Jiang Jintao’s journey from hacker to infosec entrepreneur illustrates the blend of ambition, skill, and changes in China's cybersecurity industry

France condemns in the strongest terms the use by Russia's military intelligence service (GRU) of the APT28 attack group, at the origin of several (…)

Threat hunting is made easier and simpler by combining the power of Censys, GreyNoise, CursorAI, and Censeye.

The Justice Department, FBI, Naval Criminal Investigative Service, and Departments of State and the Treasury announced today their coordinated efforts to disrupt and deter the malicious cyber activiti...

Shodan Trends - Discover how the Internet has changed over time.

Russia state-aligned threat actors target Signal Messenger accounts used by individuals of interest to Russia's intelligence services.

INTRODUCTION The Cl0p group has been active since early 2019, leveraging vulnerabilities and exploits to encrypt files for ransom. The...

We been tracking multiple espionage operations conducted by China-nexus actors utilizing POISONPLUG.SHADOW malware.

The Council imposed restrictive measures on three individuals involved in cyber-attacks against Estonia.

The Council imposed restrictive measures on three individuals involved in cyber-attacks against Estonia.

Discover daily YARA usage at Sekoia.io TDR. Learn how YARA rules identify threats and aid in investigations and DFIR engagements.

The macho module now parses and exposesLC_LINKER_OPTION commands (#256). Raise warning with some patterns that have too many 2-byte atoms and are potentially slow (#264). Extract more information ...

Since January 2024, Microsoft has observed Secret Blizzard using the tools or infrastructure of other threat groups to attack targets in Ukraine and download its custom backdoors Tavdig and KazuarV2.

Discover how Zloader 2.9.4.0 implemented a custom DNS tunneling protocol combined with TLS encryption to evade network detection.

Microsoft has observed Secret Blizzard compromising the infrastructure and backdoors of the Pakistan-based threat actor we track as Storm-0156 for espionage against the Afghanistan government and Indi...

Microsoft’s Digital Crimes Unit (DCU) has seized 256 fraudulent websites linked to ‘MRxC0DER’, who sold phishing kits under the brand names ‘ONNX’ and ‘Caffeine’. This takedown disrupts a significant ...

I wanted to call this repo "Nuclear Football Codes". I was outvoted.. - EmergingThreats/threatresearch

ESET Research has conducted a comprehensive technical analysis of Gamaredon’s toolset used to conduct its cyberespionage activities focused in Ukraine.

In this episode of the Microsoft Threat Intelligence Podcast host Sherrod DeGrippo discusses North Korean threat actors with one of our Microsoft Threat Intelligence researchers and Greg Schloemer focusing on two prominent groups: Onyx Sleet and Storm 0530. Onyx Sleet is a long-standing espionage group known for targeting defense and energy sectors, particularly in the U.S. and India. However, they’ve diversified into ransomware, using tactics like malware downloaders, zero-day vulnerabilities, and a remote access Trojan called D-Track. The conversation also touches on the use of fake certificates and the group's involvement in the software supply chain space.