Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
14 / 14 results
highperson_alertThreat ActorAPT28 Breaches NATO Naval Shipbuilders with HOOKEDGE Backdoor
APT28 (also known as Fancy Bear, Forest Blizzard, BlueDelta, IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, and Group 74) is a Russian state-sponsored threat actor attributed to Russia's military intelligence service (GRU).
highpublicGeopoliticalCyberattack on BAE Systems disrupts US federal bankruptcy court systems
The compromise of BAE Systems' Bankruptcy Noticing Center (BNC) infrastructure represents a significant incident affecting critical US judicial operations.
criticalpublicGeopoliticalPentagon DMDC breach exposes 3M military personnel records
The breach of the Defense Manpower Data Center represents a significant compromise of U.S. military human capital data, affecting nearly 3 million service members over a nine-month period from October 2025 to July 2026.
highperson_alertThreat ActorTransparent Tribe Deploys Rust Backdoors via GitHub C2 Infrastructure
Transparent Tribe (also tracked as APT36, Earth Karkaddan, COPPER FIELDSTONE, Mythic Leopard, and ProjectM) is a Pakistan-aligned advanced persistent threat group with sustained focus on South Asian geopolitical targets.
highperson_alertThreat ActorGenerative Threat Groups Weaponize Claude AI for Cyber Operations
Generative Threat Groups (GTGs) is a collective term coined by Anthropic to describe diverse threat actors leveraging Claude AI models for offensive cyber operations between December 2025 and August 2026.
highperson_alertThreat ActorUAC-0099 Deploys GuardBreaker to Sabotage AI-Assisted Malware Analysis
UAC-0099 is a Russia-aligned threat actor with a history of targeting Ukraine's transportation and energy sectors. The group demonstrates tactical innovation by adapting emerging anti-AI analysis techniques to evade detection.
highperson_alertThreat ActorUNC6293, UNC7005, UNC5976 Abuse OAuth and WhatsApp Linking for Espionage
UNC6293, UNC7005, and UNC5976 are three distinct suspected Russian cyber espionage threat clusters conducting persistent account compromise operations. UNC6293 is assessed to be a sub-cluster of Ice Relic (formerly APT29, also tracked as Cozy Bear an…
highperson_alertThreat ActorIranian Cavern C2 Framework Evolves with DNS and Google Apps Script Relay
Cavern (aka Cav3rn) is a command-and-control framework attributed to Iranian nation-state threat actors, specifically linked to Cavern Manticore, a hacking group affiliated with Iran's Ministry of Intelligence and Security (MOIS).
criticalperson_alertThreat ActorLazarus Exploits Windows Zero-Day in Operation Dream Job Campaign
Lazarus Group is a North Korean state-sponsored advanced persistent threat (APT) actor attributed to Pyongyang-backed cyber operations. The group conducts cyber espionage and financially motivated campaigns targeting organizations worldwide.
criticalperson_alertThreat ActorLazarus Exploits Windows Zero-Day in Operation Dream Job Campaign
Lazarus is a North Korean state-sponsored advanced persistent threat (APT) group linked to the Reconnaissance General Bureau. The group is financially and strategically motivated, conducting espionage operations targeting defense and critical infrast…
highperson_alertThreat ActorRussian Intelligence Services Exploit Security Cameras for Military Surveillance
Russian intelligence services are conducting a systematic cyber-espionage campaign targeting internet-connected security cameras across Europe and Ukraine.
criticalperson_alertThreat ActorChina-linked espionage group targets North American research networks
A China-linked espionage group conducted a sustained intrusion campaign lasting over one year against North American institutions. The actor's motivation appears to be intelligence collection focused on medical research, academic intellectual propert…
highperson_alertThreat ActorVolt Typhoon Expands JDY Botnet Operations Against U.S. Military
Volt Typhoon (also tracked as BRONZE SILHOUETTE, Vanguard Panda, DEV-0391, and UNC3236) is a Chinese state-sponsored APT group attributed to conducting cyber espionage operations targeting critical infrastructure.
highperson_alertThreat ActorScreening Serpens: Iranian APT Targets Tech and Defense with RAT Malware
Screening Serpens is an Iranian APT group attributed by Unit 42, conducting cyber espionage operations. The group is motivated by intelligence collection targeting technology and defense sectors, consistent with Iranian state interests in acquiring s…