Stryker ‘Handala’ incident: global Microsoft environment disruption and reported remote device wipes
Disruptive Iran-nexus hacktivist operation claims large-scale data destruction as Stryker restores services and CISA investigates.
Tags /
#Nation-State Activity
42 reports
BadPaw and MeowMeow: steganographic .NET malware hits Ukrainian targets
A ClearSky report details a new loader and backdoor pair, and Scythe shows how to operationalise it as continuous adversary emulation.
UAT-9244 hits South American telcos with TernDoor, PeerTime and BruteEntry
Cisco Talos links the activity cluster to China-nexus tooling, including CrowDoor variants and ORB-style proxy infrastructure
BadAudio and APT24: “good enough” OPSEC powering a multi-vector espionage chain
Reverse engineering shows pragmatic obfuscation, hardcoded crypto, and cloud-native infrastructure supporting scalable intrusion delivery.
Iran crisis cyber risk rises as defacements and disruptive activity reported
Iran • hacktivists • IRGC • MOIS • DDoS • wipers • ransomware • critical infrastructure
DPRK FAMOUS CHOLLIMA OPSEC failure exposes npm publisher IPs through public disposable inboxes
Affected ecosystem: npm registry and developer tooling supply chain Primary issue: OPSEC leakage from disposable email inbox exposure combined with npm publish notification metadata Exploitation…
DPRK fake interview lures and recruitment-driven access operations summary
DPRK fake interview lures and recruitment-driven malware delivery dprk, contagious interview, deceptiveDevelopment, beavertail, invisibleferret, fake recruiters, coding challenges, it worker…
Threat Actor Profile: APT42 (MITRE G1044)
APT42 is an Iran-aligned cyber espionage and surveillance actor assessed by multiple vendors as state-sponsored. Mandiant assesses with high confidence that APT42 conducts information collection…
APT28 (Fancy Bear / Sofacy / Sednit / Forest Blizzard) - Threat Actor Profile
APT28 is a long-running Russian state-aligned cyber espionage actor widely attributed to the GRU’s 85th Main Special Service Center (GTsSS), military unit 26165, active since at least 2004. (…
U.S. Telecom “Lawful Intercept” Systems Targeted in China-Linked Intrusions (Salt Typhoon)
Public reporting indicates China-linked threat actors compromised multiple U.S. broadband/telecommunications providers, including AT&T, Verizon, and Lumen, with access potentially extending to…
Chinese Surveillance-Grade Data Exposure (631GB / ~4B records) — Threat Intelligence Brief
In May 2025, security researcher Bob Dyachenko (SecurityDiscovery.com) and the Cybernews research team identified a publicly exposed database (~631GB) containing roughly 4 billion records ,…
Nation-State Cyberattacks Escalate: Indian Government Systems and Romanian Elections Under Coordinated Digital Siege
December 2024 marked a sharp escalation in nation-state cyber activity targeting democratic institutions and government infrastructure. Two developments stand out: a sustained rise in cyberattacks…