Advanced Persistent Threats are state-sponsored or state-affiliated hacking groups that conduct long-term espionage and sabotage operations against government, defense, and critical infrastructure targets. defend.network monitors APT activity reported by threat intelligence vendors, government advisories, and incident response disclosures, tracking which groups are active and which sectors they target.
Issabel Framework vulnerability CVE-2026-89026 (CVSS 9.8) actively exploited for unauthenticated OS command execution. Microsoft issued record 974-CVE patch batch including critical flaws. Browser extension attack hijacks AI assistants across Chrome, Edge, and Claude.
DDRop hardware attack undermines Intel TDX and AMD SEV-SNP confidential computing. Japan's Digital Agency confirms VPN breach of 246K personnel records. Red Heron exploits Gitea RCE to compromise 13 organizations across six countries.
Critical Check Point VPN flaws face imminent exploitation; Tencent Input Method vulnerability deployed for GrayRabbit malware; OpenAI agents linked to May RubyGems RCE campaign gaining server access.
Microsoft released 974 patches (largest batch ever); GitLab CVSS 10 flaw exploited within hours; Anthropic disrupted seven China-based labs running Claude distillation attacks and separately detected Russia-linked espionage targeting 20+ government entities.
GitLab path-traversal flaw (CVSS 10.0) exploited in-the-wild; Microsoft patches 974 CVEs; Russian state actors abuse Claude for malware rebuilding.
Cisco Secure FMC flaw CVE-2026-20079 under active attack; four China-linked espionage groups deployed BlueMoon exploit kit targeting Chrome and Windows; AI user accounts hijacked via infostealer logs to bypass MFA.
Infostealer malware targets Anthropic and Microsoft users; Aurora ransomware gang deploys Cursor AI; North Korean threat actors expand beyond IT into healthcare and sales.
Hundreds of AI agents coordinated a breach of Hugging Face; Next.js and PaperCut management software face active RCE exploitation; two alleged TeamPCP members arrested in Australia.
$320/month subscription model.
Rust crate supply-chain poisoning (245M downloads); Russian cyber espionage hijacking OAuth accounts; Microsoft patches 398 flaws including active exploitation; AI-generated Siemens PLC exploits target U.S. critical infrastructure.
CISA added four actively exploited vulnerabilities affecting Microsoft IKE, VMware vCenter, SharePoint, Dahua devices compromised en masse, and healthcare breaches expose millions.
GitLab patched critical GraphQL flaw; Forminator WordPress plugin RCE affects 600K+ sites; threat actor claims 3.6M Azure account records stolen from Fortune 500 companies.
SharePoint CVE-2026-55040 (CVSS 9.1) under active exploitation; Lazarus deploys Windows zero-day backdoor targeting defense/aerospace in France, Germany, Brazil, India; 737 malicious Chrome VPN extensions intercept traffic.
Microsoft patched 398 vulnerabilities with one under active exploitation. SharePoint auth bypass (CVE-2026-55040) being exploited post-PoC. Lazarus deployed Windows zero-day backdoor targeting defense/aerospace in 4 countries.
Lazarus Group exploits patched Windows zero-day to target defense/aerospace in four countries. Microsoft patches 398 vulns; Adobe releases CVSS 10.0 fixes. 737 fake Chrome VPN extensions intercept traffic via attacker proxies.
Microsoft patched a Windows kernel driver zero-day already exploited in attacks, alongside 420+ other CVEs. Zoom annotation flaws enable zero-click code execution. Sandworm targets IT pros via fake job offers and trojanized VPN clients.
Kimsuky deploys offline AI for phishing and malware automation; StormEncryptor emerges from Medusa affiliate; Iran-linked actors target 12+ U.S. water systems via exposed PLCs.
Zapscape KVM vulnerability allows privileged guest escape on Linux hosts; Cisco patches 12 SD-WAN/IOS XE flaws including three 9.8 CVSS bugs; researchers bypass Spectre v2 mitigations via interrupt injection.
Malware on Windows machines can hijack Google-synced passkeys without verification. Russian APT29 is actively compromising hotel Wi-Fi globally to steal Microsoft 365 credentials. N-able N-central RMM faces active CVE-2026-18577 exploitation with a second bypass vector discovered post-patch.
North Korean hackers confirmed behind Debug and Chalk npm supply-chain attacks; Azure Cosmos DB vulnerability patched after exposing cross-tenant access; Cisco FMC hard-coded password reaches CISA KEV.
Russian state-sponsored group Laundry Bear exploits Zimbra zero-click vulnerability to steal emails and 2FA codes. new CVEs added to CISA KEV including Langflow RCE and WordPress SQL injection chains.
Adobe ColdFusion max-severity RCE actively exploited; Linux KVM escape (CVE-2026-53359) affects Intel/AMD hosts; Gitea Docker auth bypass (CVE-2026-20896, CVSS 9.8) probed within 13 days; Iranian MOIS-linked group deploys new Cavern C2 framework against Israeli IT providers.
Russian intelligence phishing campaign now targets Signal backup recovery keys; Cisco vulnerability under active exploitation with CISA emergency deadline; KDDI email breach exposes 14.2M credentials across six ISPs.
Russian intelligence expanding Signal phishing to steal backup keys; Turla deploys StockStay malware against Ukraine; AI coding agents tricked into executing malware via GitHub repositories.
China-linked UNC6508 maintained undetected access to North American medical, military, and academic research networks for over a year via compromised REDCap servers. Microsoft issued record 200 patches with evidence of active exploitation. Cisco SD-WAN vManage CVE-2026-20262 exploited in the wild.
Splunk Enterprise CVE-2026-20253 (CVSS 9.8) enables unauthenticated RCE; 400+ Arch Linux AUR packages hijacked with infostealer/rootkit; China-linked Velvet Ant maintained decade-long PAM/OpenSSH backdoor.
CVE-2026-5027 in Langflow actively exploited for unauthenticated RCE; JDY botnet expands to 1,500 devices targeting U.S. military networks. CISA mandates 3-day patching for critical flaws.
Palo Alto PAN-OS GlobalProtect authentication bypass (CVE-2026-0257) actively exploited; Dutch authorities arrest two hosting operators supporting Russian cyberattacks; Linux kernel CIFSwitch flaw allows privilege escalation.
GitHub suffered breach of 3,800+ internal repos via TeamPCP. Microsoft disrupted malware-signing operation. SonicWall VPN and Drupal require urgent patching.
Critical threats include FIRESTARTER backdoor persistence on federal Cisco devices, Russian military token theft via router exploitation, Chinese APT GopherWhisper attacks, and four actively exploited CISA KEV vulnerabilities with May 2026 federal patching deadline.
FIRESTARTER backdoor persists on federal Cisco infrastructure despite patches; Russian state actors harvesting Office tokens via router exploits; four critical CVEs added to CISA KEV with May 2026 deadline; APT campaigns targeting U.S. defense sector; AI-powered phishing escalates to personalized 1-to-1 attacks.
FIRESTARTER backdoor persists on federal Cisco infrastructure despite patches. Russian military intelligence harvesting Office tokens via router exploits. Chinese APT targeting NASA and defense sector with spear-phishing. AI-powered phishing and FakeWallet credential theft escalating.
Russian state-backed APT harvesting Microsoft tokens, 1,570+ Gentlemen ransomware victims, critical SD-WAN and RMM exploits, Windows Defender flaws—urgent patching required across infrastructure.
Critical Adobe zero-day under active exploitation, Russian state-sponsored token harvesting, and APT37 social engineering campaigns compound with AI-powered vulnerability discovery threats.
Critical threats span Iranian PLC targeting, Russian token harvesting, Marimo RCE exploitation within 10 hours, and GlassWorm IDE infections. Immediate patching and detection deployment required.
Critical zero-day in Adobe Reader, state-sponsored credential theft via routers, and major supply-chain compromises demand immediate action across all organizations.
APT28 deploys PRISMEX malware targeting NATO allies; 13-year-old ActiveMQ RCE and Russian router-based token theft critical; new botnets and healthcare ransomware disruptions.
Russian APT28 conducting large-scale DNS hijacking via compromised routers for token theft; Iranian hackers targeting U.S. critical infrastructure PLCs; critical Docker and Flowise vulnerabilities under active exploitation.
State-sponsored APT campaigns targeting Microsoft 365 and supply chains escalate with GitHub C2 usage and zero-day exploits deployed within 24 hours of breach.
State-sponsored DPRK and China-linked APT campaigns, critical FortiClient RCE exploit, and cascading supply chain attacks affecting European institutions and npm ecosystem.
Nation-state campaigns targeting European governments and supply chain infrastructure. TA416 resumes targeting with PlugX. North Korean UNC1069 compromises Axios npm. Device code phishing surges 37x.
Critical zero-day in TrueConf, resurgent Chinese APT targeting European governments, North Korean npm supply chain compromise, and third-party vendor breaches require immediate response
Critical zero-day exploits in TrueConf and North Korean Axios compromise, plus wiper attacks and AI platform over-privilege vulnerabilities demand immediate response across cloud, government, and healthcare sectors.
FBI Director's email breached by Iran-linked hackers; critical Citrix and F5 vulnerabilities under active exploitation; wiper attacks target Stryker; nation-state exploit kits leaked publicly.
Iran-linked actors breached FBI Director Kash Patel's email and launched wiper attacks on Stryker. Critical Citrix and F5 vulnerabilities under active exploitation with no patches available.
State-sponsored Chinese APT embedded in telecom backbone, critical Langflow AI vulnerability actively exploited, wiper malware targeting Iran systems, and zero-click AI assistant vulnerabilities require immediate response.
AI-powered autonomous cyber espionage, device code phishing at 340+ organizations, and critical infrastructure vulnerabilities require immediate defensive action across all sectors.
Russian intelligence conducting mass Signal/WhatsApp phishing; critical Oracle RCE vulnerability; Trivy supply-chain attack spreads CanisterWorm across 47+ npm packages; VoidStealer bypasses Chrome encryption; Iran-backed wiper attacks on medical technology.
Subscribe free and never miss a threat briefing.