#Espionage
All CosmicBytez Labs articles tagged #Espionage, across news, security advisories, how-to guides, and projects.
- News
China-Linked Hackers Exploited BeyondTrust Remote Support Zero-Day Since August
Armory Castle exploited CVE-2026-102764 (CVSS 9.3) in BeyondTrust Remote Support since late August, gaining root access and deploying webshells.
- News
FBI, Allies Expose China-Linked Flax Typhoon Portal Selling Stolen Email Access
FBI and 6 allied nations say China's Integrity Tech ran a portal selling access to emails stolen from Southeast Asian governments and healthcare systems.
- News
MI5 Says China's MSS Funded Research Involving 100+ U.K.-Linked Academics
MI5's Sept. 30 Espionage Alert says China's MSS funded AI, cyber, and covert-comms research via front company CGTRI, reaching 100+ U.K. academics.
- News
Cyber Op Targets South Korean Media & Automotive Sectors
A North Korea-aligned APT embedded a custom backdoor in HAProxy load balancers at two South Korean firms, intercepting decrypted traffic for months.
- News
Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries
China-linked actor Red Heron weaponized Gitea RCE CVE-2026-60004 within days, breaching 13 orgs across six countries with a custom implant.
- News
Hackers Exploit Tencent Sogou Input Method Flaw to Deploy GrayRabbit
A China-aligned group chains a Sogou Input Method URI flaw with an outdated Chromium engine for one-click RCE, deploying the GrayRabbit backdoor.
- News
⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
This week's recap: OpenAI agents hit RubyGems, a WeChat zero-click worm, active PaperCut exploitation, AI-assisted espionage, and an F5 rootkit.
- News
Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware
China-nexus APT exploits CVE-2026-59310 in VMware vCenter five days post-disclosure, compromising 361 systems in 47 countries with Babuk-derived ransomware.
- News
Hackers Breach Govt Webmail While Running Parallel Crypto Fraud
China-linked Jewelbug injected malicious JS into 15 govt webmail tenants while simultaneously operating a 44-server industrial crypto fraud empire.
- News
Hotel Wi-Fi Attacks Use Custom Malware to Breach Microsoft 365 Accounts
Russia-linked APT29 subgroup Storm-2945 is hijacking hotel and conference centre Wi-Fi captive portals to steal Microsoft 365 tokens from travelling...
- News
Russian Hackers Exploit Zimbra Zero-Day Against US, Ukraine Targets
State-sponsored threat group 'Laundry Bear' is weaponizing a Zimbra zero-day using half-click phishing emails that trigger exploitation simply by opening...
- News
Russian Laundry Bear Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
A Russian state-sponsored espionage group spent months silently reading Western mailboxes through a zero-click XSS flaw in Zimbra's webmail client —...
- News
South Korea Discloses Data Breach Impacting Diplomats Worldwide
South Korea's Ministry of Foreign Affairs has disclosed a data breach affecting approximately 10,000 diplomatic records after an unidentified attacker...
- News
China and India-Linked Hackers Both Targeted the Same Pakistani Police Force
SentinelOne researchers discovered that threat actors linked to both China and India independently targeted the Balochistan Police force in Pakistan for...
- News
China and India Ran Separate Spying Campaigns Against the Same Pakistani Police Force
SentinelOne Labs uncovered parallel nation-state espionage operations by China-linked and India-linked threat actors targeting Pakistani law enforcement,...
- News
China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
Cisco Talos researchers have identified new LONGLEASH malware deployed by Chinese APT group UAT-7810 to expand its Operational Relay Box network,...
- News
Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign
A Chinese-speaking advanced persistent threat actor has launched targeted attacks against government entities and critical infrastructure in Southeast...
- News
Russian APT Deploys 'StockStay' Backdoor Against Ukrainian Targets
Turla, a prolific Russian state-sponsored threat actor, has deployed a previously undocumented backdoor dubbed 'StockStay' in espionage operations...
- News
China-Nexus Actor Spies on US Researchers Undetected for a Year
Google's Threat Intelligence Group discovered and disrupted a sprawling China-nexus espionage campaign that stole RedCAP credentials to silently breach...
- News
Google Exposes China Espionage Group UNC6508 Lurking in Networks Since 2023
Google's Threat Intelligence Group has unmasked UNC6508, a China-linked espionage actor that silently maintained access to critical infrastructure and...
- News
Chinese Hackers Breach REDCap Servers, Steal Medical Research Data
A China-linked espionage campaign targeted exposed REDCap servers, deploying the InfiniteRed malware to steal sensitive medical research data from a North...
- News
China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade
Sygnia researchers uncovered Velvet Ant, a China-nexus APT that spent close to a decade hidden inside Linux authentication infrastructure by backdooring...
- News
Chinese Hackers Hijack Auth Flow, Spy on Isolated Network for a Decade
Chinese state-sponsored hackers seized complete control of a target organization's authentication infrastructure and maintained undetected access for ten...
- News
Chinese APT UNC5221 Deploys Three New Malware Families to Maintain M365 Access
Chinese espionage group UNC5221 is actively using the Brickstorm backdoor alongside two newly discovered malware families — Plenet and AgentPSD — to maintain…
- News
China-Aligned Groups Ramp Up Attacks: Operation Dragon Weave Hits Czech Republic and Taiwan
Security researchers at Seqrite Labs have uncovered Operation Dragon Weave, a new China-aligned cyber espionage campaign targeting government, research…
- News
Russian Spies Aggressively Targeting Western Technology as Sanctions Bite
Western intelligence officials warn that Moscow's espionage apparatus is deploying cyber spies, hackers, and recruited middlemen to steal dual-use...
- News
Iranian APT Targets Aviation, Software Companies With
Nimbus Manticore, an Iranian advanced persistent threat group, has continued operations targeting aviation and software companies during and after the US.
- News
Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access
Russia's Turla APT has transformed its long-running Kazuar backdoor into a modular peer-to-peer botnet architecture engineered for stealth and deep...
- News
Russian Hackers Turn Kazuar Backdoor into Modular P2P Botnet
Secret Blizzard, a Russian state-sponsored threat group, has evolved its long-running Kazuar backdoor into a sophisticated modular peer-to-peer botnet...
- News
''FrostyNeighbor'' APT Carefully Targets Govt Orgs in Poland, Ukraine
A Belarusian nation-state threat group dubbed FrostyNeighbor is conducting a precise espionage campaign against government organizations in Poland and...
- News
China's 'FamousSparrow' APT Nests in South Caucasus Energy
The China-linked threat group FamousSparrow has expanded its targeting to an Azerbaijani oil and gas company, marking a shift beyond its traditional...
- News
PAN-OS RCE Exploit Under Active Use Enabling Root Access
Palo Alto Networks has disclosed that CVE-2026-0300, a critical CVSS 9.3 buffer overflow in the PAN-OS User-ID Authentication service, is being actively...
- News
Incomplete Windows Patch Opens Door to Zero-Click Attacks
A Microsoft Windows vulnerability originally patched in a prior Patch Tuesday was incompletely remediated, leaving a residual attack surface that...
- News
China-Linked GopherWhisper Infects 12 Mongolian Government
A previously undocumented China-aligned APT group tracked as GopherWhisper has targeted Mongolian governmental institutions, deploying a wide array of...
- News
China-Linked APT GopherWhisper Abuses Legitimate Services
A newly identified Chinese advanced persistent threat group dubbed GopherWhisper has been deploying multiple Go-based backdoors alongside custom loaders...
- News
Ukraine Confirms APT28 Campaign Targeting Prosecutors and Anti-Corruption Agencies
Ukraine's CERT-UA has confirmed a suspected APT28 espionage campaign targeting Ukrainian prosecutors and anti-corruption agencies, exploiting Roundcube...
- News
Adobe Reader Zero-Day Exploited via Malicious PDFs Since
Threat actors have been exploiting an unpatched zero-day in Adobe Reader since at least November 2025, using specially crafted PDFs to fingerprint victims...
- News
Russia's Forest Blizzard Harvests Logins via SOHO Router
Russia's APT28 (Forest Blizzard) is conducting a malwareless espionage campaign by modifying a single DNS setting in vulnerable SOHO routers to silently...
- News
State Department Reissues $10 Million Reward for Info on Iranian Hackers
Hours after the FBI confirmed that Iranian hackers gained access to Director Kash Patel's personal email account, the U.S. State Department reissued a $10...
- News
Three China-Linked Clusters Target Southeast Asian
Three threat activity clusters aligned with China jointly targeted a Southeast Asian government organization in a complex, well-resourced espionage...
- News
FBI Confirms Hack of Director Patel's Personal Email Inbox
Iran-linked Handala hackers have breached the personal email account of FBI Director Kash Patel, publishing stolen photos and documents in a high-profile...
- News
Google Disrupts Massive Chinese Espionage Campaign
Google's Threat Intelligence Group dismantles UNC2814, a China-linked operation that deployed a novel backdoor called GRIDTIDE abusing Google Sheets API...
- News
Leaked Documents Reveal China's 'Expedition Cloud' Cyber
Technical documents leaked from a malware-infected developer device expose a Chinese military-linked training platform that replicates the critical...
- News
APT28 Operation MacroMaze: Russia-Linked Hackers Hit
Russia-linked APT28 targeted government, diplomatic, and defense-adjacent entities across Western and Central Europe from September 2025 to January 2026...
- Security
Dell RecoverPoint Zero-Day Exploited by Chinese APT Since
A maximum-severity CVSS 10.0 hardcoded credentials vulnerability in Dell RecoverPoint for VMs has been under active exploitation by China-nexus threat...
- News
APT28 Weaponizes Microsoft Office Zero-Day in 3 Days
Russia-linked APT28 (Fancy Bear) weaponized Microsoft Office CVE-2026-21509 within days of disclosure, deploying espionage implants against Ukrainian...
- News
All Four Major Nation-State Adversaries Now Weaponizing
Google reports that APT groups from China, Russia, Iran, and North Korea are all actively using Gemini AI for cyber operations including target...
- News
Russian-Linked CANFAIL Malware Targets Ukrainian Defense
Google Threat Intelligence Group attributes a previously undocumented JavaScript malware called CANFAIL to a Russian-linked threat actor targeting...
- Security
Apple Patches Actively Exploited Zero-Day in dyld
Apple releases emergency patches across all platforms for a memory corruption vulnerability in the Dynamic Link Editor (dyld) that was exploited in...
- News
Ex-L3Harris Executive Pleads Guilty to Selling Eight
Peter Williams, former GM of L3Harris's cyber subsidiary Trenchant, admits to selling eight zero-day exploit kits to a Russian broker for $1.3M in...
- News
China-Linked UNC3886 Breaches All Four Singapore Telecom
Singapore discloses that APT group UNC3886 compromised all four major telecom providers using zero-day exploits and rootkits, triggering the nation's...
- Security
UNC3886 Zero-Day Campaign: Singapore Telecom Operators
Singapore discloses that APT group UNC3886 conducted a targeted espionage campaign against M1, SIMBA, Singtel, and StarHub using a previously unknown...
- Newsletter
Global Threat Intelligence & New Tools - Issue #3
This week: state-backed espionage campaigns across 155 countries, China-linked router hijacking, ransomware surge, new security tools, and site updates.
- News
Google Patches Actively Exploited Chrome Zero-Day
Google has released an emergency Chrome update to fix a zero-day vulnerability being actively exploited in targeted attacks against journalists and activists.
- News
US Treasury Department Confirms Network Breach by State Actors
The US Treasury Department has confirmed a significant cybersecurity incident, attributing the breach to state-sponsored threat actors who accessed...