Group-IB Threat Intelligence performed enrichment and APT hunting based on recent public data about the Tortoiseshell APT group, leading to the discovery of new samples sharing similarities with known...

Proofpoint would like to thank Josh Miller for his initial research on UNK_SmudgedSerpent and contribution to this report. Key findings Between June and August 2025,

YouTube video by O.T. Genasis

Between April and July 2024, Microsoft observed Iranian state-sponsored threat actor Peach Sandstorm deploying a new custom multi-stage backdoor, which we named Tickler.

Suspected Iran-nexus espionage activity targeting the aerospace, aviation and defense industries in Middle East countries.

GigaWiper is a destructive backdoor that combines multiple wiping and ransomware-like capabilities into a single operational platform. This blog analyzes how the malware incorporates code from several...

Ferocious Kitten is an APT group that since at least 2015 has been targeting Persian-speaking individuals who appear to be based in Iran.

YouTube video by PHONKmedia東京

In this article we present research on a malicious npm package that led us to IronWorm: a Rust-built infostealer that scrapes secrets from developer machines, hides behind an eBPF kernel rootkit, and ...

Explore SparkRAT detection tactics, macOS targeting, and insights into recent DPRK-linked campaigns with actionable research findings.

An IRGC-directed persona sabotaged industrial refrigeration and staged a disk-wipe campaign at Israeli facilities during a ceasefire. How the operation unfolded, and how to find the actor before it re...

Overview: This post is long overdue and unlike most of my posts, this is not a technical post, but rather a high level, strategical post, al...

Identifier: TRR260101. Summary RedKitten is a newly identified campaign targeting Iranian interests, likely including non-governmental organizations and individuals involved in documenting recent huma...

Profero IRT reverse engineered a .NET 8 RAT named WindowsAudit.exe recovered from a victim host in April 2026. It uses Discord as primary C2, runs as SYSTEM, tears down EDR in Safe Mode, and ships a f...

See how Lazarus Group's IT workers scheme was exposed on a live camera using real-time monitoring inside ANY.RUN’s sandbox.

MuddyWater targets critical infrastructure in Israel and Egypt, relying on custom malware, improved tactics, and a predictable playbook.

Unmasking Iran’s IRGC Cyber Operations Targeting High-Profile Individuals The SpearSpecter campaign linked to Iran’s IRGC / APT42 used social engineering and the TAMECAT backdoor to infiltrate high-v...

YouTube video by כאן | דיגיטל - תאגיד השידור הישראלי

Tactics, techniques and procedures we discovered during incident response investigations into UNC1549 activity.

During the week, Handala — a group painfully in love with Israel, tried a forward supply chain attack.