◈ Encrygma — AI Cyber Security Intelligence. Defensive research only. No exploit code or attack instructions. All analysis based on public reporting & OSINT. ◈
56 articles tagged with #Espionage
A sophisticated China-aligned threat actor, tracked as UAT-11587, is deploying the novel 'Antino' backdoor to infiltrate government and policy organizations across Asia. The campaign leverages legitimate Outlook and OneDrive services for command-and-control, complicating detection efforts.
Apple has escalated its defense against government-grade surveillance, issuing high-confidence threat notifications to users in 110 countries. These alerts highlight the persistent threat of mercenary spyware, which remains a critical risk for high-profile individuals globally.
The newly identified state-backed threat actor GopherWhisper is leveraging legitimate SaaS platforms like Microsoft 365, Slack, and Discord to conduct stealthy espionage against government targets.
Encrygma threat intelligence confirms a massive, coordinated wave of mercenary spyware targeting high-profile individuals globally. Our analysts categorize these operations as state-sponsored, utilizing advanced zero-click exploit chains to bypass standard mobile security.
Encrygma analysts have identified a surge in sophisticated phishing operations utilizing the 'RedFlick' delivery technique. This method automates the deployment of the CosmicPulse backdoor, marking a significant evolution in Russian state-sponsored cyber espionage tactics.
International security agencies have issued a joint advisory regarding the 'CHOSEN BRICK' spyware, an Iranian state-linked tool. The campaign focuses on the surveillance of activists, journalists, and dissidents.
New intelligence reveals the China-nexus threat actor TA419 is conducting credential-harvesting attacks against U.S. AI policy experts. The group uses adversary-in-the-middle techniques to bypass MFA.
Apple has initiated a massive wave of threat notifications to users across 110 countries, warning of targeted mercenary spyware attacks. These alerts highlight the escalating threat from private-sector offensive actors.
Apple has intensified its global defense against mercenary spyware, issuing high-confidence alerts to users across 110 countries. These notifications highlight the persistent threat posed by state-sponsored surveillance tools targeting high-risk individuals.
A sophisticated China-nexus threat actor, tracked as UAT-11587, is deploying the newly discovered 'Antino' backdoor to infiltrate government and policy organizations across Asia. The campaign leverages legitimate cloud services for command-and-control, complicating detection efforts.
The state-backed threat actor GopherWhisper has intensified its global campaign, leveraging custom Go-based toolkits and legitimate communication platforms to infiltrate government entities. Intelligence reports indicate a shift toward sophisticated supply chain exploitation and persistent cloud-based exfiltration.
Russian state-sponsored actor Star Blizzard has adopted the 'RedFlick' technique to automate the deployment of its CosmicPulse backdoor, significantly reducing the need for direct victim interaction.
A China-linked threat actor, UAT-11587, is actively targeting government and policy organizations across Asia using a novel backdoor called Antino. The campaign leverages legitimate cloud services like Outlook and OneDrive for command-and-control communications.
The China-based threat actor Jewelbug is simultaneously conducting state-sponsored espionage against government ministries and industrial-scale cryptocurrency fraud using a shared control infrastructure.
Threat actors are leveraging a novel 'RedFlick' technique to distribute malware, marking a significant shift in evasion tactics. This development highlights the ongoing evolution of state-sponsored cyber espionage.
Paragon Solutions has acknowledged it lacks the technical capability to track how clients use its Graphite spyware. This admission follows a massive wave of Apple mercenary spyware alerts in August.
A new China-linked espionage campaign targeting Asian government entities utilizes the novel 'Antino' Rust-based backdoor. The threat actor, UAT-11587, leverages legitimate Microsoft 365 services for C2.
Paragon Solutions confirms it cannot track misuse of its Graphite spyware, while a new CoreGraphics zero-day (CVE-2026-86950) emerges, threatening high-risk users with potential mercenary exploitation.
A Russian intelligence-linked cluster, GTG-20006, has integrated AI-driven workflows to automate reconnaissance and phishing. This development marks a significant shift in state-sponsored espionage tactics.
Recent forensic analysis confirms the deployment of advanced zero-click spyware against activists in Serbia. This incident highlights the persistent threat posed by commercial surveillance vendors.
Recent cyberattacks targeting Japanese railway operators have raised alarms regarding the security of critical transportation networks. Security analysts are investigating potential links to state-sponsored actors seeking to map operational technology vulnerabilities.
British intelligence has exposed a Chinese research institute with deep ties to the Ministry of State Security (MSS) for funding over 100 UK academics. The operation focuses on harvesting sensitive research in AI, cyber warfare, and covert communications.
Four distinct nation-state threat actors have rapidly adopted the BlueMoon Chrome-and-Windows exploit kit within a 12-day window. This surge suggests a coordinated or AI-accelerated proliferation of zero-day capabilities targeting global infrastructure.
Security researchers have identified a surge in activity from the Iranian state-sponsored group Nimbus Manticore. The group is deploying sophisticated new backdoors and SSH tunneling tools to maintain long-term persistence in targeted government and critical infrastructure networks.
Recent intelligence indicates the China-linked JDY botnet has significantly expanded its targeting scope, focusing on U.S. military networks and critical infrastructure for long-term pre-positioning.
Apple has issued a significant wave of threat notifications to users in 110 countries, warning of targeted mercenary spyware attacks. These sophisticated, state-linked operations continue to threaten journalists, activists, and officials globally.
The Iranian-linked threat actor Nimbus Manticore has launched a new wave of cross-platform cyber espionage campaigns. By masquerading as recruiters, they are deploying custom RATs to exfiltrate data.
Recent intelligence indicates a surge in nation-state actors masking espionage operations as ransomware attacks. This shift complicates attribution and allows groups to bypass traditional security controls.
Apple has escalated its defense against mercenary spyware by implementing direct Lock Screen notifications for targeted users across 110 countries. This move follows a rise in sophisticated, zero-click attacks.
Security researchers have identified a massive, coordinated campaign by the China-linked threat actor Jewelbug. The group is leveraging a unified control panel to conduct simultaneous cyber espionage and large-scale cryptocurrency fraud across the Middle East and Asia.
Microsoft Threat Intelligence has uncovered NeedyMantis, a sophisticated, modular post-compromise malware family. The threat is currently being deployed in highly targeted operations against critical sectors.
Apple has issued a massive wave of threat notifications to users in 110 countries, warning of targeted mercenary spyware attacks. These sophisticated, state-linked operations continue to plague high-risk individuals.
Singapore has announced a major shift in its national cybersecurity strategy after a sophisticated, long-term espionage campaign by the APT group UNC3886 targeted the nation's critical telecommunications infrastructure.
Recent intelligence confirms a surge in state-sponsored cyber activity targeting AI research and maritime infrastructure. China-linked actors are leveraging advanced persistent threats to secure strategic technological advantages.
A sophisticated Iranian threat actor is targeting nationals living abroad using social engineering on messaging platforms. The campaign delivers a custom trojan, 'CHOSEN BRICK', disguised as legitimate files.
Recent intelligence confirms China-linked threat actors are aggressively targeting AI robotics in South Korea and maritime monitoring systems in the Gulf. These operations align with Beijing's long-term economic and security objectives.
Apple has issued a new wave of high-confidence threat notifications to users in 110 countries, warning of targeted mercenary spyware attacks. These alerts highlight the escalating sophistication of state-linked surveillance operations.
The China-linked JDY botnet has significantly expanded its targeting scope, focusing on U.S. military networks. Intelligence indicates a shift toward aggressive reconnaissance and persistent access.
Recent intelligence indicates a surge in state-sponsored actors leveraging zero-day vulnerabilities in edge networking hardware. These campaigns prioritize long-term persistence within critical infrastructure.
Recent investigations confirm the use of NSO Group's Pegasus spyware against Serbian student activists via iMessage zero-click exploits. This marks a significant escalation in the use of mercenary surveillance tools within the region.
Apple has intensified its security efforts, issuing urgent notifications to users in 110 countries regarding potential mercenary spyware infections. These sophisticated, state-sponsored-grade attacks continue to target high-profile individuals, including journalists and diplomats.
The China-nexus actor Fire Ant has expanded its operations, utilizing compromised Cisco routers to exfiltrate credentials and manipulate security logs. This campaign highlights a shift toward leveraging trusted network infrastructure to maintain long-term persistence in high-value targets.
Recent intelligence confirms that the China-linked threat actor QTFY has intensified its campaign against military and critical infrastructure sectors. The group is utilizing advanced persistent threat tactics to compromise sensitive networks globally.
A newly identified Iranian cyber espionage campaign is actively targeting dissidents, activists, and journalists worldwide. The operation utilizes sophisticated social engineering and custom malware.
Recent intelligence reveals Chinese-speaking threat actors are utilizing autonomous AI agents to automate cyberattacks against government and industrial targets across Asia. This shift marks a significant escalation in the use of generative AI for large-scale, persistent espionage operations.
The NightEagle APT group has launched a sophisticated campaign targeting Russian enterprises using the GhostContainer backdoor. The operation leverages Active Directory vulnerabilities and RDP to maintain persistence.
Intelligence reports indicate a surge in sophisticated cyber-espionage operations by the state-sponsored actor APT41. The campaign focuses on compromising telecommunications backbones to facilitate long-term data exfiltration.
Apple has issued a massive wave of threat notifications to users in 110 countries, warning of sophisticated, government-grade mercenary spyware attacks. These alerts target high-risk individuals, including journalists and activists, highlighting the escalating threat of private surveillance vendors.
Apple has initiated a massive, global notification campaign warning high-risk users of potential targeting by government-grade mercenary spyware. This surge follows a series of high-profile compromises involving zero-click exploits against journalists, activists, and political figures.
Singapore's Cyber Security Agency has confirmed a coordinated, long-term espionage campaign by the APT actor UNC3886 targeting the nation's four major telecommunications providers.
The FBI has released a new flash alert detailing sophisticated tactics used by the North Korean state-sponsored group Kimsuky. The advisory focuses on protecting NGOs, think tanks, and academia from targeted espionage.
Apple has issued a new wave of high-confidence threat notifications to users across 110 countries, warning of sophisticated, state-linked mercenary spyware targeting high-profile individuals.
Apple has issued urgent threat notifications to users in 110 countries, warning of sophisticated, state-sponsored mercenary spyware attacks. These highly targeted intrusions continue to bypass standard security measures, impacting journalists, activists, and political figures globally.
Three distinct threat clusters are conducting concurrent cyber-espionage and sabotage operations against Russian enterprises. The campaigns utilize custom modular backdoors and data wipers to bypass security.
The China-linked threat actor FamousSparrow has launched a new wave of attacks across Latin America. The campaign utilizes sophisticated backdoors to compromise government systems and exfiltrate sensitive data.
Recent intelligence confirms a surge in mercenary spyware targeting civil society members across 110 countries. Investigations reveal sophisticated zero-click exploits are being deployed against activists.