#Nation-State
All CosmicBytez Labs articles tagged #Nation-State, across news, security advisories, how-to guides, and projects.
- News
DOJ Dismantles Texas 'Laptop Farm' Network Behind $3 Million North Korean IT Worker Scheme
DOJ charged 14 people and raided 40+ Texas laptop farms that funneled $3M to North Korea via fake remote IT workers at 70 US firms.
- News
FBI Seizes Seven Domains, Disrupts Flax Typhoon's MicroScan and FishHub Hacking Tools
FBI and DOJ seized seven domains used by China's Flax Typhoon to run MicroScan and FishHub, tools tied to critical infrastructure intrusions worldwide.
- News
FBI Seizes Seven Domains Behind Flax Typhoon's MicroScan and FishHub Hacking Tools
The FBI seized seven domains used by China-linked Flax Typhoon to run MicroScan and FishHub, tools tied to breaches of global critical infrastructure.
- News
FBI, Allies Expose China-Linked Flax Typhoon Portal Selling Stolen Email Access
FBI and 6 allied nations say China's Integrity Tech ran a portal selling access to emails stolen from Southeast Asian governments and healthcare systems.
- News
US Posts $10 Million Reward for Accused Chinese 'Hafnium' Hacker
State Dept. offers $10M for Zhang Yu, accused in the HAFNIUM Exchange Server campaign that hit 60,000+ US entities.
- News
Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes
Island researchers disclosed a human-operated phishing platform impersonating ChatGPT, Gemini, and Claude ad portals to steal logins and MFA codes.
- News
Attackers Exploited Citrix NetScaler Zero-Day for Weeks Before Detection
Mandiant says a Citrix NetScaler zero-day was exploited for three-plus weeks before detection, hitting dozens of orgs; state-sponsored actors suspected.
- News
China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
China-aligned TA419 impersonated ex-White House officials and an Anthropic staffer to phish AI policy experts via a Microsoft OAuth AitM kit.
- News
Microsoft Says Threat Actors Are Ahead in the Early AI Race
Microsoft's 2026 Digital Defense Report warns attackers are weaponizing AI faster than defenders, cutting exploit timelines to under 24 hours.
- News
Citrix NetScaler Zero-Days Exploited for Weeks Against Government, Finance Targets
Mandiant says state-sponsored actors exploited Citrix NetScaler zero-days CVE-2026-88771/88772 undetected for weeks, hitting government and finance orgs.
- News
Russian APT Star Blizzard Uses 'RedFlick' Infection Chain in Recent Attacks
FSB-linked Star Blizzard shifted to a 'RedFlick' infection chain, hitting 100+ Ukraine-linked orgs since January to deploy the CosmicPulse backdoor.
- News
Mandiant: Suspected State Hackers Exploited NetScaler Zero-Day for Three-Plus Weeks Undetected
Mandiant traced NetScaler zero-day exploitation to Sept. 3, weeks before detection, hitting dozens of orgs tied to suspected state actors.
- News
How Tax Policy Could Help Stop Threat Actors From Breaching US Water Systems
An op-ed argues Congress should clarify existing tax incentives, not new grant programs, to fund cybersecurity at cash-strapped water utilities now.
- News
Chinese Hackers Exploit WordPress, Zyxel Flaws to Steal Government Data
Chinese-speaking actor breached 996 Zyxel switches and 49 orgs via WordPress flaws, stealing 18,566 government records.
- News
Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme
Japan, the US, Germany and Australia detail WaterPlum's 30,000-device haul and Japan's first North Korean laptop farm takedown.
- News
Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repos for C2
Pakistan-aligned APT36 debuts RUSTYSHADE, a Rust backdoor using private GitHub repos for C2, targeting India and Afghanistan govt/defense.
- News
China's FamousSparrow APT Deploys New SparroWocky Backdoor Across Latin America
ESET says China-aligned FamousSparrow deployed a new SparroWocky backdoor against Latin American governments across eight countries.
- News
Anthropic's September 2026 Report Details AI-Assisted Fraud, Espionage & Influence Ops
Anthropic's latest misuse report names groups stealing AI vendor API keys, running fake reseller scams, and using Claude for state-linked ops.
- News
Users in Houthi-Held Yemen Tried to Develop Advanced Weapons With AI, Anthropic Says
Anthropic disrupted a Yemen-based cell that used Claude to build missile guidance software; a test-fired guided rocket failed and no device was fielded.
- News
AI Is Giving Lesser-Resourced Attackers Nation-State-Level Reach, Google Warns
Google's GTIG says criminal and state-backed hackers are using AI to automate attacks at a scale once reserved for well-funded nation states.
- News
DoJ Corrects China Hacking Claim: Agencies Were Targets, Not Victims
The DoJ walked back a claim that NASA, the Fed, and other agencies were breach "victims," clarifying they were targets of China-linked group QTFY.
- News
NovaCookies Campaigns Abuse Genuine Docusign Notifications to Steal Microsoft 365 Sessions
A $320/month AitM phishing kit rides real Docusign notification emails to relay Microsoft 365 logins and steal live session cookies.
- News
U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches
Operation Economic Outcast sanctions ~60 Iran-linked entities including MOIS-affiliated hackers who hit energy, defense, healthcare, and US government.
- Newsletter
Weekly Digest — Issue #32
Oracle WebLogic and Keycloak both land on active-exploitation radar, a critical isolated-vm sandbox escape threatens AI agent stacks, and the US sanctions...
- Newsletter
Weekly Digest — Issue #31
3.5M enterprise records stolen via Azure infostealer campaign, China-nexus APT mass-exploits vCenter in 5 days, and CISA adds Microsoft IKE RCE to KEV.
- News
Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
Iranian nation-state hackers evolved the Cavern C2 framework to tunnel commands through DNS and Google Apps Script, evading detection against Israeli targets.
- News
Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware
China-nexus APT exploits CVE-2026-59310 in VMware vCenter five days post-disclosure, compromising 361 systems in 47 countries with Babuk-derived ransomware.
- News
Lazarus Hackers Exploited Windows Zero-Day to Target Defense Firms
North Korea's Lazarus Group weaponized CVE-2026-68820 in Operation Dream Job, hitting defense and aerospace firms across four countries for five weeks.
- News
The Coordination Gap: How Attackers Are Outpacing Law Enforcement
Threat actors have evolved their strategies faster than law enforcement can coordinate across jurisdictions and agencies, creating a widening gap that...
- News
Russian Hackers Exploit Zimbra Zero-Day Against US, Ukraine Targets
State-sponsored threat group 'Laundry Bear' is weaponizing a Zimbra zero-day using half-click phishing emails that trigger exploitation simply by opening...
- News
Russian APT 'Laundry Bear' Exploited Zimbra Zero-Day with Half-Click Email Attack
Russia-backed Laundry Bear (Void Blizzard/TA488) exploited CVE-2025-66376 — a stored XSS flaw in Zimbra's Classic UI — to compromise US, Ukrainian, and...
- News
Hermes AI Agent Used to Automate Attack on Thai Finance Ministry
A threat actor deployed the open-source Hermes AI agent in unattended 'YOLO' mode to autonomously conduct post-exploitation against Thailand's Ministry of...
- News
South Korea Discloses Data Breach Impacting Diplomats Worldwide
South Korea's Ministry of Foreign Affairs has disclosed a data breach affecting approximately 10,000 diplomatic records after an unidentified attacker...
- News
In Other News: Iran Tracks US Military Phones, CrashStealer macOS Malware, CVD Blueprint
This week's security roundup covers Iranian threat actors tracking US military personnel's phones, the newly discovered CrashStealer macOS infostealer, a...
- Security
CVE-2026-58065: Apache Airflow Git Provider Disables SSH Host Key Verification
The Apache Airflow Git provider runs git-over-SSH with StrictHostKeyChecking=no by default, allowing a network-position attacker to silently impersonate...
- News
China and India-Linked Hackers Both Targeted the Same Pakistani Police Force
SentinelOne researchers discovered that threat actors linked to both China and India independently targeted the Balochistan Police force in Pakistan for...
- News
Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns
SentinelOne researchers have uncovered two years of sustained cyberespionage against Pakistani law enforcement — with China-nexus and India-nexus threat...
- News
China and India Ran Separate Spying Campaigns Against the Same Pakistani Police Force
SentinelOne Labs uncovered parallel nation-state espionage operations by China-linked and India-linked threat actors targeting Pakistani law enforcement,...
- News
Armored Likho APT Targeting Government and Electric Power Entities
Kaspersky researchers have detailed a new campaign by Armored Likho — a threat actor overlapping with Eagle Werewolf — deploying modular RATs and the...
- News
Canada's Spy Agency Reports Hacking Three Criminal Groups in 2025
Canada's Communications Security Establishment publicly disclosed offensive cyber operations against a ransomware-as-a-service gang, a foreign online...
- Newsletter
June 30 Digest: BlueHammer Zero-Day, Ransomware Goes Corporate, AI Supply Chain Risks & Nation-State ICS Threats
A Microsoft Defender zero-day fuels ransomware before any patch exists; researchers dissect how syndicate groups run HR departments and tiered pricing;...
- News
Iran, Russia, and China Target Water Systems for Sabotage
Nation-state attackers from Iran, Russia, and China are breaching water utility systems through weak passwords, exposed PLCs, and poor network...
- News
Hackers Exploit Cisco SD-WAN Zero-Day for Root Access at Telecom Provider
Mandiant has detailed an incident in which threat actors exploited a Cisco SD-WAN zero-day vulnerability to gain the highest possible access level at a...
- News
Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign
A Chinese-speaking advanced persistent threat actor has launched targeted attacks against government entities and critical infrastructure in Southeast...
- News
Russian APT Deploys 'StockStay' Backdoor Against Ukrainian Targets
Turla, a prolific Russian state-sponsored threat actor, has deployed a previously undocumented backdoor dubbed 'StockStay' in espionage operations...
- News
Russian Initial Access Broker Behind FortiBleed Campaign
A Russian-speaking initial access broker has compromised 86,644 verified credentials from over 430,000 internet-facing Fortinet FortiGate devices across...
- News
China-Nexus Actor Spies on US Researchers Undetected for a Year
Google's Threat Intelligence Group discovered and disrupted a sprawling China-nexus espionage campaign that stole RedCAP credentials to silently breach...
- News
Google Exposes China Espionage Group UNC6508 Lurking in Networks Since 2023
Google's Threat Intelligence Group has unmasked UNC6508, a China-linked espionage actor that silently maintained access to critical infrastructure and...
- News
Hostile States Behind Three-Quarters of Attacks on Britain's Critical Infrastructure, Cyber Chief Warns
UK NCSC CEO Richard Horne delivered a stark warning at the RUSI Annual Security Lecture: nation-state adversaries are pre-positioning inside British...
- News
China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade
Sygnia researchers uncovered Velvet Ant, a China-nexus APT that spent close to a decade hidden inside Linux authentication infrastructure by backdooring...
- News
Chinese Hackers Hijack Auth Flow, Spy on Isolated Network for a Decade
Chinese state-sponsored hackers seized complete control of a target organization's authentication infrastructure and maintained undetected access for ten...
- News
Adaptive, Agentic AI Worms Loom as the Next Major Enterprise Threat
Security researchers warn that adaptive agentic AI worms — described as 'viruses with wings and brains' — will likely strike enterprise environments within a…
- News
China-Aligned Groups Ramp Up Attacks: Operation Dragon Weave Hits Czech Republic and Taiwan
Security researchers at Seqrite Labs have uncovered Operation Dragon Weave, a new China-aligned cyber espionage campaign targeting government, research…
- News
As Global Powers Explore Humanoid Robots, Cyber-Risk Looms
Nation-states are racing to dominate the embodied AI and humanoid robotics market, but as governments and militaries integrate these systems, the…
- News
GCHQ Chief: AI Is an 'Unstoppable Force' with Offensive and Defensive Cyber Ramifications
Anne Keast-Butler, head of the UK's GCHQ signals intelligence agency, has warned that artificial intelligence represents an unstoppable force in cyberspace…
- News
Russian Spies Aggressively Targeting Western Technology as Sanctions Bite
Western intelligence officials warn that Moscow's espionage apparatus is deploying cyber spies, hackers, and recruited middlemen to steal dual-use...
- News
UK Cyberspying Chief Calls AI 'an Unstoppable Force' and Warns About Russia
UK signals-intel chief warns AI is reshaping threats as an unstoppable force while Russia escalates hostile gray-zone activity below open conflict.
- News
Iranian APT Targets Aviation, Software Companies With
Nimbus Manticore, an Iranian advanced persistent threat group, has continued operations targeting aviation and software companies during and after the US.
- News
FBI Warns of Kali365 Phishing-as-a-Service Targeting
The FBI has published an advisory on Kali365, a Telegram-based phishing-as-a-service platform that captures legitimate OAuth tokens to gain persistent...
- News
''FrostyNeighbor'' APT Carefully Targets Govt Orgs in Poland, Ukraine
A Belarusian nation-state threat group dubbed FrostyNeighbor is conducting a precise espionage campaign against government organizations in Poland and...
- News
China's 'FamousSparrow' APT Nests in South Caucasus Energy
The China-linked threat group FamousSparrow has expanded its targeting to an Azerbaijani oil and gas company, marking a shift beyond its traditional...
- News
American Duo Sentenced for Hosting Laptop Farms for North
Two U.S. men have been sentenced for operating laptop farms that helped North Korean IT workers fraudulently obtain employment at nearly 70 American...
- News
Deepfake Voice Attacks Are Outpacing Defenses: What
AI-powered voice cloning requires just three seconds of audio to convincingly impersonate executives and employees. Adaptive Security's new research...
- News
Fake CAPTCHA IRSF Scam and 120 Keitaro Campaigns Drive
Researchers at Infoblox and Confiant have uncovered a dual-threat fraud operation active since 2020: fake CAPTCHA pages secretly send up to 50...
- News
Incomplete Windows Patch Opens Door to Zero-Click Attacks
A Microsoft Windows vulnerability originally patched in a prior Patch Tuesday was incompletely remediated, leaving a residual attack surface that...
- News
China-Linked GopherWhisper Infects 12 Mongolian Government
A previously undocumented China-aligned APT group tracked as GopherWhisper has targeted Mongolian governmental institutions, deploying a wide array of...
- News
China-Linked APT GopherWhisper Abuses Legitimate Services
A newly identified Chinese advanced persistent threat group dubbed GopherWhisper has been deploying multiple Go-based backdoors alongside custom loaders...
- News
FIRESTARTER Backdoor Hit Federal Cisco Firepower Device
CISA and the UK's NCSC have revealed that a US federal civilian agency's Cisco Firepower device running ASA software was compromised in September 2025...
- News
Researchers Uncover Pre-Stuxnet 'fast16' Malware Targeting
SentinelOne has discovered 'fast16', a 2005-era Lua-based cyber sabotage implant that predates Stuxnet by five years and targeted high-precision...
- News
Firestarter Malware Survives Cisco Firewall Updates and Security Patches
US and UK cybersecurity agencies are warning about Firestarter, a custom implant that persists on Cisco Firepower and Secure Firewall devices running ASA...
- News
New Jersey Men Sentenced to Combined 17 Years for Running
Two New Jersey men received prison sentences of nine and nearly eight years respectively for operating IT laptop farms that funneled over $5 million to...
- News
Ukraine Confirms APT28 Campaign Targeting Prosecutors and Anti-Corruption Agencies
Ukraine's CERT-UA has confirmed a suspected APT28 espionage campaign targeting Ukrainian prosecutors and anti-corruption agencies, exploiting Roundcube...
- News
In Other News: Cyberattack Stings Stryker, Windows
A weekly roundup of notable cybersecurity stories: Iran-linked hackers wipe 200,000 Stryker devices, the BlueHammer Windows zero-day PoC goes public,...
- News
Russia's Forest Blizzard Harvests Logins via SOHO Router
Russia's APT28 (Forest Blizzard) is conducting a malwareless espionage campaign by modifying a single DNS setting in vulnerable SOHO routers to silently...
- News
APT28 Deploys PRISMEX Malware in Campaign Targeting Ukraine
Russian state-sponsored threat actor APT28 (Forest Blizzard / Pawn Storm) has launched a targeted spear-phishing campaign deploying a newly documented...
- News
Authorities Disrupt APT28 Router DNS Hijacks Targeting
An international law enforcement operation has dismantled FrostArmada, an APT28 campaign that hijacked DNS on compromised MikroTik and TP-Link routers to...
- News
How LiteLLM Turned Developer Machines Into Credential
The TeamPCP threat actor's March 2026 supply chain attack against LiteLLM exposed a dangerous blind spot: developer workstations running local AI agents...
- News
Iran Deploys 'Pseudo-Ransomware,' Revives Pay2Key Operations
Iranian APT groups are increasingly blurring the lines between state-sponsored cyber espionage and financially motivated cybercrime, deploying destructive...
- News
State Department Reissues $10 Million Reward for Info on Iranian Hackers
Hours after the FBI confirmed that Iranian hackers gained access to Director Kash Patel's personal email account, the U.S. State Department reissued a $10...
- News
Stolen Logins Are Fueling Everything From Ransomware to Nation-State Cyberattacks
A new report reveals how industrialized credential theft has become the common thread connecting ransomware campaigns, SaaS platform breaches, and...
- News
Three China-Linked Clusters Target Southeast Asian
Three threat activity clusters aligned with China jointly targeted a Southeast Asian government organization in a complex, well-resourced espionage...
- News
FBI Confirms Hack of Director Patel's Personal Email Inbox
Iran-linked Handala hackers have breached the personal email account of FBI Director Kash Patel, publishing stolen photos and documents in a high-profile...
- News
Iran-Linked Hackers Breach FBI Director's Personal Email
Iran's Handala Hack Team breached the personal email of FBI Director Kash Patel, leaking photos and documents online, while simultaneously launching a...
- News
TA446 Deploys DarkSword iOS Exploit Kit in Targeted
Proofpoint has attributed a targeted email campaign to Russian state-sponsored threat actor TA446, which is leveraging the recently disclosed DarkSword...
- News
DarkSword GitHub Leak Threatens to Turn Elite iPhone
Researchers say the GitHub leak of the DarkSword iOS exploit chain — six chained vulnerabilities targeting iOS 18.4 through 18.7 — threatens to...
- News
FBI Warns Russian Intelligence Targeting Signal and WhatsApp in Mass Phishing Campaign
FBI and CISA alert warns Russian state actors have compromised thousands of messaging accounts belonging to US government officials, military personnel,...
- News
New Speagle Malware Hijacks Cobra DocGuard for State-Sponsored Espionage
A newly discovered .NET infostealer dubbed Speagle repurposes compromised Cobra DocGuard servers for C2 and data exfiltration, targeting organizations...
- News
Google: 90 Zero-Days Exploited in 2025 — Enterprise Tech
Google's Threat Intelligence Group tracked 90 zero-day vulnerabilities actively exploited in 2025, with enterprise software and appliances accounting for...
- News
Cloudflare 2026 Threat Report: 230 Billion Daily Threats as
Cloudflare's inaugural threat intelligence report reveals its network blocks 230 billion cyber threats daily, with DDoS attacks doubling to 47.1 million...
- News
Operation Epic Fury Triggers Unprecedented Cyber Escalation
Following the joint U.S.-Israeli military operation against Iran, Palo Alto Networks Unit 42 reports an unprecedented surge in cyber retaliation with...
- News
China-Linked UNC3886 Breaches All Four Singapore Telecom
Singapore discloses that APT group UNC3886 compromised all four major telecom providers using zero-day exploits and rootkits, triggering the nation's...
- Security
UNC3886 Zero-Day Campaign: Singapore Telecom Operators
Singapore discloses that APT group UNC3886 conducted a targeted espionage campaign against M1, SIMBA, Singtel, and StarHub using a previously unknown...
- News
Shadow Campaigns: State-Backed Espionage Group Breaches 70+
Palo Alto Unit 42 reveals a state-aligned group designated TGR-STA-1030 compromised government and critical infrastructure targets in 37 countries using...
- News
Cyberattacks on Critical Infrastructure Double in Q1 2026
Dragos and Mandiant report a 112% increase in cyberattacks targeting energy, water, and transportation systems in the first quarter of 2026, with...
- News
DKnife: China-Linked AitM Framework Hijacks Router Traffic
Cisco Talos uncovers a seven-component Linux framework called DKnife that compromises routers to intercept credentials, replace downloads with trojans,...
- News
Senator Demands AT&T, Verizon CEOs Testify Over Salt
Senate Commerce Committee Chair Maria Cantwell accuses AT&T and Verizon of blocking Mandiant security reports related to the Salt Typhoon campaign,...
- News
US Treasury Department Confirms Network Breach by State Actors
The US Treasury Department has confirmed a significant cybersecurity incident, attributing the breach to state-sponsored threat actors who accessed...