APT Threat Intelligence

Advanced Persistent Threats are state-sponsored or state-affiliated hacking groups that conduct long-term espionage and sabotage operations against government, defense, and critical infrastructure targets. defend.network monitors APT activity reported by threat intelligence vendors, government advisories, and incident response disclosures, tracking which groups are active and which sectors they target.

FBI confirms $6.3B Binance heist; critical LXD/MicroCloud flaw; Polymarket $2.7M theft

FBI attributed record $6.3B Binance cryptocurrency heist to North Korean TraderTraitor group. Critical CVSS 10.0 flaw in LXD/MicroCloud enables authentication bypass. Polymarket lost $2.7M to supply-chain script injection; Northflank breach exposed AI API keys.

Volt Typhoon dismantled; PHP RCE active; Microsoft patches 1,400+ flaws

Volt Typhoon's “Silent Train” covert network dismantled after four zero-day campaigns. PHP RCE vulnerabilities affecting 70% of websites under active exploitation. Microsoft releases record 1,400+ patches.

Brotli RCE spans Node.js, Python, Bun; Microsoft patches 1,400 flaws; FBI arrests ShinyHunters negotiator

Google's Brotli decoder flaw (CVE-2026-111497) enables RCE across Node.js, Python, Bun, and Envoy proxies. Microsoft released 1,400+ patches. FBI arrested ransomware negotiation firm executive linked to ShinyHunters data theft.

PHP Critical RCEs Under Active Exploitation; BlackX UEFI Bootkit Targets Diplomats

PHP RCE flaws (CVE-2026-109618/109619) actively exploited on ~70% of sites, 400+ patches, Quest Diagnostics confirms patient data breach.

Critical RCE exploits: PHP, GitLab, LiteLLM under active attack

PHP (70% of websites), GitLab (CVSS 10.0, 12-year reach), and LiteLLM Python package all exploited or compromised. Active in-the-wild attacks detected; immediate patching required.

ConnectWise, BeyondTrust, Drupal: Critical exploits, M365 breach, patched RCEs

ConnectWise compromised credential led attackers to compromise 173 Microsoft 365 tenants. BeyondTrust zero-day in active exploitation by Chinese APT. Drupal patches critical RCEs.

ConnectWise breach affects 173 M365 tenants; Drupal RCEs patched; BeyondTrust exploited

ConnectWise Cloud Backup credential stolen; 173 Microsoft 365 environments compromised. Drupal patches two critical RCEs. Candiru spyware delivered via malicious ads. MALFEX npm package distributes shellcode loader.

BeyondTrust zero-day exploited by Chinese APT; Microsoft patches 1,400 flaws; AOMEI supply-chain compromised

Chinese state-backed APT actively exploiting BeyondTrust zero-day (CVE-2026-102764) for espionage; Microsoft released historic 1,400+ patch bundle for Windows; attackers compromised AOMEI Backupper update infrastructure for months.

PwnEscape kernel RCE, Nextcloud backdoors, ShinyHunters arrests

Critical Linux kernel flaw (CVE-2026-99999) allows VMs to read host memory; Nextcloud servers actively backdoored via Collabora RCE; ShinyHunters leadership arrested as remaining members escalate attacks.

Cisco Email Gateway RCE exploited; Nextcloud backdoors; 3 phishing platforms disrupted

Cisco Secure Email Gateway zero-day actively exploited for unauthenticated RCE; Nextcloud servers backdoored via Collabora vulnerability; Microsoft disrupts three phishing platforms behind 1B+ scam messages; U.S. charges 14 in North Korean IT worker fraud ring.

P7 DarkSword iOS exploits escalate; ShinyHunters arrests surge; AI agents targeted in bank breaches

P7 DarkSword iOS variant adds keychain & crypto-wallet theft; multiple ShinyHunters members arrested across three countries; Chinese threat actor exploited Claude AI agents in South Korean bank attacks.

Flax Typhoon infrastructure seized; Cisco NX-OS RCE patches released

FBI-led international coalition seized Flax Typhoon's MicroScan and FishHub hacking tools. Cisco patched critical NX-OS RCE flaws. Android devices ship with Midnight Mimosa firmware malware enabling proxy abuse.

Citrix NetScaler zero-day under attack; ShinyHunters member detained; DTU breach

Citrix NetScaler CVE-2026-88779 actively exploited in zero-day attacks; patches released. ShinyHunters member detained in Jordan aiding FBI. Danish university DTU breach exposes 200,000 records. TA419 phishing targets U.S. AI policy experts.

Microsoft, Fortra vulnerabilities patched; Warlock escalates SharePoint attacks on critical infrastructure

Microsoft shipped nearly 1,000 patches; Fortra issued critical BoKS updates; Warlock ransomware escalates SharePoint exploits against water utilities, telecom operators, and government bodies in Portuguese/Spanish-speaking regions.

Critical RCEs in GitLab, Dell CSM, SharePoint; Warlock ransomware escalates

GitLab patches critical AI Gateway RCE; Dell CSM flaws grant unauthenticated root access on Kubernetes; Warlock ransomware expands SharePoint exploitation across critical infrastructure in multiple countries.

Cisco SD-WAN, Zimbra, Zammad under attack; active exploitation confirmed

Cisco Catalyst SD-WAN Manager zero-day actively exploited for admin access, Zimbra webshell deployments confirmed

France tax breach, Star Blizzard backdoor campaign, Spectre-v2 BTR CPU flaw disclosed

French tax authority breached via stolen staff passwords; 100+ orgs targeted by Russian Star Blizzard with fake event invitations; Spectre-v2 BTR variant leaks Linux memory despite existing defenses.

Apple zero-day, Microsoft mega-patch (974 CVEs), ShinyHunters Oracle escalation

Apple patched CoreGraphics zero-day (CVE-2026-86950) possibly exploited in targeted attacks; Microsoft released record 974-vulnerability patch batch; ShinyHunters escalated attacks on Oracle PeopleSoft after member arrest.

GitHub Actions re-compromised; North Korea suspected in $351M Bitget heist

Compromised GitHub Actions resumed executing malware after re-gaining access, WSO2, Adobe remain under active exploitation.

OpenAI Codex sandbox escapes, North Korean WaterPlum targets 30K devices globally

Researchers escaped OpenAI Codex sandbox in two ways, enabling host command execution. North Korean WaterPlum campaign infected 30,000 devices and stole $10.7M in cryptocurrency. Hacktron researchers chained OpenAI flaws to access employee accounts and internal code.

Issabel RCE under active exploitation; Microsoft patches 974 CVEs; browser AI assistants hijacked

Issabel Framework vulnerability CVE-2026-89026 (CVSS 9.8) actively exploited for unauthenticated OS command execution. Microsoft issued record 974-CVE patch batch including critical flaws. Browser extension attack hijacks AI assistants across Chrome, Edge, and Claude.

Hardware attack breaks Intel/AMD confidential computing; Gitea RCE exploited across six countries

DDRop hardware attack undermines Intel TDX and AMD SEV-SNP confidential computing. Japan's Digital Agency confirms VPN breach of 246K personnel records. Red Heron exploits Gitea RCE to compromise 13 organizations across six countries.

Check Point VPN & Tencent flaws in active exploitation; RubyGems RCE confirmed

Critical Check Point VPN flaws face imminent exploitation; Tencent Input Method vulnerability deployed for GrayRabbit malware; OpenAI agents linked to May RubyGems RCE campaign gaining server access.

Microsoft 974 patches, GitLab CVSS 10 exploited, Russia weaponizes Claude

Microsoft released 974 patches (largest batch ever); GitLab CVSS 10 flaw exploited within hours; Anthropic disrupted seven China-based labs running Claude distillation attacks and separately detected Russia-linked espionage targeting 20+ government entities.

GitLab CVSS 10 exploited in wild; Microsoft ships 974 patches; Claude abused by state actors

GitLab path-traversal flaw (CVSS 10.0) exploited in-the-wild; Microsoft patches 974 CVEs; Russian state actors abuse Claude for malware rebuilding.

Cisco FMC actively exploited; BlueMoon exploit kit chains Chrome & Windows; AI tokens bypass MFA

Cisco Secure FMC flaw CVE-2026-20079 under active attack; four China-linked espionage groups deployed BlueMoon exploit kit targeting Chrome and Windows; AI user accounts hijacked via infostealer logs to bypass MFA.

Kaspersky, Microsoft, Anthropic hit by infostealers; ransomware escalates AI tools

Infostealer malware targets Anthropic and Microsoft users; Aurora ransomware gang deploys Cursor AI; North Korean threat actors expand beyond IT into healthcare and sales.

AI agents breach Hugging Face; Next.js, PaperCut RCEs exploited; TeamPCP arrests

Hundreds of AI agents coordinated a breach of Hugging Face; Next.js and PaperCut management software face active RCE exploitation; two alleged TeamPCP members arrested in Australia.

Chinese infrastructure disrupted; Kaltura RCE unpatched; NovaCookies targets Microsoft 365

$320/month subscription model.

Rust supply-chain attack, Microsoft patches 398 flaws, Siemens PLCs targeted by AI-generated exploits

Rust crate supply-chain poisoning (245M downloads); Russian cyber espionage hijacking OAuth accounts; Microsoft patches 398 flaws including active exploitation; AI-generated Siemens PLC exploits target U.S. critical infrastructure.

Microsoft, VMware, Apple vulnerabilities actively exploited; CISA KEV additions demand immediate patching

CISA added four actively exploited vulnerabilities affecting Microsoft IKE, VMware vCenter, SharePoint, Dahua devices compromised en masse, and healthcare breaches expose millions.

GitLab, Forminator WordPress, Azure breach: Critical RCEs and 3.6M records stolen

GitLab patched critical GraphQL flaw; Forminator WordPress plugin RCE affects 600K+ sites; threat actor claims 3.6M Azure account records stolen from Fortune 500 companies.

SharePoint, Windows zero-day exploited; Lazarus backdoor in defense sector

SharePoint CVE-2026-55040 (CVSS 9.1) under active exploitation; Lazarus deploys Windows zero-day backdoor targeting defense/aerospace in France, Germany, Brazil, India; 737 malicious Chrome VPN extensions intercept traffic.

Microsoft patches 398 flaws; SharePoint exploited; Lazarus deploys Windows backdoor

Microsoft patched 398 vulnerabilities with one under active exploitation. SharePoint auth bypass (CVE-2026-55040) being exploited post-PoC. Lazarus deployed Windows zero-day backdoor targeting defense/aerospace in 4 countries.

Lazarus Windows zero-day, Adobe CVSS 10.0 patches, 737 malicious Chrome VPN extensions

Lazarus Group exploits patched Windows zero-day to target defense/aerospace in four countries. Microsoft patches 398 vulns; Adobe releases CVSS 10.0 fixes. 737 fake Chrome VPN extensions intercept traffic via attacker proxies.

Windows kernel zero-day exploited; Zoom annotation RCE, Sandworm VPN campaign

Microsoft patched a Windows kernel driver zero-day already exploited in attacks, alongside 420+ other CVEs. Zoom annotation flaws enable zero-click code execution. Sandworm targets IT pros via fake job offers and trojanized VPN clients.

Kimsuky's AI warfare, StormEncryptor ransomware, water infrastructure targeted by Iran

Kimsuky deploys offline AI for phishing and malware automation; StormEncryptor emerges from Medusa affiliate; Iran-linked actors target 12+ U.S. water systems via exposed PLCs.

Linux KVM escape, Cisco SD-WAN patches, Spectre v2 defenses bypassed

Zapscape KVM vulnerability allows privileged guest escape on Linux hosts; Cisco patches 12 SD-WAN/IOS XE flaws including three 9.8 CVSS bugs; researchers bypass Spectre v2 mitigations via interrupt injection.

Google Password Manager passkey hijacking; APT29 hotel Wi-Fi espionage; N-able RMM auth bypass exploited

Malware on Windows machines can hijack Google-synced passkeys without verification. Russian APT29 is actively compromising hotel Wi-Fi globally to steal Microsoft 365 credentials. N-able N-central RMM faces active CVE-2026-18577 exploitation with a second bypass vector discovered post-patch.

North Korea npm attacks, Azure Cosmos DB flaw patched, TeamCity RCE

North Korean hackers confirmed behind Debug and Chalk npm supply-chain attacks; Azure Cosmos DB vulnerability patched after exposing cross-tenant access; Cisco FMC hard-coded password reaches CISA KEV.

Zimbra zero-day exploited by Laundry Bear; Langflow RCE added to KEV

Russian state-sponsored group Laundry Bear exploits Zimbra zero-click vulnerability to steal emails and 2FA codes. new CVEs added to CISA KEV including Langflow RCE and WordPress SQL injection chains.

Adobe ColdFusion RCE, Linux KVM escape, Gitea authentication bypass under active attack

Adobe ColdFusion max-severity RCE actively exploited; Linux KVM escape (CVE-2026-53359) affects Intel/AMD hosts; Gitea Docker auth bypass (CVE-2026-20896, CVSS 9.8) probed within 13 days; Iranian MOIS-linked group deploys new Cavern C2 framework against Israeli IT providers.

Russian intel evolves Signal phishing; Cisco actively exploited; KDDI breach hits 14.2M

Russian intelligence phishing campaign now targets Signal backup recovery keys; Cisco vulnerability under active exploitation with CISA emergency deadline; KDDI email breach exposes 14.2M credentials across six ISPs.

Russian phishing escalates; Turla malware evolves; GitHub AI agents at risk

Russian intelligence expanding Signal phishing to steal backup keys; Turla deploys StockStay malware against Ukraine; AI coding agents tricked into executing malware via GitHub repositories.

China espionage dwell 1 year, Microsoft 200 patches, Cisco SD-WAN actively exploited

China-linked UNC6508 maintained undetected access to North American medical, military, and academic research networks for over a year via compromised REDCap servers. Microsoft issued record 200 patches with evidence of active exploitation. Cisco SD-WAN vManage CVE-2026-20262 exploited in the wild.

Splunk RCE, Arch Linux supply-chain hijack, Velvet Ant decade-long backdoor

Splunk Enterprise CVE-2026-20253 (CVSS 9.8) enables unauthenticated RCE; 400+ Arch Linux AUR packages hijacked with infostealer/rootkit; China-linked Velvet Ant maintained decade-long PAM/OpenSSH backdoor.

Langflow RCE exploited, JDY botnet expands U.S. military targeting, npm security hardened

CVE-2026-5027 in Langflow actively exploited for unauthenticated RCE; JDY botnet expands to 1,500 devices targeting U.S. military networks. CISA mandates 3-day patching for critical flaws.

PAN-OS GlobalProtect actively exploited; Russian infrastructure dismantled; Linux kernel flaw

Palo Alto PAN-OS GlobalProtect authentication bypass (CVE-2026-0257) actively exploited; Dutch authorities arrest two hosting operators supporting Russian cyberattacks; Linux kernel CIFSwitch flaw allows privilege escalation.

GitHub breach, SonicWall VPN MFA bypass, Drupal critical flaw demand patching

GitHub suffered breach of 3,800+ internal repos via TeamPCP. Microsoft disrupted malware-signing operation. SonicWall VPN and Drupal require urgent patching.

FIRESTARTER federal Cisco persistence; Chinese APT GopherWhisper

Critical threats include FIRESTARTER backdoor persistence on federal Cisco devices, Russian military token theft via router exploitation, Chinese APT GopherWhisper attacks, and four actively exploited CISA KEV vulnerabilities with May 2026 federal patching deadline.

FIRESTARTER on federal Cisco gear; 4 critical CVEs added to CISA KEV

FIRESTARTER backdoor persists on federal Cisco infrastructure despite patches; Russian state actors harvesting Office tokens via router exploits; four critical CVEs added to CISA KEV with May 2026 deadline; APT campaigns targeting U.S. defense sector; AI-powered phishing escalates to personalized 1-to-1 attacks.

FIRESTARTER persists on federal Cisco; APT spear-phishes NASA

FIRESTARTER backdoor persists on federal Cisco infrastructure despite patches. Russian military intelligence harvesting Office tokens via router exploits. Chinese APT targeting NASA and defense sector with spear-phishing. AI-powered phishing and FakeWallet credential theft escalating.

Russian APT token theft; Gentlemen ransomware claims 1,570 victims

Russian state-backed APT harvesting Microsoft tokens, 1,570+ Gentlemen ransomware victims, critical SD-WAN and RMM exploits, Windows Defender flaws—urgent patching required across infrastructure.

Adobe zero-day exploited; APT37 attacks; AI-powered exploitation

Critical Adobe zero-day under active exploitation, Russian state-sponsored token harvesting, and APT37 social engineering campaigns compound with AI-powered vulnerability discovery threats.

Iran PLC attacks; Marimo RCE exploited in 10h; GlassWorm IDE infection

Critical threats span Iranian PLC targeting, Russian token harvesting, Marimo RCE exploitation within 10 hours, and GlassWorm IDE infections. Immediate patching and detection deployment required.

Adobe Reader zero-day exploited; APT28 router credential theft

Critical zero-day in Adobe Reader, state-sponsored credential theft via routers, and major supply-chain compromises demand immediate action across all organizations.

APT28 PRISMEX on NATO; ActiveMQ 13-yr RCE; Russian router token theft

APT28 deploys PRISMEX malware targeting NATO allies; 13-year-old ActiveMQ RCE and Russian router-based token theft critical; new botnets and healthcare ransomware disruptions.

APT28 DNS hijack via routers; Iran hits PLCs; Docker RCE

Russian APT28 conducting large-scale DNS hijacking via compromised routers for token theft; Iranian hackers targeting U.S. critical infrastructure PLCs; critical Docker and Flowise vulnerabilities under active exploitation.

Iran & DPRK target Microsoft 365; GitHub C2 supply-chain attacks

State-sponsored APT campaigns targeting Microsoft 365 and supply chains escalate with GitHub C2 usage and zero-day exploits deployed within 24 hours of breach.

FortiClient RCE exploited; DPRK & Chinese APTs hit EU institutions

State-sponsored DPRK and China-linked APT campaigns, critical FortiClient RCE exploit, and cascading supply chain attacks affecting European institutions and npm ecosystem.

TA416 PlugX on EU govts; UNC1069 Axios npm; device code phishing 37x

Nation-state campaigns targeting European governments and supply chain infrastructure. TA416 resumes targeting with PlugX. North Korean UNC1069 compromises Axios npm. Device code phishing surges 37x.

TrueConf zero-day; TA416 hits EU govts; UNC1069 npm compromise

Critical zero-day in TrueConf, resurgent Chinese APT targeting European governments, North Korean npm supply chain compromise, and third-party vendor breaches require immediate response

TrueConf zero-day exploited; North Korea Axios npm compromise

Critical zero-day exploits in TrueConf and North Korean Axios compromise, plus wiper attacks and AI platform over-privilege vulnerabilities demand immediate response across cloud, government, and healthcare sectors.

FBI Director email breached; Citrix & F5 zero-days exploited

FBI Director's email breached by Iran-linked hackers; critical Citrix and F5 vulnerabilities under active exploitation; wiper attacks target Stryker; nation-state exploit kits leaked publicly.

Iran breaches FBI Director email; Citrix & F5 zero-days unpatched

Iran-linked actors breached FBI Director Kash Patel's email and launched wiper attacks on Stryker. Critical Citrix and F5 vulnerabilities under active exploitation with no patches available.

Chinese APT in telecom backbone; Langflow zero-day exploited

State-sponsored Chinese APT embedded in telecom backbone, critical Langflow AI vulnerability actively exploited, wiper malware targeting Iran systems, and zero-click AI assistant vulnerabilities require immediate response.

AI autonomous espionage; device code phishing at 340+ orgs

AI-powered autonomous cyber espionage, device code phishing at 340+ organizations, and critical infrastructure vulnerabilities require immediate defensive action across all sectors.

Russian phishing on Signal/WhatsApp; Oracle RCE exploited

Russian intelligence conducting mass Signal/WhatsApp phishing; critical Oracle RCE vulnerability; Trivy supply-chain attack spreads CanisterWorm across 47+ npm packages; VoidStealer bypasses Chrome encryption; Iran-backed wiper attacks on medical technology.