◈ Encrygma — AI Cyber Security Intelligence. Defensive research only. No exploit code or attack instructions. All analysis based on public reporting & OSINT. ◈
Cyber espionage news: latest state-linked intelligence collection campaigns, corporate data theft operations, APT long-dwell intrusions, and covert access networks. Updated with each weekly cyberwarfare briefing.
300 articles
A sophisticated China-nexus threat actor, tracked as UAT-11587, is deploying the newly discovered 'Antino' backdoor to infiltrate government and policy organizations across Asia. The campaign leverages legitimate cloud services for command-and-control, complicating detection efforts.
A China-linked threat actor, UAT-11587, is actively targeting government and policy organizations across Asia using a novel backdoor called Antino. The campaign leverages legitimate cloud services like Outlook and OneDrive for command-and-control communications.
A new China-linked espionage campaign targeting Asian government entities utilizes the novel 'Antino' Rust-based backdoor. The threat actor, UAT-11587, leverages legitimate Microsoft 365 services for C2.
A Russian intelligence-linked cluster, GTG-20006, has integrated AI-driven workflows to automate reconnaissance and phishing. This development marks a significant shift in state-sponsored espionage tactics.
British intelligence has exposed a Chinese research institute with deep ties to the Ministry of State Security (MSS) for funding over 100 UK academics. The operation focuses on harvesting sensitive research in AI, cyber warfare, and covert communications.
Security researchers have identified a surge in activity from the Iranian state-sponsored group Nimbus Manticore. The group is deploying sophisticated new backdoors and SSH tunneling tools to maintain long-term persistence in targeted government and critical infrastructure networks.
The Iranian-linked threat actor Nimbus Manticore has launched a new wave of cross-platform cyber espionage campaigns. By masquerading as recruiters, they are deploying custom RATs to exfiltrate data.
Security researchers have identified a massive, coordinated campaign by the China-linked threat actor Jewelbug. The group is leveraging a unified control panel to conduct simultaneous cyber espionage and large-scale cryptocurrency fraud across the Middle East and Asia.
Singapore has announced a major shift in its national cybersecurity strategy after a sophisticated, long-term espionage campaign by the APT group UNC3886 targeted the nation's critical telecommunications infrastructure.
A sophisticated Iranian threat actor is targeting nationals living abroad using social engineering on messaging platforms. The campaign delivers a custom trojan, 'CHOSEN BRICK', disguised as legitimate files.
The China-linked JDY botnet has significantly expanded its targeting scope, focusing on U.S. military networks. Intelligence indicates a shift toward aggressive reconnaissance and persistent access.
The China-nexus actor Fire Ant has expanded its operations, utilizing compromised Cisco routers to exfiltrate credentials and manipulate security logs. This campaign highlights a shift toward leveraging trusted network infrastructure to maintain long-term persistence in high-value targets.
A newly identified Iranian cyber espionage campaign is actively targeting dissidents, activists, and journalists worldwide. The operation utilizes sophisticated social engineering and custom malware.
The NightEagle APT group has launched a sophisticated campaign targeting Russian enterprises using the GhostContainer backdoor. The operation leverages Active Directory vulnerabilities and RDP to maintain persistence.
Singapore's Cyber Security Agency has confirmed a coordinated, long-term espionage campaign by the APT actor UNC3886 targeting the nation's four major telecommunications providers.
Three distinct threat clusters are conducting concurrent cyber-espionage and sabotage operations against Russian enterprises. The campaigns utilize custom modular backdoors and data wipers to bypass security.
A joint international advisory has exposed a sophisticated Iranian cyber-espionage campaign utilizing Telegram-based malware to surveil journalists and activists. The operation, dubbed HEAVYGRAM by the FBI, enables remote audio recording and data exfiltration.
A suspected North Korean APT group has deployed a previously undocumented Linux-based espionage toolkit to compromise load balancers. The campaign aims to intercept communications and exploit networks.
A sophisticated Iranian-linked threat actor has been identified utilizing Telegram-based command-and-control infrastructure to conduct surveillance on journalists and political dissidents. The campaign, active as of September 2026, leverages custom malware to exfiltrate sensitive communications.
A China-aligned threat actor, GopherWhisper, has been identified conducting a sophisticated espionage campaign against Mongolian government systems. The group is utilizing legitimate platforms like Outlook, Slack, and Discord to mask command-and-control traffic.
Two distinct China-aligned threat actors have been observed utilizing the same Chrome and Windows zero-day exploit chain to target non-governmental organizations. The campaign, active since September 1, 2026, highlights a sophisticated coordination in exploit development and distribution.
A new report from Anthropic reveals that Russian-aligned threat actors are utilizing AI models to conduct sophisticated espionage campaigns against over 20 global organizations.
Disclosures reveal nation-state operatives are systematically utilizing LLMs to scale deception, reconnaissance, and offensive cyber espionage campaigns globally.
NSA, CISA and FBI describe what they characterize as industrial-scale malicious distillation attacks targeting U.S. frontier models including Claude, GPT, Gemini and Grok. The advisory treats the operation as a systematic campaign for extracting restricted AI capabilities with implications for AI espionage.
Cyber espionage cluster Fire Ant has compromised edge Cisco routers and TACACS servers to harvest credentials and blind security logs. The campaign targets critical routing layers across high-value environments.
CISA and international defenders warn of a sophisticated espionage intrusion targeting Philippine nuclear research bodies via an unpatched ownCloud vulnerability to exfiltrate critical research records.
China-nexus actor Fire Ant has escalated operations by targeting Cisco IOS XR routers and TACACS servers. The campaign establishes stealthy, credential-harvesting persistence within core network infrastructure.
A China-linked espionage cluster, Fire Ant, has successfully infiltrated core enterprise routing infrastructure, utilizing bespoke malware to subvert TACACS+ authentication and maintain persistent access.
A sophisticated campaign by the 'Fire Ant' APT group has been identified using compromised Cisco routers and a new beacon-less backdoor, SLEEPWALKER, to maintain persistent access to government networks.
North Korea's IT-worker fraud schemes are moving beyond software engineering into healthcare, sales, marketing and finance roles — powered by AI-generated profile photos, synthetic identities and real-time ChatGPT-assisted interview answers, per Recorded Future and Huntress reporting.
Russian-linked APT group Turla (Secret Blizzard) has intensified its espionage operations, utilizing the new STOCKSTAY malware alongside updated Kazuar backdoors to target government and diplomatic sectors.
A sophisticated Chinese-nexus threat actor, SilkParasite, is deploying five undocumented AI-developed malware strains against Central Asian government entities. The campaign marks a significant evolution in state-sponsored cyber espionage tactics.
Cybersecurity researchers have identified a fresh campaign by the Russian-linked APT28 group utilizing the HOOKEDGE backdoor. The operation targets government and diplomatic organizations across Romania, Spain, and Türkiye to exfiltrate sensitive intelligence.
The FBI has dismantled a sophisticated proxy infrastructure operated by the Chinese-linked QTFY group, which facilitated espionage against NASA, the U.S. Senate, and critical energy sectors.
The U.S. Department of Justice announced the disruption of the QTFY hacking platforms, QScan and QTRouter, used by Chinese state-sponsored actors to infiltrate NASA, the Federal Reserve, and the U.S. Senate.
A China-nexus threat actor, Jewelbug, is conducting parallel operations targeting government ministries across the Middle East and Asia while simultaneously managing a massive cryptocurrency fraud network.
A sophisticated cyber espionage campaign, Operation QUICSILVER, is targeting Myanmar's government and IT sectors using graduation-themed lures to deploy the novel Go-based QUICAgent backdoor.
A newly identified espionage cluster, SilkParasite, is targeting Central Asian government entities using five previously undocumented RATs. The campaign features AI-assisted code development to enhance stealth.
Intelligence reports from August 20-22, 2026, identify three Russian-linked threat clusters leveraging legitimate cloud infrastructure to bypass defenses at high-value financial entities.
Google Threat Intelligence Group (GTIG) has identified three Russian cyber-espionage clusters targeting diplomats and academics in Europe and the US by abusing legitimate account-authentication features.
A newly identified China-nexus threat cluster, SilkParasite, is utilizing five previously undocumented RATs and AI-enhanced lures to infiltrate government networks across Central Asia.
A newly identified China-nexus threat cluster, SilkParasite, is targeting Central Asian government bodies using a sophisticated arsenal of seven remote access tools and AI-assisted code development.
Kaspersky GReAT researchers have identified a sophisticated campaign by HoneyMyte (Mustang Panda) utilizing an updated CoolClient backdoor. The malware leverages a signed Windows kernel driver to achieve deep persistence and evade detection across government and military targets in Asia and Russia.
HoneyMyte (Mustang Panda) has deployed an updated CoolClient backdoor featuring a signed Windows kernel-mode rootkit. The campaign targets government entities across Asia and Russia using PlugX for initial delivery.
Recent intelligence confirms Void Blizzard (Laundry Bear) is actively exploiting Zimbra collaboration suites to deploy the 'Ulej' malware framework, facilitating long-term espionage against EU targets.
Kaspersky researchers have identified a sophisticated cyber-espionage operation by HoneyMyte, utilizing an evolved CoolClient backdoor to infiltrate government and telecommunications sectors across Southeast Asia.
Analysts have identified a novel cyber espionage operation targeting Taiwan. The campaign utilizes AI tools to automate exploitation, marking a shift toward autonomous intelligence operations.
The Jewelbug threat actor has been identified conducting dual-purpose operations, utilizing a unified control panel to manage both high-level government espionage and illicit cryptocurrency theft.
The hacktivist group Head Mare is actively exploiting unpatched TrueConf video conferencing servers. They are replacing legitimate client installers with malicious versions to establish persistent backdoors.
A sophisticated espionage campaign is leveraging a critical RCE in TeamCity to deploy modular backdoors. The operation targets aerospace and defense sectors to exfiltrate proprietary R&D data.
Intelligence analysts have identified a sophisticated evolution of the EtherHiding technique, dubbed 'NullReceiver,' where APT actors use trojanized npm packages to decode C2 IPs from empty Ethereum transactions.
Investigations into a breach of Swiss government SharePoint accounts reveal a novel NullReceiver blockchain-based command-and-control mechanism. The campaign compromised over 200 accounts.
Researchers have identified a sophisticated evolution of the EtherHiding technique, dubbed 'NullReceiver,' which leverages empty Ethereum transfers to mask command-and-control (C2) IP addresses.
Recent intelligence indicates a surge in nation-state actors, particularly those aligned with China and North Korea, utilizing ransomware operations to mask high-level espionage and data exfiltration.
A sophisticated espionage operation, 'CaptiveCrunch,' is targeting high-value travelers by hijacking hotel Wi-Fi to deliver the 'CornFlake' RAT. The campaign, attributed to Storm-2945, focuses on exfiltrating sensitive audio and visual data from corporate and diplomatic targets.
US intelligence and CISA confirm Chinese state-linked group Volt Typhoon has successfully infiltrated over 30 water utilities, shifting from data theft to long-term operational pre-positioning.
Microsoft and Check Point researchers have identified a sophisticated campaign by Russia-linked Storm-2945 targeting high-value travelers via hijacked hotel captive portals.
Microsoft has identified a new espionage campaign by the Russian SVR-linked group Midnight Blizzard, targeting hotel Wi-Fi networks to compromise high-value diplomatic and government targets.
A major espionage campaign by APT44 (Sandworm) has been detected targeting Baltic energy providers. The operation uses the new 'MicroVolt' malware to gain persistent OT environment access.
A new joint intelligence advisory warns that APT45 is intensifying its espionage campaign against critical infrastructure. The group is leveraging custom malware to steal military technology.
A high-impact espionage campaign attributed to Chinese actor Salt Typhoon has been detected compromising satellite ground infrastructure. The operation aims at long-term persistence within subsea cable management systems.
A joint advisory from CISA and international partners reveals a Russian-linked 'Laundry Bear' campaign exploiting a zero-click vulnerability in Zimbra mail servers to exfiltrate 90 days of government communications.
A sophisticated espionage campaign by LAUNDRY BEAR has compromised Western networks using a Zimbra zero-day. Attackers exfiltrated 90 days of emails, targeting diplomatic and strategic data.
Mandiant researchers have identified a persistent APT41 campaign targeting shipping and automotive sectors across Europe and Asia using the DUSTTRAP framework to maintain stealthy, long-term access.
Russian state-sponsored actor Laundry Bear is exploiting a critical zero-day in Zimbra servers to exfiltrate 90 days of government emails and bypass 2FA across Western diplomatic networks.
A Russian state-sponsored group has targeted US nuclear scientists and defense contractors using a zero-click Zimbra exploit to exfiltrate strategic intelligence on nuclear fusion research.
A joint advisory from Five Eyes agencies warns of a sophisticated campaign by Russian-linked actor Laundry Bear. The group is utilizing a zero-click exploit in Zimbra servers to exfiltrate diplomatic communications.
A joint advisory from Microsoft and Dutch intelligence (AIVD/MIVD) reveals a sustained espionage campaign by Void Blizzard targeting nuclear scientists and defense contractors via Zimbra exploits.
Intelligence identifies a sophisticated state-sponsored campaign, ArcaneDoor, utilizing Cisco ASA zero-day vulnerabilities to deploy persistent implants across global government networks.
Dutch intelligence (AIVD/MIVD) has uncovered a systematic Russian campaign targeting IP cameras across NATO states to track military cargo and weapon deliveries to Ukraine.
A joint advisory from twelve nations confirms that Russian state-sponsored actors are compromising edge networking hardware to establish long-term espionage persistence within global power and telecom grids.
A persistent espionage campaign by Chinese actor Salt Typhoon has successfully breached the core infrastructure of multiple international telecommunications providers, targeting lawful intercept systems.
A multi-national advisory reveals a widespread espionage campaign by Russia's FSB Center 16 targeting edge devices. The group exploits SNMP to infiltrate energy and communication sectors globally.
Researchers have identified GoSerpent, a sophisticated malware family targeting Southeast Asian governments. The campaign uses modular payloads for long-term intelligence gathering and data theft.
Intelligence reports confirm Chinese state-sponsored actors are utilizing Claude Code and DeepSeek LLMs to automate exploit development and bypass security in government networks across Asia and the U.S.
State-sponsored actors are leveraging a critical vulnerability in Check Point gateways to gain initial access, bypass MFA, and infiltrate high-value government and corporate networks globally.
A landmark July 2026 report reveals a Chinese-linked threat group successfully utilized AI tools to autonomously execute 90% of an espionage campaign targeting 30 global organizations.
The EU and UK have issued major sanctions against Russia's FSB Center 16 and GRU following a series of aggressive cyber espionage operations and a failed 2025 power grid attack in Poland.
A sophisticated cyber espionage campaign attributed to Salt Typhoon has compromised major telecommunications providers, utilizing previously unknown vulnerabilities in edge networking appliances.
Intelligence agencies from the 'Five Eyes' and allies reveal APT40’s capability to weaponize N-day vulnerabilities within hours of public disclosure, targeting high-value regional targets.
Microsoft researchers have identified a sophisticated new malware framework, GigaWiper, which integrates advanced espionage backdoors with destructive wiping modules. This marks a dangerous shift toward unified offensive operations by state-linked actors.
Former FSB officer Denis Obrezko has pleaded not guilty to charges involving 'Void Blizzard,' a Russian campaign targeting NATO-aligned agencies and exfiltrating thousands of parliamentary emails.
A sophisticated espionage campaign by the 'Void Banshee' APT group leverages a zero-day vulnerability in Windows MHTML. The operation targets organizations globally using malicious shortcuts to steal data.
Proofpoint identifies a sophisticated espionage campaign by UNK_MassTraction targeting physics and engineering departments in the U.S. and Canada to exfiltrate national security research.
Recent intelligence indicates that Pakistan-affiliated threat groups are using a sophisticated implant to target Indian government and military systems, enhancing their espionage capabilities.
An advanced persistent threat (APT), linked to the Russian GRU, has compromised NATO defense contractors via Living-off-the-Land tactics, amplifying espionage risks.
Recent intelligence reveals that Pakistan-affiliated threat actors are utilizing a sophisticated implant to infiltrate Indian government ministries and military networks, highlighting rising cyber hostilities.
An analysis reveals a sophisticated GRU-linked advanced persistent threat (APT) group targeting NATO defense contractors using Living-off-the-Land techniques for espionage.
Recent intelligence reveals that Pakistan-linked cyber actors have initiated a sophisticated campaign targeting Indian government and military networks, deploying an advanced implant.
Recent intelligence reveals that a Russian GRU-linked Advanced Persistent Threat (APT) group has successfully infiltrated NATO defense contractor networks employing Living-off-the-Land (LoL) tactics.
Recent intelligence reveals upgraded malware from Pakistani threat actors targeting Indian ministries and military operations, posing a significant security risk.
Recent intelligence reveals a sustained campaign by a Russian APT linked to the GRU, targeting NATO defense contractors via Living-off-the-Land techniques to exfiltrate sensitive data.
Pakistani APT group EarthShaker has deployed an enhanced SHADOWSTRIKE implant against critical Indian government and military networks. Analysts suspect increased espionage activities ahead.
Recent intelligence reveals a GRU-aligned APT group is infiltrating NATO defense contractor systems by leveraging advanced Living-off-the-Land techniques, posing a significant threat.
Recent geopolitical conflicts in the Middle East have led to a surge in hacktivist cyber espionage activities targeting government and corporate entities.
Hacktivist groups in South Asia are deploying sophisticated cyber espionage tactics, including long-term implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting, posing critical threats to regional security.
Recent cyber espionage campaigns in Eastern Europe have seen ransomware groups targeting government and corporate networks, posing critical threats to national security and economic stability.
Ransomware groups are increasingly engaging in cyber espionage across Africa, employing long-term implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting to advance their objectives.
Hacktivist collectives in Central Asia are escalating cyber espionage activities, targeting government and corporate entities to advance geopolitical agendas.
Chinese state-sponsored cyber actors are increasingly targeting Southeast Asian governments and critical infrastructure, employing sophisticated techniques to maintain long-term access and gather intelligence.
Recent cyber espionage campaigns have intensified in South Asia, with state-sponsored APT groups targeting government agencies and critical infrastructure, posing significant risks to regional security.
Nation-state cyber operations in South Asia have intensified, focusing on long-term espionage implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting.
APT-C-36, also known as Blind Eagle, continues to target Latin American governments and critical sectors, employing sophisticated phishing and remote access tools to exfiltrate sensitive data.
Ransomware groups are increasingly targeting Western European supply chains and diplomatic entities, employing long-term espionage implants and SIGINT-linked intrusions to collect intelligence.
Recent intelligence indicates a surge in cyber espionage activities by ransomware groups targeting African governments and corporations, posing significant security risks.
Hacktivist groups are increasingly deploying long-term espionage implants and supply chain compromises to collect intelligence, with a focus on SIGINT-linked intrusions and diplomatic targeting in North America.
Recent cyber espionage campaigns in Eastern Europe have seen increased activity from state-sponsored groups targeting government and diplomatic entities. This briefing provides an in-depth analysis of these developments.
State-sponsored APT groups are intensifying cyber espionage operations in Eastern Europe, targeting critical infrastructure and diplomatic entities to gather intelligence and disrupt operations.
Recent cyber espionage campaigns have intensified, with ransomware groups employing sophisticated tactics to infiltrate and exfiltrate sensitive data from North American entities.
Recent cyber espionage activities in Central Asia have intensified, with cybercriminal groups deploying long-term implants, compromising supply chains, and targeting diplomatic entities. This briefing examines these evolving threats.
Advanced Persistent Threat (APT) groups in South Asia have escalated cyber espionage activities targeting government, defense, and critical infrastructure sectors, employing sophisticated techniques to maintain long-term access.
Advanced Persistent Threats (APTs) are increasingly targeting North American entities through long-term implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting.
State-sponsored cyber espionage campaigns in East Asia have intensified, targeting critical infrastructure and government entities, posing significant national security risks.
Hacktivist groups are increasingly targeting Central Asia with cyber espionage operations, employing long-term implants and supply chain compromises to gather intelligence.
Russian-aligned APT groups have escalated cyber espionage activities in Eastern Europe, targeting critical infrastructure and government entities with sophisticated malware and zero-day exploits.
Russian state-sponsored cyber espionage activities have escalated in Eastern Europe, focusing on long-term implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting.
Recent hacktivist cyber espionage campaigns in East Asia have escalated, targeting critical infrastructure and government entities, reflecting a critical threat level.
Hacktivist groups in South Asia are deploying sophisticated cyber espionage tactics, including long-term implants and supply chain compromises, to target diplomatic entities and critical infrastructure.
Recent hacktivist cyber espionage campaigns have escalated in Southeast Asia, targeting government and critical infrastructure sectors, with heightened activity linked to regional geopolitical tensions.
Recent developments in South Asia reveal a medium-level threat from ransomware groups employing cyber espionage tactics, including long-term implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting.
Nation-state actors are deploying sophisticated cyber espionage tactics in South Asia, targeting critical infrastructure and diplomatic channels to gather intelligence and disrupt operations.
State-sponsored cybercriminals have intensified espionage campaigns against Western European governments and corporations, employing sophisticated tactics to infiltrate critical infrastructure.
State-sponsored cyber espionage in Western Europe has intensified, with sophisticated long-term implants, supply chain compromises, SIGINT-linked intrusions, and targeted diplomatic operations.
Hacktivist groups in East Asia are increasingly engaging in cyber espionage, targeting government and corporate entities to advance political agendas, with significant implications for regional security.
Pro-Iranian hacktivist groups are escalating cyber espionage activities in the Middle East, targeting critical infrastructure and diplomatic entities to gather intelligence and disrupt adversaries.
In March 2026, Iranian state-sponsored cyber actors intensified espionage campaigns against Middle Eastern governments and critical infrastructure, leveraging regional conflicts as lures in sophisticated phishing operations.
An in-depth analysis of the escalating cyber espionage activities in Southeast Asia, focusing on long-term implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting by APT groups.
Recent cyber espionage activities by APT groups have intensified in Southeast Asia, focusing on government and telecom sectors, employing sophisticated malware and persistent intrusion tactics.
Recent geopolitical tensions in the Middle East have led to a significant surge in state-sponsored cyber espionage activities targeting critical infrastructure and government entities.
Middle East-based ransomware groups are increasingly integrating cyber espionage tactics, targeting critical infrastructure and diplomatic entities to gather intelligence and exert geopolitical influence.
Hacktivist groups are increasingly targeting Latin American governments and corporations, employing sophisticated cyber espionage tactics to exfiltrate sensitive data and disrupt operations.
Iranian state-sponsored APT groups are escalating cyber espionage activities targeting Middle Eastern governments, critical infrastructure, and diplomatic entities, leveraging geopolitical conflicts as lures.
Advanced Persistent Threat (APT) groups in South Asia are increasingly integrating ransomware techniques into their cyber espionage campaigns, targeting government and corporate entities to exfiltrate sensitive data and disrupt operations.
Recent cyber espionage campaigns have targeted Middle Eastern diplomatic and energy sectors, employing long-term implants and supply chain compromises to extract sensitive intelligence.
RomCom, a Russian-aligned ransomware group, has intensified cyber espionage operations against European infrastructure, exploiting zero-day vulnerabilities and deploying wiper malware.
Cybercriminals in South Asia are increasingly deploying long-term espionage implants, compromising supply chains, and targeting diplomatic entities to collect sensitive information.
Silent Lynx, a Chinese-speaking APT group, has been conducting sophisticated cyber espionage campaigns across Central Asia since late 2024, targeting government entities and critical infrastructure.
Hacktivist groups are increasingly targeting Western Europe's diplomatic entities and critical infrastructure, employing long-term espionage implants and supply chain compromises to collect sensitive information.
Recent cyber espionage activities have intensified in Southeast Asia, with state-sponsored actors deploying advanced malware to infiltrate government and telecom sectors, posing significant security threats.
Recent cyber espionage activities in East Asia have intensified, with cybercriminals deploying long-term implants and compromising supply chains to gather intelligence. These operations pose a critical threat to regional security and require immediate attention.
Hacktivist groups in Eastern Europe are increasingly engaging in cyber espionage, targeting government and corporate entities to gather intelligence and disrupt operations.
Hacktivist groups in East Asia are increasingly deploying long-term espionage implants, compromising supply chains, and targeting diplomatic entities, posing a critical threat to regional security.
New ransomware groups are increasingly targeting North American entities, employing sophisticated tactics to infiltrate corporate and government networks.
State-sponsored cyber espionage groups are increasingly targeting Central Asia's critical infrastructure, employing sophisticated techniques to infiltrate and exfiltrate sensitive data.
Recent ransomware campaigns in Central Asia have escalated, with groups like Qilin and Akira deploying sophisticated attacks against government and corporate entities, raising concerns over national security and economic stability.
Nation-state actors are deploying long-term cyber espionage implants and compromising supply chains to gather intelligence in Eastern Europe, with a focus on SIGINT-linked intrusions and diplomatic targeting.
Hacktivist groups have intensified cyber espionage activities in Latin America, targeting government agencies and corporations to steal sensitive information and disrupt operations.
Latin American governments are increasingly targeted by ransomware groups employing cyber espionage tactics, including long-term implants, supply chain compromises, and SIGINT-linked intrusions.
Recent cyber espionage campaigns in South Asia have intensified, with advanced persistent threat (APT) groups targeting government, defense, and critical infrastructure sectors. This briefing analyzes the current threat landscape, highlighting key actors, tactics, and implications for regional security.
Eastern European ransomware groups are increasingly engaging in cyber espionage, targeting supply chains, SIGINT-linked intrusions, and diplomatic entities, posing a high-level threat.
Hacktivist groups have intensified cyber espionage activities in Southeast Asia, targeting government agencies and critical sectors to gather intelligence and disrupt operations.
Ransomware groups are increasingly targeting supply chains in Western Europe to deploy long-term espionage implants, compromising critical infrastructure for intelligence collection and SIGINT-linked intrusions.
Recent cyber espionage campaigns in Africa have intensified, with state-sponsored actors and cybercriminals targeting critical sectors. This briefing examines the evolving threat landscape, highlighting key actors, tactics, and implications for regional security.
Cybercriminals in South Asia are increasingly leveraging long-term espionage implants, supply chain compromises, and SIGINT-linked intrusions to target diplomatic entities, posing a high-level threat to regional security.
Chinese state-sponsored group TA416 has intensified cyber espionage campaigns targeting European governments, employing sophisticated malware delivery methods.
South Asian ransomware groups are increasingly adopting cyber espionage methods, including long-term implants and supply chain compromises, to enhance intelligence collection and target diplomatic entities.
Recent cyber espionage campaigns have intensified in Southeast Asia, with state-sponsored actors targeting government agencies and telecom sectors using sophisticated malware and phishing techniques.
APT-C-36, also known as Blind Eagle, has been actively targeting Latin American governments and organizations since 2018, employing sophisticated cyber espionage tactics to infiltrate critical sectors.
Hacktivist groups are increasingly targeting Latin American governments and corporations, employing sophisticated cyber espionage tactics to advance political and environmental agendas.
Hacktivist groups are increasingly targeting Central Asia's critical infrastructure through long-term implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting, posing a critical threat.
Recent cyber espionage campaigns and ransomware attacks in East Asia have escalated, with state-backed actors and ransomware groups intensifying operations targeting government and corporate entities.
Recent cyber espionage campaigns in South Asia have targeted critical infrastructure, employing sophisticated implants and supply chain compromises to gather intelligence.
Recent cyber espionage campaigns by nation-state actors have escalated in North America, leveraging advanced AI tools to infiltrate critical infrastructure and corporate networks.
Hacktivist groups are increasingly targeting Central Asia with sophisticated cyber espionage operations, focusing on long-term implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting.
Recent cyber espionage campaigns in Eastern Europe have intensified, with state-sponsored actors deploying sophisticated malware and exploiting zero-day vulnerabilities to infiltrate government and corporate networks.
Recent cyber espionage activities in Eastern Europe have intensified, with APT groups deploying long-term implants, compromising supply chains, and targeting diplomatic communications.
Recent geopolitical tensions in the Middle East have led to a significant increase in cyber espionage activities targeting government and corporate entities across the region.
South Asian ransomware groups are increasingly integrating cyber espionage techniques, targeting critical infrastructure and diplomatic entities to enhance their operational effectiveness.
The Golden Falcon Team, a pro-Russian hacktivist collective, has intensified cyber espionage activities in Central Asia, leveraging sophisticated malware and DDoS attacks to advance geopolitical objectives.
African ransomware groups are increasingly employing cyber espionage tactics, including long-term implants and supply chain compromises, to enhance their operations and intelligence collection capabilities.
Chinese state-sponsored group Silver Dragon, linked to APT41, has been conducting cyber-espionage campaigns targeting government entities in Southeast Asia and Europe since mid-2024.
Cybercriminals are deploying long-term espionage implants and supply chain compromises to infiltrate Latin American organizations, with a focus on SIGINT-linked intrusions and diplomatic targeting.
Latin America faces a critical rise in cyber espionage, with APT-C-36 and other cybercriminals targeting government and corporate entities, exploiting vulnerabilities and deploying sophisticated malware.
APT28's 'Operation MacroMaze' employs spear-phishing and sophisticated malware to infiltrate Western European entities, highlighting the evolving nature of cyber espionage.
Recent cyber espionage campaigns in the Middle East, notably by the BQT.Lock ransomware group, have intensified, targeting critical infrastructure and government entities, posing significant security risks.
Recent cyber espionage activities by advanced persistent threat (APT) groups have intensified in Africa, focusing on government entities and critical infrastructure sectors.
APT41, a China-linked advanced persistent threat group, has launched a sophisticated cyber-espionage campaign targeting U.S.-based policy institutions, exploiting multiple vulnerabilities to gain unauthorized access.
China's state-sponsored cyber espionage activities in East Asia have intensified, targeting diplomatic entities, supply chains, and critical infrastructure, posing a critical threat to regional security.
Hacktivist groups in Latin America are increasingly targeting government and corporate entities, employing sophisticated cyber espionage tactics to extract sensitive information and disrupt operations.
Recent developments in Southeast Asia reveal a shift in cyber espionage tactics, with ransomware groups increasingly engaging in long-term implants, supply chain compromises, and diplomatic targeting.
Recent cyber espionage activities in East Asia have intensified, with state-sponsored actors targeting critical sectors through sophisticated, long-term intrusions.
Advanced Persistent Threat (APT) groups are increasingly targeting Southeast Asia with sophisticated cyber espionage tactics, including long-term implants, supply chain compromises, and SIGINT-linked intrusions.
Recent cyber espionage campaigns in South Asia have seen heightened activity from advanced persistent threat (APT) groups, targeting government and defense sectors to gather sensitive intelligence.
Advanced Persistent Threat (APT) groups are increasingly targeting Southeast Asia with sophisticated cyber espionage campaigns, leveraging long-term implants, supply chain compromises, and SIGINT-linked intrusions to gather intelligence and disrupt diplomatic operations.
Ransomware groups are increasingly engaging in cyber espionage activities targeting Latin American governments and corporations, exploiting the region's cybersecurity vulnerabilities.
APT41's recent cyber espionage campaigns have intensified, focusing on North American supply chains and diplomatic entities, employing sophisticated implants and SIGINT-linked intrusions.
Iranian APT groups, notably MuddyWater, have intensified cyber espionage campaigns against Middle Eastern diplomatic and energy sectors, deploying sophisticated malware to exfiltrate sensitive intelligence.
Russian state-sponsored cyber actors are increasingly targeting Eastern European supply chains and diplomatic entities to gather intelligence and disrupt regional stability.
Hacktivist groups are increasingly targeting African governments and critical infrastructure, employing sophisticated cyber espionage tactics to advance geopolitical agendas.
Ransomware groups are increasingly targeting African supply chains and diplomatic communications, posing critical cyber espionage threats.
Recent hacktivist cyber espionage campaigns have targeted East Asia's critical infrastructure, including government agencies and telecom operators, with medium-level threat implications.
Hacktivist groups are increasingly targeting Southeast Asia with long-term espionage implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting, posing a medium-level threat.
APT-C-36, also known as Blind Eagle, has been targeting Latin American governments and financial institutions since 2018, employing sophisticated tactics to extract sensitive information.
Cybercriminals are deploying sophisticated long-term implants and supply chain attacks to infiltrate Southeast Asia's critical sectors, posing significant risks to national security and economic stability.
New ransomware groups are increasingly targeting critical infrastructure in Western Europe, employing sophisticated tactics to infiltrate and disrupt operations.
Hacktivist groups are increasingly targeting Central Asia with long-term espionage implants, compromising supply chains, and conducting SIGINT-linked intrusions, posing medium-level threats to diplomatic and economic stability.
Advanced Persistent Threat (APT) groups are intensifying cyber espionage campaigns in Latin America, employing sophisticated techniques to infiltrate government and corporate networks.
Latin American ransomware groups are increasingly engaging in cyber espionage, targeting supply chains, SIGINT-linked intrusions, and diplomatic entities to collect intelligence.
APT-C-36, also known as Blind Eagle, has been actively targeting Latin American governments and corporations since 2018, employing sophisticated cyber espionage tactics to infiltrate critical sectors.
Recent intelligence indicates that ransomware groups are leveraging supply chain vulnerabilities and targeting diplomatic entities in Central Asia for espionage activities.
Recent cyber espionage campaigns in Central Asia have seen advanced persistent threat (APT) groups targeting government and corporate sectors, posing significant risks to national security and economic stability.
Recent cyber espionage activities targeting African diplomatic entities and supply chains underscore a high-level threat from cybercriminals aiming to extract sensitive information and disrupt critical infrastructure.
Recent hacktivist cyber espionage campaigns have targeted East Asia's critical infrastructure, including government agencies and telecom operators, with a focus on economic and geopolitical intelligence collection.
Nation-state actors are increasingly targeting Latin America with sophisticated cyber espionage operations, leveraging long-term implants, supply chain compromises, and SIGINT-linked intrusions to gather intelligence and disrupt diplomatic activities.
Recent analyses reveal sustained cyber espionage campaigns by advanced persistent threat (APT) groups in Eastern Europe, targeting government and military entities.
Recent ransomware activities in Central Asia have evolved, with groups like Royal and BianLian targeting critical infrastructure and diplomatic entities. This briefing analyzes these developments and offers strategic recommendations.
Recent cyber espionage activities in Southeast Asia have seen hacktivist groups targeting government and critical infrastructure sectors, employing sophisticated techniques to maintain long-term access.
Recent cyber espionage campaigns in Southeast Asia have targeted critical infrastructure, utilizing long-term implants, supply chain compromises, and SIGINT-linked intrusions to gather sensitive information.
Recent cyber espionage campaigns in South Asia have seen the rise of new APT groups employing sophisticated tactics to target critical sectors, posing significant security challenges.
APT-C-36, also known as Blind Eagle, has been actively targeting Latin American governments and organizations since 2018, employing sophisticated cyber espionage tactics to infiltrate critical sectors.
Recent geopolitical tensions in the Middle East have intensified cyber espionage activities, with state-sponsored and hacktivist groups targeting government and diplomatic networks across the region.
Silent Lynx, a sophisticated APT group, has intensified cyber espionage operations in Central Asia, focusing on diplomatic and critical infrastructure sectors.
Iranian state-sponsored cyber actors have escalated espionage activities targeting Middle Eastern governments and critical infrastructure, coinciding with heightened geopolitical tensions.
Advanced Persistent Threat (APT) groups are intensifying cyber espionage operations in Africa, focusing on government, energy, and telecommunications sectors to exfiltrate sensitive data and disrupt critical infrastructure.
Hacktivist groups in Latin America are increasingly targeting government and corporate entities, employing sophisticated cyber espionage tactics to advance ideological and environmental agendas.
Hacktivist groups are increasingly targeting North American infrastructure through long-term espionage implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting.
In 2026, Africa faces escalating cyber espionage campaigns targeting critical infrastructure and high-profile entities, with state-sponsored actors leveraging advanced tactics to infiltrate and exfiltrate sensitive information.
Nation-state actors are increasingly targeting Central Asia with sophisticated cyber espionage operations, employing long-term implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting to achieve strategic objectives.
APT28, a Russian state-sponsored group, has been exploiting CVE-2026-21509 to target Eastern European government entities, highlighting a significant escalation in cyber espionage activities.
Latin America faces a surge in cyber espionage activities, with cybercriminals leveraging long-term implants, supply chain compromises, and SIGINT-linked intrusions to target diplomatic entities.
Recent cyber espionage campaigns have intensified in Latin America, with APT groups employing sophisticated tactics to infiltrate government and corporate networks.
Ransomware groups are increasingly engaging in cyber espionage, deploying long-term implants, compromising supply chains, and targeting diplomatic entities in North America, posing a critical threat to national security.
Recent analyses indicate a surge in state-sponsored cyber espionage activities targeting African nations, with advanced persistent threats (APTs) exploiting geopolitical tensions and technological advancements.
Cybercriminals are increasingly targeting Latin America's critical infrastructure through long-term espionage implants, supply chain compromises, and SIGINT-linked intrusions, posing a medium-level threat to the region.
Latin America faces a critical escalation in nation-state cyber espionage, with advanced persistent threats targeting government and corporate entities.
Latin America faces escalating cyber espionage threats, with cybercriminals deploying long-term implants, compromising supply chains, and targeting diplomatic entities.
Recent state-sponsored cyber espionage campaigns have escalated across Africa, targeting critical infrastructure and high-profile entities, reflecting a significant rise in geopolitical tensions.
Hacktivist groups in Latin America are increasingly deploying long-term espionage implants, compromising supply chains, and targeting diplomatic entities, posing a high-level threat to regional cybersecurity.
Hacktivist groups, notably the Golden Falcon Group, are escalating cyber espionage activities in Central Asia, targeting critical infrastructure and government entities.
Recent cyber espionage activities in South Asia have seen ransomware groups exploiting supply chains and diplomatic channels to conduct intelligence collection, posing a high-level threat to regional security.
Ransomware groups are increasingly targeting African governments with sophisticated cyber espionage campaigns, leveraging advanced tools and AI-driven tactics to infiltrate critical infrastructure.
In 2026, state-sponsored cyber espionage groups have intensified operations in Africa, focusing on long-term implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting.
Recent cyber espionage campaigns have intensified, with nation-state actors employing advanced tactics to infiltrate North American corporate and government networks, posing critical threats to national security.
An analysis of recent cyber espionage activities in Western Europe reveals sustained threats from state-sponsored APT groups targeting supply chains, diplomatic entities, and critical infrastructure.
Recent intelligence indicates a surge in ransomware groups conducting cyber espionage campaigns in Central Asia, targeting both government and corporate sectors. These operations pose a critical threat to regional security and economic stability.
Ransomware groups are increasingly targeting Africa's expanding digital infrastructure, employing long-term espionage implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting to collect intelligence.
Recent cyber espionage campaigns have escalated, with state-sponsored actors targeting critical sectors in North America, employing sophisticated techniques to infiltrate defense, technology, and government entities.
Latin America faces heightened cyber espionage threats from nation-state actors, with long-term implants, supply chain compromises, and SIGINT-linked intrusions targeting diplomatic entities.
Recent cyber espionage campaigns in Eastern Europe, attributed to state-sponsored actors, have targeted critical infrastructure and government entities, reflecting escalating geopolitical tensions.
An analysis of recent hacktivist cyber espionage activities in Eastern Europe, focusing on long-term implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting.
Hacktivist groups in Central Asia are increasingly engaging in cyber espionage, targeting critical infrastructure and government entities, with heightened activity observed since early 2026.
Recent cyber espionage activities in South Asia have seen ransomware groups deploying long-term implants, compromising supply chains, and targeting diplomatic entities, posing significant security risks.
Recent state-sponsored cyber espionage campaigns have escalated in Western Europe, targeting critical infrastructure and defense sectors, reflecting a high-level threat to regional security.
An analysis of ongoing cyber espionage activities in East Asia reveals sustained operations by state-sponsored APT groups targeting critical infrastructure, supply chains, and diplomatic entities.
APT28's 'MacroMaze' campaign employs social engineering and macro malware to infiltrate European organizations, highlighting the evolving threat landscape.
Hacktivist groups are increasingly targeting North American infrastructure through long-term espionage implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting, posing a high-level threat.
Recent state-sponsored cyber espionage campaigns have targeted critical infrastructure across East Asia, with China and North Korea identified as primary actors.
African ransomware groups are increasingly targeting supply chains to implant long-term espionage tools, compromising critical infrastructure and diplomatic communications.
Cybercriminals are increasingly targeting Latin America with sophisticated supply chain attacks and SIGINT-linked intrusions, posing critical threats to regional security.
APT41, a Chinese-speaking cyber espionage group, has targeted African government IT services, deploying tools like Pillager and Checkout to steal sensitive data.
Cybercriminals are increasingly deploying long-term espionage implants and supply chain compromises to infiltrate North American infrastructure, posing significant risks to national security.
A surge in hacktivist cyber activities has intensified in the Middle East, targeting critical infrastructure and government entities, following recent geopolitical tensions.
State-sponsored cyber espionage campaigns are increasingly targeting Southeast Asia's critical infrastructure, utilizing sophisticated techniques to infiltrate networks and exfiltrate sensitive data.
Pro-Russian hacktivist groups, notably NoName057(16) and CyberVolk, have escalated cyber espionage activities targeting Western European entities, employing advanced tactics to infiltrate critical infrastructure and government systems.
Latin American ransomware groups are increasingly targeting supply chains to implant long-term espionage tools, compromising critical infrastructure and diplomatic entities for intelligence collection.
The Silver Dragon cyber espionage campaign, attributed to a China-nexus threat actor, has been targeting government ministries and public sector organizations across Southeast Asia since mid-2024.
Iranian state-sponsored cyber actors and hacktivist groups have escalated cyber espionage activities targeting U.S., Israeli, and allied critical infrastructure, including DDoS attacks, data wipers, and information operations.
An analysis of recent cyber espionage activities in East Asia reveals a shift towards long-term implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting by ransomware groups.
Recent cyber espionage campaigns in East Asia have seen advanced persistent threat (APT) groups targeting critical infrastructure and sensitive data, posing significant risks to regional security.
An analysis of ongoing cyber espionage activities in East Asia reveals persistent threats from cybercriminal groups employing long-term implants, supply chain compromises, and SIGINT-linked intrusions targeting diplomatic entities.
Recent cyber espionage campaigns and ransomware attacks have intensified in Western Europe, posing significant threats to government and corporate entities.
Sophisticated ransomware groups are increasingly employing cyber espionage techniques in Southeast Asia, compromising supply chains and targeting diplomatic entities to enhance intelligence collection.
Pro-Russia hacktivist groups have intensified cyber espionage activities against North American critical infrastructure, exploiting vulnerabilities to infiltrate systems and exfiltrate sensitive data.
Russian state-sponsored cyber actors are increasingly targeting Eastern European nations with long-term espionage implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting.
Hacktivist groups have intensified cyberattacks on South Asian infrastructure, exploiting geopolitical tensions and vulnerabilities in critical sectors.
Recent cyber espionage campaigns in Southeast Asia have seen advanced persistent threats (APTs) targeting critical infrastructure, employing long-term implants, supply chain compromises, and SIGINT-linked intrusions.
Recent cyber espionage campaigns in East Asia have targeted critical infrastructure and government entities, with notable activities attributed to Chinese state-sponsored groups.
Hacktivist groups are increasingly targeting African diplomatic entities and supply chains, deploying long-term espionage implants and SIGINT-linked intrusions to collect sensitive information.
New ransomware groups, including BQT.Lock and CyberVolk, are increasingly targeting East Asian entities, leveraging geopolitical conflicts to enhance their operations.
Russian state-sponsored cyber actors are increasingly targeting Eastern European nations with long-term espionage implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting, posing a critical threat to regional security.
Recent months have seen a surge in cyber espionage activities by state-sponsored Advanced Persistent Threats (APTs) targeting Western European entities, employing sophisticated techniques to infiltrate and exfiltrate sensitive information.
Latin American nations face escalating cyber espionage threats from ransomware groups exploiting supply chains and diplomatic channels for intelligence collection.
Advanced Persistent Threats (APTs) and hacktivist groups are increasingly targeting African nations, posing significant risks to governmental and corporate entities.
Latin America faces a surge in cyber espionage activities, with cybercriminals deploying long-term implants, compromising supply chains, and targeting diplomatic entities.
Chinese state-sponsored group Silver Dragon employs sophisticated tactics to infiltrate Southeast Asian government networks, utilizing custom malware and legitimate services to evade detection.
Recent cyber espionage activities in Eastern Europe have seen cybercriminals deploying long-term implants, compromising supply chains for intelligence collection, and targeting diplomatic entities, posing a medium-level threat.
Indonesian hacktivist group INDOHAXSEC has escalated cyberattacks targeting Southeast Asian nations, employing DDoS attacks, ransomware, and data leaks to advance pro-Palestinian causes.
China's Salt Typhoon APT has escalated cyber espionage activities in East Asia, targeting critical infrastructure and diplomatic entities to enhance intelligence collection.
Recent intelligence indicates a surge in cyber espionage activities by advanced persistent threat (APT) groups in East Asia, targeting government and corporate entities with sophisticated, long-dwell intrusions.
Recent cyber espionage activities in the Middle East have seen cybercriminals deploying long-term implants, compromising supply chains, and targeting diplomatic entities, posing significant security risks.
Iranian APT group MuddyWater has expanded its cyber espionage operations to target African government entities, employing sophisticated malware and phishing techniques to infiltrate critical infrastructure.
Nimbus Manticore, an Iranian state-aligned APT, has intensified cyber espionage targeting defense and aerospace sectors in Western Europe since early 2025, employing sophisticated spear-phishing and custom malware.
Latin American nations face escalating cyber espionage threats as ransomware groups exploit supply chains and diplomatic channels for intelligence collection.
Guacamaya, a hacktivist group, has escalated cyber espionage activities targeting Latin American governments and corporations, revealing sensitive information to the public.
Recent cyber espionage activities have intensified in Central Asia, with state-sponsored threat actors targeting critical infrastructure and government entities to gather strategic intelligence.
Sophisticated ransomware groups are increasingly employing cyber espionage techniques in Southeast Asia, compromising supply chains and targeting diplomatic entities to extract sensitive information.
Hacktivist groups have intensified cyber espionage activities against African entities, employing advanced tactics to infiltrate government and corporate networks.
Hacktivist groups are increasingly targeting North American infrastructure through long-term espionage implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting, posing a high-level threat.
Iranian state-sponsored cyber actors have escalated cyber espionage campaigns targeting U.S. and Middle Eastern entities, leveraging advanced malware and exploiting IoT vulnerabilities.
Middle East-based ransomware groups are increasingly engaging in cyber espionage, targeting diplomatic entities and critical infrastructure to gather intelligence and exert geopolitical influence.
Recent cyber espionage campaigns in East Asia, notably by Chinese APT groups like Volt Typhoon and UNC3886, have intensified, targeting critical infrastructure and government entities, posing a critical threat.
Nation-state cyber actors are increasingly targeting Latin American supply chains and diplomatic channels, deploying long-term espionage implants and SIGINT-linked intrusions to collect sensitive information.
Recent cyber espionage activities in East Asia have seen increased ransomware attacks and advanced persistent threats targeting critical infrastructure and government entities.
Iran's cyber espionage activities have intensified, targeting critical infrastructure and diplomatic entities in the Middle East and beyond. This briefing examines recent operations, methodologies, and implications for regional security.
Hacktivist groups have escalated cyber espionage activities in Southeast Asia, targeting government and critical infrastructure sectors, reflecting heightened geopolitical tensions.
Recent cyber espionage activities in Central Asia have revealed sophisticated supply chain compromises and SIGINT-linked intrusions, highlighting the evolving threat landscape.
Recent intelligence indicates a surge in advanced persistent threat (APT) activities targeting North American critical infrastructure, with state-sponsored actors employing sophisticated tactics to infiltrate and exfiltrate sensitive data.
Hacktivist groups are increasingly targeting Western Europe with long-term espionage implants, supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting, posing a high-level threat.
Recent cyber espionage campaigns have intensified, with ransomware groups like Qilin and BlackCat targeting critical infrastructure and government entities in North America, posing significant threats.
Iranian state-affiliated cyber actors have intensified espionage operations targeting critical infrastructure and diplomatic entities in the Middle East, leveraging sophisticated tools and long-term implants.