incus, related to deficiencies in the authentication mechanism, allows attackers to circumvent existing security restrictions and perform spear-phishing attacks.

The vulnerability of the container management system and the virtual machine manager Incus is related to deficiencies in the authentication mechanism, resulting from incorrect rule generation based on the access control list. Exploiting this vulnerability allows a malicious actor to bypass existi...

PUBLOAD and Pubshell Malware Used in Mustang Panda's Tibet-Specific Attack

A China-linked threat actor known as Mustang Panda has been attributed to a new cyber espionage campaign directed against the Tibetan community. The spear-phishing attacks leveraged topics related to Tibet, such as the 9th World Parliamentarians' Convention on Tibet WPCT, China's education policy...

The vulnerability of the Windows Security App antivirus program on the Windows operating system allows attackers to perform spear-phishing attacks.

The vulnerability of the Windows Security App antivirus program in the Windows operating system is related to improper external manipulation of the file name or path. Exploiting this vulnerability can allow attackers to perform spear-phishing attacks...

The vulnerability of the FileSystemAccess API programming interface of the Google Chrome browser, which allows attackers to perform spoofing attacks

The vulnerability of the FileSystemAccess API of the Google Chrome browser’s software interface is related to errors in information representation by the user interface. Exploiting this vulnerability allows a malicious actor to perform spear-phishing attacks using a specially created HTML page...

Researchers Detail Bitter APT's Evolving Tactics as Its Geographic Scope Expands

The threat actor known as Bitter has been assessed to be a state-backed hacking group that's tasked with gathering intelligence that aligns with the interests of the Indian government. That's according to new findings jointly published by Proofpoint and Threatray in an exhaustive two-part analysi...

Fake Recruiter Emails Target CFOs Using Legit NetBird Tool Across 6 Global Regions

Cybersecurity researchers have warned of a new spear-phishing campaign that uses a legitimate remote access tool called Netbird to target Chief Financial Officers CFOs and financial executives at banks, energy companies, insurers, and investment firms across Europe, Africa, Canada, the Middle Eas...

A Flyby on the CFO's Inbox: Spear-Phishing Campaign Targeting Financial Executives with NetBird Deployment

A Flyby on the CFO's Inbox: Spear-Phishing Campaign Targeting Financial Executives with NetBird Deployment By Trellix · May 28, 2025 This blog was written by Srini Seethapathy Trellix wants to acknowledge thequick response from NetBird following our initial findings. NetBird acted immediately to...

Russia-Linked Hackers Target Tajikistan Government with Weaponized Word Documents

The Russia-aligned threat actor known as TAG-110 has been observed conducting a spear-phishing campaign targeting Tajikistan using macro-enabled Word templates as an initial payload. The attack chain is a departure from the threat actor's previously documented use of an HTML Application .HTA load...

South Asian Ministries Hit by SideWinder APT Using Old Office Flaws and Custom Malware

High-level government institutions in Sri Lanka, Bangladesh, and Pakistan have emerged as the target of a new campaign orchestrated by a threat actor known as SideWinder. "The attackers used spear phishing emails paired with geofenced payloads to ensure that only victims in specific countries...

Chinese Hackers Deploy MarsSnake Backdoor in Multi-Year Attack on Saudi Organization

Threat hunters have exposed the tactics of a China-aligned threat actor called UnsolicitedBooker that targeted an unnamed international organization in Saudi Arabia with a previously undocumented backdoor dubbed MarsSnake. ESET, which first discovered the hacking group's intrusions targeting the...

The vulnerability of Microsoft Visual Studio, the Microsoft.NET platform, and the Build Tools for Visual Studio toolset lies in improper external control of file names or files, allowing attackers to perform spoofing attacks.

The vulnerability of Microsoft Visual Studio, the Microsoft.NET platform, and the Build Tools for Visual Studio toolset is related to improper external name handling or file path manipulation. Exploitation of this vulnerability can allow a malicious actor to perform spear-phishing attacks by...

The vulnerability of Microsoft Edge browser, related to information representation errors in the user interface, allows attackers to perform spear-phishing attacks.

The vulnerability of Microsoft Edge is related to information representation errors in the user interface. Exploiting this vulnerability can allow a remote attacker to perform spoofing attacks...

MirrorFace Targets Japan and Taiwan with ROAMINGMOUSE and Upgraded ANEL Malware

The nation-state threat actor known as MirrorFace has been observed deploying malware dubbed ROAMINGMOUSE as part of a cyber espionage campaign directed against government agencies and public institutions in Japan and Taiwan. The activity, detected by Trend Micro in March 2025, involved the use o...

Nebulous Mantis Targets NATO-Linked Entities with Multi-Stage Malware Attacks

Cybersecurity researchers have shed light on a Russian-speaking cyber espionage group called Nebulous Mantis that has deployed a remote access trojan known as RomCom RAT since mid-2022. RomCom "employs advanced evasion techniques, including living-off-the-land LOTL tactics and encrypted command a...

Malware Attack Targets World Uyghur Congress Leaders via Trojanized UyghurEdit++ Tool

In a new campaign detected in March 2025, senior members of the World Uyghur Congress WUC living in exile have been targeted by a Windows-based malware that's capable of conducting surveillance. The spear-phishing campaign involved the use of a trojanized version of a legitimate open-source word...