./APT & nation-state activityMon, 19 Oct 2026 12:28:44 GMT https://objective-see.org/blog/blog_0x57.htmlmaxdzcSun, 18 Oct 2026 21:00:39 GMTObjective-See. A sophisticated Lazarus Group implant has arrived on macOS. In this post, we deconstruct the Mac variant of a OSX.Dacls, detailing its install logic, persistence, and capabilities.ResearchMalwareAPT https://objective-see.org/blog/blog_0x54.html16vr7j3Sun, 18 Oct 2026 21:00:39 GMTObjective-See. The Lazarus group's latest implant/loader supports in-memory loading of 2nd-stage payloads. In this post we describe exactly how to repurposing this 1st-stage loader to execute *our* custom 'fileless' payloads!ResearchMalwareAPT https://objective-see.org/blog/blog_0x51.html1f1lzkmSun, 18 Oct 2026 21:00:39 GMTObjective-See. The rather infamous APT group, "Lazarus", continues to evolve their macOS capabilities. Today, we tear apart their latest 1st-stage implant that supports remote download & in-memory execution of secondary payloads!ResearchAPT https://objective-see.org/blog/blog_0x49.html1ayob0xSun, 18 Oct 2026 21:00:39 GMTObjective-See. A new macOS backdoor written by the infamous Lazarus APT group needs analyzing. Here, we examine it's infection vector, method of persistence, capabilities, and more!ResearchAPT https://objective-see.org/blog/blog_0x3D.html1c5963hSun, 18 Oct 2026 21:00:39 GMTObjective-See. The APT group WindShift has been targeting Middle Eastern governments with Mac implants. Let's (continue to) analyze their 1st-stage macOS implant: OSX.WindTail!ResearchAPT https://objective-see.org/blog/blog_0x3B.html1rykklnSun, 18 Oct 2026 21:00:39 GMTObjective-See. The APT group WindShift has been targeting Middle Eastern governments with Mac implants. Let's analyze their 1st-stage macOS implant: OSX.WindTail!ResearchAPT https://securityaffairs.com/201218/breaking-news/security-affairs-newsletter-round-600-by-pierluigi-paganini-international-edition.html1jke1kdSun, 18 Oct 2026 08:37:32 GMTSecurity Affairs. A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. North Korean…APT https://securityaffairs.com/201193/intelligence/north-korean-it-workers-used-stolen-us-identities-to-earn-3-million.htmle1elcjSat, 17 Oct 2026 16:29:10 GMTSecurity Affairs. The FBI raided 40 Texas homes over a North Korean scheme that used fake IT workers to target 70 US companies and generate $3 million. The Justice Department (DoJ) announced coordinated enforcement actions this week targeting North Korea’s long-running scheme…APT https://www.volexity.com/blog/2026/10/16/mind-the-patch-gap-part-3-analysis-with-volexity-volcano-threat-intel-and-mcp/1mb6406Fri, 16 Oct 2026 18:27:25 GMTVolexity. Last month, Volexity published two blog posts in its Mind the (Patch) Gap series. The series details Volexity’s discovery of multiple Chinese threat actors simultaneously using zero-day exploits in Google […]ResearchVulnerabilityZero-dayAPTAI https://cyberscoop.com/china-espionage-attacks-beyondtrust-zero-day-armory-castle/bqhrqfFri, 16 Oct 2026 17:09:09 GMTCyberScoop. Researchers said the first known attack by Armory Castle, also known as UNC5221, occurred almost seven weeks ago. The threat group previously compromised Ivanti and Citrix customers.Zero-dayAPT https://thehackernews.com/2026/10/uat-11985-uses-fake-event-invites-to.html17oqv6dFri, 16 Oct 2026 16:16:44 GMTThe Hacker News. Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing…APTPhishing https://www.cybersecuritydive.com/news/china-espionage-beyondtrust-zero-day-hacker/833240/jobatxFri, 16 Oct 2026 15:01:39 GMTCybersecurity Dive. Researchers say the hacker is harvesting credentials and stealing sensitive information.Zero-dayAPT https://www.rapid7.com/blog/post/tr-rapid7-intelligence-wins-2026-peter-szor-award-outstanding-researchzorn2mFri, 16 Oct 2026 13:00:00 GMTRapid7. Some awards you're happy to receive, while others make you stop for a moment. Receiving the 2026 Péter Szőr Award this week at Virus Bulletin in Seville for our research, BPFdoor in Telecom Networks: Sleeper Cells in the Backbone , was of the latter kind.…ResearchAPTMalware https://therecord.media/beyond-trust-cyberattack-chinad9z2hqFri, 16 Oct 2026 13:00:00 GMTThe Record. An alleged Chinese state-backed group is using a new zero-day affecting BeyondTrust IT support software to conduct espionage attacks.Zero-dayAPT https://www.infosecurity-magazine.com/news/china-actor-beyondtrust-flaw-google/13p8jt2Fri, 16 Oct 2026 10:10:00 GMTInfosecurity Magazine. The suspected PRC-aligned group Armory Castle has been observed exploiting the newly disclosed flaw for long-term persistenceVulnerabilityAPT https://cybersecuritynews.com/beyondtrust-0-day-vulnerability-exploited/1hmg90iFri, 16 Oct 2026 08:17:57 GMTCybersecurity News. A critical zero-day vulnerability in BeyondTrust Remote Support was exploited in late August, weeks before the company disclosed the flaw and released a patch. The suspected China-linked espionage group ARMORY CASTLE used the weakness to access appliances,…VulnerabilityZero-dayAPT https://cybersecuritynews.com/midnight-blizzard-linked-hackers/45bx6aFri, 16 Oct 2026 07:23:31 GMTCybersecurity News. Hackers linked to Midnight Blizzard used Anthropic’s Claude AI to rebuild malware after security tools detected it, helping them keep espionage operations running against Ukrainian and European targets. New research shows that changing a file’s code and hash…APTMalwareAI https://news.risky.biz/risky-bulletin-russia-arrests-datasuckers-hacking-group/1bz78u2Fri, 16 Oct 2026 02:01:33 GMTRisky Bulletin. In other news: Al Jazeera employees targeted with Candiru spyware; US disrupts 40 DPRK laptop farms; OpenAI employee arrested for planting spy device.Law & policyAPT https://unit42.paloaltonetworks.com/ai-campaign-targets-linux-infrastructure/1vf7y91Thu, 15 Oct 2026 22:00:09 GMTUnit 42. Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft.ResearchAPTAI https://securityaffairs.com/201003/apt/silent-lynx-kazakhstan-linked-hackers-target-russian-refinery-and-government.htmlajwfd0Thu, 15 Oct 2026 18:33:35 GMTSecurity Affairs. Silent Lynx, a group likely based in Kazakhstan, targets Russian energy and government entities in espionage campaigns across Central Asia. Researchers from Cisco Talos and Recorded Future published a detailed paper on a threat actor they call Silent Lynx…APT https://opensourcemalware.com/blog/the-opensourcemalwareshow-episode251q4u3igThu, 15 Oct 2026 18:00:00 GMTOpenSourceMalware. GitHub security improvements, GhostAction phishes OSS maintainers, and DoJ shuts down DPRK laptop farmsResearchMalwareAPT https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/hn0p1gThu, 15 Oct 2026 14:00:00 GMTGoogle Threat Intelligence (+4 more sources). Written by: Jayson Frost, Bryce Greathouse, Brian Meyer, John Palmisano, Rajesh Rajeshirke, Steve Rasch, John Wolfram Introduction On October 15, BeyondTrust disclosed a vulnerability, CVE-2026-102764, impacting BeyondTrust Remote Support (formerly Bomgar)…ResearchVulnerabilityZero-dayAPTMalwareAdvisory https://therecord.media/suspected-kazakhstan-phishing-central-asia-espionagez3pgspThu, 15 Oct 2026 13:55:00 GMTThe Record. A roughly 2-year-old cyber-espionage campaign against Central Asian states appears to originate in Kazakhstan, researchers said.APT https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering/s7oh8aThu, 15 Oct 2026 11:00:00 GMTGoogle Threat Intelligence. Written by: Tyler McLellan Introduction Google Threat Intelligence Group (GTIG) and Mandiant investigated a software supply chain compromise campaign targeting the update infrastructure belonging to AOMEI Technology between April 2026 and July 2026. The…ResearchAPTSupply chain https://www.bleepingcomputer.com/news/security/fbi-raids-dprk-it-worker-laptop-farms-in-texas-us-nationals-arrested/y4a9scWed, 14 Oct 2026 19:41:43 GMTBleepingComputer. The U.S. Department of Justice (DoJ) has disrupted the Famous Chollima threat group's operations by arresting two suspects, charging 14 individuals, and seizing nearly 187 laptops used in North Korean remote IT worker schemes. [...]Law & policyAPT https://thehackernews.com/2026/10/us-shuts-down-over-40-laptop-farms.htmlk96mgjWed, 14 Oct 2026 16:34:31 GMTThe Hacker News. The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers and KVM devices as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The indictment charges a mix of U.S. citizens…APT https://www.cybersecuritydive.com/news/north-korea-it-worker-raids-arrests-charges/832968/30g1wtWed, 14 Oct 2026 14:46:07 GMTCybersecurity Dive. The latest operation targeted “laptop farms” across Texas that allegedly aided North Korea’s moneymaking plots.Law & policyAPT https://www.bleepingcomputer.com/news/security/global-takedown-hits-network-behind-1-billion-phishing-messages/l74trlWed, 14 Oct 2026 13:12:52 GMTBleepingComputer (+5 more sources). A massive cybercriminal ecosystem facilitating more than a billion malicious messages targeting over 75,000 organizations across 150 countries has been disrupted by law enforcement agencies and partners worldwide. [...]PhishingLaw & policyAPT https://www.helpnetsecurity.com/2026/10/14/north-korean-it-workers-laptop-farms-arrests/z4vcmeWed, 14 Oct 2026 13:00:49 GMTHelp Net Security. North Korean IT workers used stolen and fabricated identities to land remote jobs at more than 70 US companies, with help from Americans who allegedly kept company-issued laptops running from their homes, according to the US Department of Justice. Arrests in…Law & policyAPT https://www.microsoft.com/en-us/security/blog/2026/10/14/the-hidden-network-inside-the-phishing-infrastructure-ecosystem-powering-global-cybercrime/1jyz4utWed, 14 Oct 2026 13:00:00 GMTMicrosoft Security Blog. Microsoft uncovered a Chinese-language cybercriminal ecosystem, an interconnected network of phishing kit operators (tracked as Storm-2990), and an illicit marketplace (tracked as Storm-3119) selling tools and infrastructure for large-scale phishing. In…ResearchAPTPhishing https://cybersecuritynews.com/famous-chollima/1mk0reqWed, 14 Oct 2026 12:37:23 GMTCybersecurity News. The FBI disrupted several U.S. laptop farms used by North Korean threat group FAMOUS CHOLLIMA in late September 2026, cutting off infrastructure that helped fake remote workers enter American companies. CrowdStrike disclosed the joint operation on October 13,…APTLaw & policy https://www.securityweek.com/us-arrests-two-in-crackdown-on-north-korean-it-worker-laptop-farms/tlqrgbWed, 14 Oct 2026 10:55:21 GMTSecurityWeek. Investigators stormed 40 locations in Texas and seized 187 laptops used by North Korean IT workers to hide their location.Law & policyAPT https://www.recordedfuture.com/blog/tag193-regional-espionage-operationst8gowzWed, 14 Oct 2026 00:00:00 GMTRecorded Future. Explore joint Cisco Talos and Recorded Future research on TAG-193's cyber-espionage operations targeting government across Central Asia and the wider Commonwealth of Independent States (CIS)ResearchAPT https://therecord.media/north-korea-laptop-farms-worker-scams-doj-raids-texas8zyejsTue, 13 Oct 2026 20:55:00 GMTThe Record. More than 40 residences in Texas were the target of a federal operation in September to clamp down on remote worker scams that feed money back to the North Korean regime.Law & policyAPT https://therecord.media/north-korea-hackers-russia-ukrainea13vtgTue, 13 Oct 2026 15:15:00 GMTThe Record. North Korean hackers have been targeting Ukrainian experts in diplomacy, security and international policy amid Pyongyang’s growing military cooperation with Russia.APT https://databreaches.net/2026/10/13/shinyhunters-six-years-of-cybercrime-expert-analysis-and-ransomware-group-perspectives/bwo738Tue, 13 Oct 2026 12:43:12 GMTDataBreaches.net. Back in the day, when my co-author and I would conduct training workshops on neurobehavioral disorders in children and teens, we would always introduce our presentation with an overhead that said, “Two Professionals. Three Opinions.” That remains true for so…RansomwareAPT https://cybersecuritynews.com/kimsuky-operation-gitpower/12qrslyTue, 13 Oct 2026 08:27:25 GMTCybersecurity News. Kimsuky is using GitHub and other trusted code platforms to deliver malware, run commands, and steal data from Ukrainian experts in diplomacy, security, and international policy. The North Korea-linked group’s Operation GitPower combines targeted emails, fake…MalwareAPT https://www.crowdstrike.com/en-us/blog/fbi-disrupts-famous-chollima-operation-with-crowdstrike-assistance/15j2jc4Tue, 13 Oct 2026 05:00:00 GMTCrowdStrike. ResearchAPT https://securityaffairs.com/200847/cyber-crime/shinyhunters-arrest-number-three-a-canadian-ransomware-negotiator.html5uiwb9Mon, 12 Oct 2026 21:26:12 GMTSecurity Affairs. A Canadian ransomware negotiator faces extortion charges in the FBI’s ShinyHunters crackdown. Here’s what is known, and what isn’t. ShinyHunters is the focus of a global FBI investigation, and the crackdown has led to the October 8 arrest of a Canadian…RansomwareLaw & policyAPT https://thehackernews.com/2026/10/weekly-recap-helpdesk-0-days-rogue.htmlnaxpfhMon, 12 Oct 2026 15:16:26 GMTThe Hacker News. Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it. But speed is only part of the…VulnerabilityZero-dayRansomwareMalwareAILaw & policyAPT https://www.schneier.com/blog/archives/2026/10/fbi-arrests-suspect-in-fbi-hacking-case.htmlp6ghc6Mon, 12 Oct 2026 15:01:26 GMTSchneier on Security. In September, hackers from a group called ShinyHunters announced that they stole a trove of FBI data about its own agents. It was an intelligence disaster . Last week, the FBI arrested (alternate link ) someone associated with that crime.RansomwareLaw & policyAPT https://www.securityweek.com/ransomware-response-expert-arrested-in-shinyhunters-fbi-hack-probe/x2y5x4Mon, 12 Oct 2026 10:32:05 GMTSecurityWeek. The suspect is believed to be Edward Dubrovsky, a Canadian cybersecurity executive who was visiting the United States for a conference.RansomwareLaw & policyAPT https://www.infosecurity-magazine.com/news/net-closes-shinyhunters-another/122coiuMon, 12 Oct 2026 10:00:00 GMTInfosecurity Magazine. The FBI has arrested a Canadian cybersecurity executive as it continues its crackdown on ShinyHuntersRansomwareLaw & policyAPT https://news.risky.biz/risky-bulletin-shinyhunters-suspects-arrested-in-us-and-jordan/1q6i43zMon, 12 Oct 2026 02:54:42 GMTRisky Bulletin. In other news: Hackers breach TLD registrars to get Google certs; Qilin member arrested in Japan; Google suspends OSS VRP due to AI spam.RansomwareLaw & policyAPT https://securityaffairs.com/200775/breaking-news/security-affairs-malware-newsletter-round-118.htmlzl7e9tSun, 11 Oct 2026 15:23:21 GMTSecurity Affairs. Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure UAC-0277: ClickFix on compromised websites to…VulnerabilityMalwareSupply chainAPT https://www.bleepingcomputer.com/news/security/cyber-exec-arrested-in-case-allegedly-tied-to-shinyhunters-hackers/le2uvySat, 10 Oct 2026 15:07:54 GMTBleepingComputer. Canadian cybersecurity executive Edward Dubrovsky has been arrested in Pennsylvania in connection with alleged extortion activity that multiple reports have linked to the FBI's ongoing crackdown on the ShinyHunters hacking group. [...]RansomwareLaw & policyAPT https://cyberscoop.com/edward-dubrovsky-cypfer-arrested-fbi-extortion-charges/edjrghSat, 10 Oct 2026 13:35:50 GMTCyberScoop. Details of the case align with the investigation into ShinyHunters’ attack on FBI IT systems.RansomwareLaw & policyAPT https://databreaches.net/2026/10/10/fbi-announces-yet-another-arrest-allegedly-connected-to-the-fbi-jobs-hack/1r5xxttSat, 10 Oct 2026 11:57:52 GMTDataBreaches.net. The FBI is doing another victory dance after arresting someone they allege assisted ShinyHunters with the FBI Jobs attack. Brian Krebs reports: Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian…RansomwareLaw & policyAPT https://krebsonsecurity.com/2026/10/fbi-arrests-founder-of-ransomware-negotiation-firm/15wcc9Sat, 10 Oct 2026 00:17:42 GMTKrebs on Security. Agents with the Federal Bureau of Investigation (FBI) on Thursday arrested the co-founder of a Canadian cybersecurity firm in connection with an investigation into the ShinyHunters hacking group that recently relieved the FBI of sensitive data on thousands of…RansomwareLaw & policyAPT https://thehackernews.com/2026/10/fbi-arrests-another-shinyhunters.html8benqaFri, 09 Oct 2026 17:45:26 GMTThe Hacker News. The FBI has arrested another suspected co-conspirator of ShinyHunters, FBI Director Kash Patel said on October 9 in a post on X. ShinyHunters is the extortion group that said in September it had breached the FBI's jobs portal and stolen sensitive data on…RansomwareLaw & policyAPT https://www.darkreading.com/identity-access-management-security/fbi-shinyhunters-claims-hack1o7854aFri, 09 Oct 2026 17:21:00 GMTDark Reading. In this video conversation, Dark Reading editors discuss some of the news they didn't get a chance to cover, from the arrest of a suspected ShinyHunters operative to the compromise of a Pentagon-run data center.RansomwareLaw & policyAPT https://www.bleepingcomputer.com/news/security/fbi-arrests-another-suspected-shinyhunters-hacker-after-agency-breach/14187fdFri, 09 Oct 2026 17:02:29 GMTBleepingComputer. The FBI has arrested another suspected member of the ShinyHunters extortion group believed to be involved in the recent breach of FBI systems, Director Kash Patel announced Friday. [...]BreachRansomwareLaw & policyAPT https://therecord.media/shinyhunters-arrest-fbi-data-breach-investigation1lb9ltaFri, 09 Oct 2026 15:41:00 GMTThe Record. “We will continue to work closely with our partners to disrupt what’s left of the ShinyHunters group and their associates, no matter where they operate," FBI Director Kash Patel said.BreachRansomwareLaw & policyAPT https://therecord.media/belarusian-cyber-partisans-claim-2023-russia-healthcare-hackjnsf55Fri, 09 Oct 2026 14:40:00 GMTThe Record. The Belarusian Cyber Partisans concurred with Russian research that they indeed spent months inside the network for the Moscow Department of Health.BreachAPT https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.htmlz7zye9Fri, 09 Oct 2026 12:21:51 GMTThe Hacker News. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their abuse by a China-linked threat actor known as Flax Typhoon. The vulnerabilities in…VulnerabilityZero-dayAPT https://securityaffairs.com/200673/security/us-disrupts-china-linked-integrity-tech-cyber-espionage-tools.html10j0qcaFri, 09 Oct 2026 10:49:22 GMTSecurity Affairs. DOJ and FBI seized China-linked hacking tools Microscan and FishHub, linked to Integrity Tech and attacks on critical infrastructure worldwide. The Justice Department and FBI took down two hacking tools this week, Microscan and FishHub, both built and run by…APT https://www.infosecurity-magazine.com/news/uk-allies-threat-china-integrity/1osmcscFri, 09 Oct 2026 10:00:00 GMTInfosecurity Magazine. The UK, US and allies have issued an alert detailing malicious activity linked to China’s Integrity Technology GroupAPT https://www.helpnetsecurity.com/2026/10/09/fbi-flax-typhoon-microscan-fishhub-domains/1nzl74nFri, 09 Oct 2026 09:44:44 GMTHelp Net Security. The FBI seized seven domains used to operate Microscan and FishHub, two hacking tools linked to Chinese state-sponsored hackers known as Flax Typhoon that were used to target critical infrastructure and other organizations in the US and abroad. Seizure notice…APTLaw & policy https://www.securityweek.com/us-disrupts-chinese-state-sponsored-hacking-tools/1rxihjyFri, 09 Oct 2026 08:36:37 GMTSecurityWeek. Flax Typhoon and other APTs used MicroScan and FishHub to scan and hack US and foreign critical infrastructure.APT https://thehackernews.com/2026/10/fbi-seizes-7-domains-disrupts-flax.html1iiovkxFri, 09 Oct 2026 06:39:29 GMTThe Hacker News. The U.S. Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) have announced the disruption of malicious tools used by a China-linked advanced persistent threat group known as Flax Typhoon. To that end, the agencies seized several domains and…Law & policyAPT