◈ Encrygma — AI Cyber Security Intelligence. Defensive research only. No exploit code or attack instructions. All analysis based on public reporting & OSINT. ◈
67 articles tagged with #APT
A sophisticated China-aligned threat actor, tracked as UAT-11587, is deploying the novel 'Antino' backdoor to infiltrate government and policy organizations across Asia. The campaign leverages legitimate Outlook and OneDrive services for command-and-control, complicating detection efforts.
Following a surge in nation-state activity targeting energy and water sectors, the OT Cyber Coalition has formally petitioned CISA to issue binding directives to mandate stricter OT security standards.
The newly identified state-backed threat actor GopherWhisper is leveraging legitimate SaaS platforms like Microsoft 365, Slack, and Discord to conduct stealthy espionage against government targets.
Encrygma analysts have identified a surge in sophisticated phishing operations utilizing the 'RedFlick' delivery technique. This method automates the deployment of the CosmicPulse backdoor, marking a significant evolution in Russian state-sponsored cyber espionage tactics.
International security agencies have issued a joint advisory regarding the 'CHOSEN BRICK' spyware, an Iranian state-linked tool. The campaign focuses on the surveillance of activists, journalists, and dissidents.
Recent intelligence indicates a shift from AI-assisted attacks to fully autonomous operations. Threat actors are now deploying hundreds of AI agents to scale exploits against critical infrastructure.
New intelligence reveals the China-nexus threat actor TA419 is conducting credential-harvesting attacks against U.S. AI policy experts. The group uses adversary-in-the-middle techniques to bypass MFA.
Recent intelligence indicates a significant shift as threat actors deploy autonomous AI agents to compress the attack lifecycle from weeks to minutes. This new wave of machine-speed operations is overwhelming traditional perimeter defenses.
Recent intelligence indicates a surge in sophisticated cyber operations targeting U.S. water and energy OT systems. Federal agencies warn of persistent, state-linked actors exploiting vulnerabilities to disrupt essential services.
Security researchers have identified active exploitation of CVE-2026-88772 in Citrix NetScaler, where attackers are leveraging LLM-driven automation to accelerate post-exploitation shellcode execution.
South Korean authorities have launched a major investigation into a series of cyber attacks targeting major financial institutions, resulting in significant customer data leaks.
A China-nexus threat actor, tracked as Longlegs (Storm-2603), is actively exploiting SharePoint vulnerabilities to compromise water and telecommunications operators across three continents.
A sophisticated China-nexus threat actor, tracked as UAT-11587, is deploying the newly discovered 'Antino' backdoor to infiltrate government and policy organizations across Asia. The campaign leverages legitimate cloud services for command-and-control, complicating detection efforts.
Security researchers have identified a new wave of AI-driven zero-day exploit chains targeting critical infrastructure. The campaign has resulted in the exposure of over 543,000 live secrets globally.
The state-backed threat actor GopherWhisper has intensified its global campaign, leveraging custom Go-based toolkits and legitimate communication platforms to infiltrate government entities. Intelligence reports indicate a shift toward sophisticated supply chain exploitation and persistent cloud-based exfiltration.
Russian state-sponsored actor Star Blizzard has adopted the 'RedFlick' technique to automate the deployment of its CosmicPulse backdoor, significantly reducing the need for direct victim interaction.
The China-nexus threat actor known as Warlock is actively exploiting critical Microsoft SharePoint vulnerabilities to cripple utilities and government sectors. Recent intelligence confirms the group is disabling endpoint protection and deploying ransomware across dozens of hosts within hours.
A China-linked threat actor, UAT-11587, is actively targeting government and policy organizations across Asia using a novel backdoor called Antino. The campaign leverages legitimate cloud services like Outlook and OneDrive for command-and-control communications.
Russian state-sponsored actor Star Blizzard is deploying the new 'RedFlick' malware delivery technique. The campaign leverages sophisticated steganography and AI-assisted evasion to deploy the CosmicPulse backdoor.
The China-based threat actor Jewelbug is simultaneously conducting state-sponsored espionage against government ministries and industrial-scale cryptocurrency fraud using a shared control infrastructure.
Following a significant breach involving OpenAI systems, government agencies have been ordered to conduct an urgent review of their cyber infrastructure to defend against emerging AI-powered threats.
Threat actors are leveraging a novel 'RedFlick' technique to distribute malware, marking a significant shift in evasion tactics. This development highlights the ongoing evolution of state-sponsored cyber espionage.
Recent analysis reveals that attackers leveraged vulnerabilities in Spain's Adif web infrastructure to pivot into Renfe's IT systems, resulting in the exfiltration of 500 GB of sensitive data.
A new China-linked espionage campaign targeting Asian government entities utilizes the novel 'Antino' Rust-based backdoor. The threat actor, UAT-11587, leverages legitimate Microsoft 365 services for C2.
The European Union has formally attributed a series of disruptive cyberattacks against critical infrastructure in Poland and across Europe to the Russian FSB's 16th Centre. This follows a summer of heightened tensions and diplomatic warnings regarding state-sponsored sabotage.
Security researchers have identified a sophisticated breach of Spain's national rail operator, Renfe, originating from compromised web infrastructure belonging to the rail manager, Adif. The incident highlights the growing threat of AI-assisted cyber operations targeting critical transportation networks.
Security researchers have confirmed active in-the-wild exploitation of critical RCE vulnerabilities in Citrix NetScaler and Cisco SD-WAN. CISA has mandated immediate patching for federal agencies.
A Russian intelligence-linked cluster, GTG-20006, has integrated AI-driven workflows to automate reconnaissance and phishing. This development marks a significant shift in state-sponsored espionage tactics.
As of October 2026, the FBI's Operation Riptide is actively dismantling state-sponsored cyber infrastructure. This comes as healthcare and critical sectors face a surge in AI-powered nation-state attacks.
Recent cyberattacks targeting Japanese railway operators have raised alarms regarding the security of critical transportation networks. Security analysts are investigating potential links to state-sponsored actors seeking to map operational technology vulnerabilities.
Global infrastructure faces heightened risk as threat actors exploit critical zero-day vulnerabilities in Citrix NetScaler and F5 BIG-IP appliances. Security agencies have issued urgent warnings.
Four distinct nation-state threat actors have rapidly adopted the BlueMoon Chrome-and-Windows exploit kit within a 12-day window. This surge suggests a coordinated or AI-accelerated proliferation of zero-day capabilities targeting global infrastructure.
Apple has issued a widespread wave of threat notifications to users across 110 countries, warning of sophisticated mercenary spyware targeting high-risk individuals. This escalation follows recent reports of zero-click exploits, including the targeting of activists in Serbia.
Security researchers have identified a surge in activity from the Iranian state-sponsored group Nimbus Manticore. The group is deploying sophisticated new backdoors and SSH tunneling tools to maintain long-term persistence in targeted government and critical infrastructure networks.
Recent intelligence indicates the China-linked JDY botnet has significantly expanded its targeting scope, focusing on U.S. military networks and critical infrastructure for long-term pre-positioning.
Citrix has confirmed active, in-the-wild exploitation of two critical remote code execution zero-day vulnerabilities, CVE-2026-88771 and CVE-2026-88772, affecting NetScaler ADC and Gateway products.
The Iranian-linked threat actor Nimbus Manticore has launched a new wave of cross-platform cyber espionage campaigns. By masquerading as recruiters, they are deploying custom RATs to exfiltrate data.
Recent intelligence indicates a surge in nation-state actors masking espionage operations as ransomware attacks. This shift complicates attribution and allows groups to bypass traditional security controls.
Recent intelligence indicates a surge in coordinated cyber-physical threats against critical power infrastructure. European energy leaders and US agencies report increased vulnerabilities in OT/ICS environments.
Security researchers have identified a massive, coordinated campaign by the China-linked threat actor Jewelbug. The group is leveraging a unified control panel to conduct simultaneous cyber espionage and large-scale cryptocurrency fraud across the Middle East and Asia.
Recent intelligence reveals Chinese-speaking threat actors are integrating commercial AI models into live cyber-espionage operations. These campaigns target government, education, and industrial sectors across Asia.
Microsoft Threat Intelligence has uncovered NeedyMantis, a sophisticated, modular post-compromise malware family. The threat is currently being deployed in highly targeted operations against critical sectors.
Apple has issued a massive wave of threat notifications to users in 110 countries, warning of targeted mercenary spyware attacks. These sophisticated, state-linked operations continue to plague high-risk individuals.
Singapore has announced a major shift in its national cybersecurity strategy after a sophisticated, long-term espionage campaign by the APT group UNC3886 targeted the nation's critical telecommunications infrastructure.
Recent intelligence confirms a surge in state-sponsored cyber activity targeting AI research and maritime infrastructure. China-linked actors are leveraging advanced persistent threats to secure strategic technological advantages.
A sophisticated Iranian threat actor is targeting nationals living abroad using social engineering on messaging platforms. The campaign delivers a custom trojan, 'CHOSEN BRICK', disguised as legitimate files.
Recent intelligence confirms China-linked threat actors are aggressively targeting AI robotics in South Korea and maritime monitoring systems in the Gulf. These operations align with Beijing's long-term economic and security objectives.
The China-linked JDY botnet has significantly expanded its targeting scope, focusing on U.S. military networks. Intelligence indicates a shift toward aggressive reconnaissance and persistent access.
Spanish authorities have confirmed the first incident of an autonomous AI agent conducting a multi-stage cyber attack. This marks a shift from AI-assisted tools to fully self-directed offensive operations.
Recent intelligence indicates a surge in state-sponsored actors leveraging zero-day vulnerabilities in edge networking hardware. These campaigns prioritize long-term persistence within critical infrastructure.
The China-nexus actor Fire Ant has expanded its operations, utilizing compromised Cisco routers to exfiltrate credentials and manipulate security logs. This campaign highlights a shift toward leveraging trusted network infrastructure to maintain long-term persistence in high-value targets.
Recent intelligence confirms that the China-linked threat actor QTFY has intensified its campaign against military and critical infrastructure sectors. The group is utilizing advanced persistent threat tactics to compromise sensitive networks globally.
A newly identified Iranian cyber espionage campaign is actively targeting dissidents, activists, and journalists worldwide. The operation utilizes sophisticated social engineering and custom malware.
Recent intelligence reveals Chinese-speaking threat actors are utilizing autonomous AI agents to automate cyberattacks against government and industrial targets across Asia. This shift marks a significant escalation in the use of generative AI for large-scale, persistent espionage operations.
Recent intelligence indicates a sharp increase in sophisticated reconnaissance operations targeting Operational Technology (OT) environments within European and North American energy sectors. Utilities are reporting heightened scanning activity and unauthorized access attempts on critical grid-connected assets.
CISA and security agencies have issued urgent warnings regarding active exploitation of a critical SQL injection vulnerability (CVE-2026-76461) in Cisco AsyncOS, allowing remote root-level command execution.
The NightEagle APT group has launched a sophisticated campaign targeting Russian enterprises using the GhostContainer backdoor. The operation leverages Active Directory vulnerabilities and RDP to maintain persistence.
Spanish authorities have identified a landmark cyber attack where an autonomous AI agent, rather than a human operator, actively identified and exploited system vulnerabilities in a domestic organization.
Intelligence reports indicate a surge in sophisticated cyber-espionage operations by the state-sponsored actor APT41. The campaign focuses on compromising telecommunications backbones to facilitate long-term data exfiltration.
U.S. federal agencies have issued a joint advisory warning of active, AI-assisted campaigns targeting Siemens S7 PLCs. The attacks have caused confirmed operational disruptions in water and energy sectors.
Arista Networks has confirmed active exploitation of a critical zero-day vulnerability in its VeloCloud platform. Security teams are urged to prioritize patching as attackers leverage the flaw.
Singapore's Cyber Security Agency has confirmed a coordinated, long-term espionage campaign by the APT actor UNC3886 targeting the nation's four major telecommunications providers.
Recent intelligence reports indicate an 89% year-over-year surge in AI-powered cyber operations. Western intelligence agencies warn that frontier AI models are accelerating the timeline for sophisticated attacks.
The FBI has released a new flash alert detailing sophisticated tactics used by the North Korean state-sponsored group Kimsuky. The advisory focuses on protecting NGOs, think tanks, and academia from targeted espionage.
Recent intelligence confirms a surge in state-sponsored cyber operations targeting critical infrastructure. Iranian-linked actors successfully forced a UK power plant offline for four days in August 2026.
Three distinct threat clusters are conducting concurrent cyber-espionage and sabotage operations against Russian enterprises. The campaigns utilize custom modular backdoors and data wipers to bypass security.
The China-linked threat actor FamousSparrow has launched a new wave of attacks across Latin America. The campaign utilizes sophisticated backdoors to compromise government systems and exfiltrate sensitive data.