Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 112 results
highperson_alertThreat ActorHandala Hack Deploys HEAVYGRAM Telegram Backdoor for Surveillance
Handala Hack is an Iran-linked hacktivist persona attributed to VOID MANTICORE (also tracked as COBALT MYSTIQUE, Banished Kitten, Red Sandstorm, and Storm-0842), a threat actor affiliated with Iran's Ministry of Intelligence and Security (MOIS).
highperson_alertThreat ActorFamousSparrow Deploys SparroWocky Backdoor in Latin America Campaign
FamousSparrow is a China-aligned state-sponsored threat actor assessed to be active since at least 2019. The group shares some level of overlap with Earth Estries and Salt Typhoon.
highperson_alertThreat ActorFamousSparrow deploys SparroWocky backdoor in Latin America espionage
FamousSparrow is a China-linked APT group conducting espionage operations primarily targeting government organizations. Attributed by ESET, the group demonstrates strong knowledge of anti-analysis techniques and Windows internals, indicating a well-r…
highperson_alertThreat ActorIranian State-Linked Hackers Deploy CHOSEN BRICK Malware
Iranian state-linked threat actors conducting espionage operations targeting dissidents, activists, and journalists globally. The activity is attributed to Iranian intelligence services and is assessed to support regime repression efforts against per…
highperson_alertThreat ActorNightEagle, Hacking Cat, and Toy Ghouls Target Russian Enterprises
Three distinct threat activity clusters are actively targeting Russian enterprises. NightEagle (APT-Q-95) is a sophisticated threat actor active since at least 2023, employing advanced persistence and lateral movement techniques.
highperson_alertThreat ActorIran MOIS Uses Telegram-Controlled Malware to Target Dissidents
Iran's Ministry of Intelligence and Security (MOIS), the country's primary intelligence agency, is attributed by the FBI, UK NCSC, and Netherlands AIVD as the operator behind this espionage campaign.
highperson_alertThreat ActorIranian State Actors Deploy CHOSEN BRICK Against Dissidents Globally
Iranian state cyber actors are attributed by NCSC UK, FBI, and AIVD to deploying CHOSEN BRICK malware against dissidents, activists, and journalists perceived as threats to the Iranian regime.
highperson_alertThreat ActorIranian State Actors Deploy CHOSEN BRICK Spyware Against Dissidents
Iranian state-sponsored cyber actors conducting surveillance operations against individuals perceived as threats to the Iranian regime. The NCSC assesses that Iran almost certainly uses cyber activity to support repression of dissidents, activists, a…
highperson_alertThreat ActorRed Heron Exploits Gitea RCE to Compromise 13 Organizations
Red Heron is a suspected Chinese threat actor attributed with moderate confidence to operating within a China-linked context. Attribution is based on the use of Simplified Chinese labels for target classification, consistent classification of Taiwan…
highperson_alertThreat ActorGTG-20006 (Midnight Blizzard) Uses Claude AI for Malware Evasion
GTG-20006 is a Russian state-sponsored cyber espionage group attributed by Anthropic, aligning with Midnight Blizzard (APT29, Cozy Bear). The actor demonstrates advanced operational sophistication by integrating generative AI into their entire attack…
highperson_alertThreat ActorUNC3569 Exploits Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor
UNC3569 is a China-linked threat actor attributed by Google Threat Intelligence to the country's hacker-for-hire ecosystem. Active since at least 2021, the group targets government, education, technology, and finance sectors primarily in East and Sou…
highperson_alertThreat ActorChinese AI Firms Conduct Industrial-Scale Distillation on U.S. Models
Six Chinese AI companies—DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI—are attributed by CISA, NSA, and FBI as conducting coordinated, industrial-scale AI model distillation attacks against U.S. frontier AI providers since late 2024.
highperson_alertThreat ActorAPT31 Deploys BlueMoon Exploit Kit Chaining Chrome and Windows Zero-Days
APT31 (also tracked as Bronze Vinewood, Judgement Panda, JungleBamboo, PerplexedGoblin, RedBravo, TA412, Tide Castle, Violet Typhoon, and ZIRCONIUM) is a China-aligned state-sponsored threat actor conducting espionage operations.
highperson_alertThreat ActorSlim Spider Targets Brazilian Financial Institutions for Crypto Theft
Slim Spider is a previously undocumented, financially motivated threat actor attributed by CrowdStrike to Brazil-based operations targeting Brazilian financial institutions since at least March 2026.
highperson_alertThreat ActorNSO Group Pegasus spyware targets Serbian student protesters via iMessage
NSO Group is an Israeli cyber intelligence company that develops and sells Pegasus, a sophisticated mobile surveillance platform marketed exclusively to government clients for lawful interception.
highperson_alertThreat ActorUAC-0099 Deploys GuardBreaker to Sabotage AI-Assisted Malware Analysis
UAC-0099 is a Russia-aligned threat actor with a history of targeting Ukraine's transportation and energy sectors. The group demonstrates tactical innovation by adapting emerging anti-AI analysis techniques to evade detection.
highperson_alertThreat ActorFire Ant compromises Cisco routers for network surveillance
Fire Ant is a Chinese espionage-focused threat actor attributed by Sygnia, with operational overlap to UNC3886 (previously documented by Google). The group targets critical infrastructure and high-value networks through a "target behind the target" s…
highperson_alertThreat ActorFire Ant Expands Espionage to Cisco Routers and TACACS Servers
Fire Ant is a China-linked cyber espionage actor that has conducted long-running campaigns targeting network infrastructure and virtualization platforms.
highperson_alertThreat ActorChinese QTFY Group Targeted U.S. Federal Agencies via IoT Botnet
QTFY (also known as QT AND QTCYBER) is a Chinese state-sponsored threat actor active since 2018, operating on behalf of Nanjing Xinjiuwei Network Technology Co.
highperson_alertThreat ActorDoJ Disrupts QTFY Chinese State-Sponsored Infrastructure Targeting U.S.
QTFY is a Chinese state-sponsored threat actor employed by Nanjing Xinjiuwei Network Technology Company (南京鑫玖维网络科技有限公司), active since May 2018. The group functions as a digital quartermaster serving China's Ministry of State Security (MSS) and People…
highperson_alertThreat ActorNimbus Manticore Expands Toolset With TWOSTROKE-Like Backdoor
Nimbus Manticore is an Iranian state-sponsored APT group affiliated with the Islamic Revolutionary Guard Corps (IRGC). Also tracked as GalaxyGato, Mirage Kitten, Screening Serpens, Smoke Sandstorm, Subtle Snail, and UNC1549, the group is assessed to…
highperson_alertThreat ActorFBI disrupts QTFY quartermaster infrastructure for Chinese espionage
QTFY (also tracked as QT, QTCYBER) is a China-based threat actor operating as a technical "quartermaster" providing reconnaissance, proxy management, and operational routing capabilities for Chinese cyber espionage operations.
highperson_alertThreat ActorOperation QUICSILVER: China-nexus campaign targets Myanmar with QUICAgent
Operation QUICSILVER is attributed with moderate confidence to a China-nexus threat actor conducting cyber espionage operations against Myanmar. The actor demonstrates sophisticated tradecraft, leveraging social engineering lures themed around govern…
highperson_alertThreat ActorUNC6293, UNC7005, UNC5976 Abuse OAuth and WhatsApp Linking for Espionage
UNC6293, UNC7005, and UNC5976 are three distinct suspected Russian cyber espionage threat clusters conducting persistent account compromise operations. UNC6293 is assessed to be a sub-cluster of Ice Relic (formerly APT29, also tracked as Cozy Bear an…
highperson_alertThreat ActorAI-Generated Exploits Target Siemens S7 PLCs in U.S. Critical Infrastructure
This campaign involves unattributed threat actors leveraging artificial intelligence to generate exploitation scripts targeting industrial control systems.
highperson_alertThreat ActorAI-Generated Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure
No specific threat actor or group has been attributed to this campaign. The advisory describes ongoing activity by unidentified threat actors targeting Siemens S7 Series programmable logic controllers in U.S. critical infrastructure.
highperson_alertThreat ActorU.S. charges 17 Mabna Institute members for $3.4B IP theft campaign
Mabna Institute is an Iranian hacking-for-hire organization linked to cyber operations conducted on behalf of Iran's Islamic Revolutionary Guard Corps (IRGC), other Iranian government bodies, universities, and private paying customers.
highperson_alertThreat ActorSilkParasite Targets Central Asian Governments with Five New RATs
SilkParasite is a previously unreported cyber espionage operation first discovered in late 2025, assessed with medium confidence to be a China-nexus threat cluster.
highperson_alertThreat ActorTWINLOOT Implant Abuses Microsoft 365 Services for C2 and Lateral Movement
No specific threat actor has been attributed to TWINLOOT operations. The malware was discovered by Ontinue's Cyber Defense Center during investigation of an ongoing campaign in July 2026.
highperson_alertThreat ActorIranian Cavern C2 Framework Evolves with DNS and Google Apps Script Relay
Cavern (aka Cav3rn) is a command-and-control framework attributed to Iranian nation-state threat actors, specifically linked to Cavern Manticore, a hacking group affiliated with Iran's Ministry of Intelligence and Security (MOIS).