Cybersecurity articles tagged #APT on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/transparent-tribe-targets-afghan-and-indian-organizationshttps://runtimerebel.com/blog/transparent-tribe-targets-afghan-and-indian-organizationsPakistan-linked Transparent Tribe updates its malware toolset to target Afghan organizations and government agencies in India.Thu, 20 Aug 2026 16:25:29 GMTTransparent TribeAPTCyber EspionageMalwarehttps://runtimerebel.com/blog/ai-driven-cyberattack-targets-apac-government-agencieshttps://runtimerebel.com/blog/ai-driven-cyberattack-targets-apac-government-agenciesA China-linked actor reportedly deployed a near-autonomous AI framework to compromise government agencies in the APAC region, signaling a new threat landscape.Wed, 19 Aug 2026 08:27:30 GMTAICyber EspionageNation StateAPTAsia Pacifichttps://runtimerebel.com/blog/north-korea-attribution-data-breaches-impact-ontrac-uk-educationhttps://runtimerebel.com/blog/north-korea-attribution-data-breaches-impact-ontrac-uk-educationAWS attributes recent hacks to North Korea. OnTrac and the UK Department for Education report significant data breaches, impacting over 600,000 records.Fri, 31 Jul 2026 17:43:11 GMTNorth KoreaAPTData BreachOntracUK Department for EducationAWShttps://runtimerebel.com/blog/google-unified-threat-actor-naming-tag-and-mandiant-convergencehttps://runtimerebel.com/blog/google-unified-threat-actor-naming-tag-and-mandiant-convergenceGoogle unifies threat actor naming across TAG and Mandiant to streamline attribution and improve intelligence sharing for security operations teams.Tue, 28 Jul 2026 10:39:08 GMTGoogle TAGMandiantThreat AttributionAPTCybersecurity Standardshttps://runtimerebel.com/blog/multi-threat-brief-ai-malware-zimbra-exploits-linux-kernel-flawshttps://runtimerebel.com/blog/multi-threat-brief-ai-malware-zimbra-exploits-linux-kernel-flawsAnalysis of recent threats including DolphinX AI malware, state-sponsored Zimbra exploits, Siemens industrial switch vulnerabilities, and 400 Linux kernel flaws.Fri, 24 Jul 2026 17:42:24 GMTDolphinXEmerald SleetWinter VivernUNC4841ZimbraLinux KernelSiemens ROX IIIndustrial Control SystemsAPTRansomwareLockBithttps://runtimerebel.com/blog/vipnet-update-mechanism-abused-in-russian-government-targetinghttps://runtimerebel.com/blog/vipnet-update-mechanism-abused-in-russian-government-targetingThreat actors are leveraging the ViPNet private networking suite's update mechanism to distribute malware to Russian government and financial entities.Sun, 19 Jul 2026 17:00:47 GMTViPNetSupply Chain AttackRussian GovernmentInfoTeCSAPThttps://runtimerebel.com/blog/advanced-persistent-threat-tracking-intelligence-for-detectionhttps://runtimerebel.com/blog/advanced-persistent-threat-tracking-intelligence-for-detectionUnderstand the methodologies and critical role of real-time cyber intelligence in detecting and mitigating Advanced Persistent Threat (APT) group activities.Fri, 17 Jul 2026 17:15:19 GMTAPTThreat IntelligenceCybersecurityDetectionThreat ActorsReal Time Intelligencehttps://runtimerebel.com/blog/ai-enhanced-cyber-operations-analyzing-iran-s-asymmetric-playbookhttps://runtimerebel.com/blog/ai-enhanced-cyber-operations-analyzing-iran-s-asymmetric-playbookAnalysis of how Iranian state actors integrate artificial intelligence into cyber operations, influence campaigns, and domestic surveillance for asymmetric gains.Thu, 16 Jul 2026 14:10:25 GMTIranArtificial IntelligenceAPTInfluence OperationsCyber Warfarehttps://runtimerebel.com/blog/parallel-apt-cyber-espionage-targets-balochistan-policehttps://runtimerebel.com/blog/parallel-apt-cyber-espionage-targets-balochistan-policeAnalysis of parallel cyber espionage campaigns by China and India-linked APTs against Pakistan's Balochistan Police, detailed by SentinelOne.Fri, 10 Jul 2026 14:32:36 GMTChinaIndiaPakistanBalochistan PoliceAPTCyber EspionageSentinelOneNation Statehttps://runtimerebel.com/blog/iranian-nexus-tag-182-deploys-markirat-android-surveillancehttps://runtimerebel.com/blog/iranian-nexus-tag-182-deploys-markirat-android-surveillanceRuntime Rebel analyzes Iranian-nexus TAG-182's use of MarkiRAT malware. Disguised as fake VPN/media apps, it conducts cyber surveillance against domestic targets.Thu, 02 Jul 2026 07:41:52 GMTTAG 182MarkiRATIranCyber SurveillanceAndroid MalwareMobile ThreatAPThttps://runtimerebel.com/blog/mustang-panda-exploits-zoho-workdrive-for-c2-in-indian-govt-attackshttps://runtimerebel.com/blog/mustang-panda-exploits-zoho-workdrive-for-c2-in-indian-govt-attacksMustang Panda, a China-aligned APT, targets Indian government and hydropower entities, leveraging Zoho WorkDrive as a C2 channel and deploying new malware.Mon, 29 Jun 2026 17:06:24 GMTMustang PandaAPTZoho WorkDriveIndian GovernmentEspionageC2Cloud Securityhttps://runtimerebel.com/blog/turla-s-stockstay-backdoor-analysis-of-campaigns-winrar-exploithttps://runtimerebel.com/blog/turla-s-stockstay-backdoor-analysis-of-campaigns-winrar-exploitGoogle Threat Intelligence details STOCKSTAY, Turla's .NET backdoor for espionage targeting Ukraine and Europe, leveraging RDP & CVE-2025-8088.Fri, 26 Jun 2026 09:21:08 GMTTurlaSTOCKSTAYKAZUARAPTCyber EspionageUkraineGovernmentMilitaryCVE-2025-8088WinRARNET MalwareFSBhttps://runtimerebel.com/blog/north-korean-apt-targets-developers-via-malicious-toolinghttps://runtimerebel.com/blog/north-korean-apt-targets-developers-via-malicious-toolingNorth Korean threat cluster Contagious Interview exploits developer recruitment and code review phishing to deliver malware via tainted dev tools.Tue, 16 Jun 2026 01:12:25 GMTContagious InterviewFamous ChollimaNorth KoreaAPTPhishingDeveloper ToolsSupply Chainhttps://runtimerebel.com/blog/unc6508-chinese-cyberespionage-targets-north-american-researchhttps://runtimerebel.com/blog/unc6508-chinese-cyberespionage-targets-north-american-researchGoogle's Threat Intelligence Group tracks UNC6508, a Chinese cyberespionage group targeting North American medical, military, and AI research sectors.Mon, 15 Jun 2026 14:23:41 GMTUNC6508Cyber EspionageChinaAPTNorth AmericaMedical ResearchMilitaryAI Researchhttps://runtimerebel.com/blog/chinese-hackers-hijack-auth-flow-for-decade-long-espionagehttps://runtimerebel.com/blog/chinese-hackers-hijack-auth-flow-for-decade-long-espionageChinese state-sponsored hackers maintained long-term access to an isolated network by hijacking the authentication flow, enabling a decade of espionage.Sat, 13 Jun 2026 16:36:15 GMTChinese HackersAuthentication BypassLong Term PersistenceEspionageIsolated NetworkAPThttps://runtimerebel.com/blog/chinese-and-north-korean-apt-activity-surges-across-apac-marketshttps://runtimerebel.com/blog/chinese-and-north-korean-apt-activity-surges-across-apac-marketsChinese and North Korean threat groups are intensifying operations in Asia-Pacific, impacting regional economies and targeting financial institutions for profit.Thu, 11 Jun 2026 09:41:37 GMTLazarus GroupAsia PacificCyber EspionageFinancial CrimeAPThttps://runtimerebel.com/blog/chinese-apt-unc5221-deploys-new-malware-for-m365-persistencehttps://runtimerebel.com/blog/chinese-apt-unc5221-deploys-new-malware-for-m365-persistenceChinese APT UNC5221 leverages new malware, Plenet and AgentPSD, alongside Brickstorm backdoor to maintain persistent access in compromised Microsoft 365 environments for…Fri, 05 Jun 2026 20:41:36 GMTUNC5221Microsoft 365BRICKSTORMPlenetAgentPSDAPTEspionagehttps://runtimerebel.com/blog/greyvibe-threat-actor-leverages-ai-for-cyberattack-operationshttps://runtimerebel.com/blog/greyvibe-threat-actor-leverages-ai-for-cyberattack-operationsRussia-linked GreyVibe threat actors are using AI tools like ChatGPT and Gemini to enhance cyberattacks, signaling a critical evolution in TTPs.Thu, 28 May 2026 20:53:51 GMTGREYVIBEAI in CyberattacksRussia LinkedAPTChatGPTGeminihttps://runtimerebel.com/blog/ghostwriter-targets-ukraine-government-with-prometheus-phishinghttps://runtimerebel.com/blog/ghostwriter-targets-ukraine-government-with-prometheus-phishingBelarus-aligned Ghostwriter (UAC-0057) targets Ukrainian government entities with Prometheus-themed phishing emails to deploy sophisticated malware.Fri, 22 May 2026 20:37:28 GMTGhostwriterUAC 0057UNC1151UkraineGovernmentPhishingPrometheusCERT UAAPThttps://runtimerebel.com/blog/turla-updates-kazuar-backdoor-with-modular-p2p-botnet-capabilitieshttps://runtimerebel.com/blog/turla-updates-kazuar-backdoor-with-modular-p2p-botnet-capabilitiesRussian threat actor Turla (Secret Blizzard) has upgraded its Kazuar backdoor with peer-to-peer botnet functionality and modular architecture for stealth.Sat, 16 May 2026 16:23:51 GMTTurlaSecret BlizzardKAZUARP2P BotnetNET BackdoorAPTRussian Espionagehttps://runtimerebel.com/blog/frostyneighbor-apt-targets-poland-ukraine-gov-with-spear-phishinghttps://runtimerebel.com/blog/frostyneighbor-apt-targets-poland-ukraine-gov-with-spear-phishingBelarussian APT 'FrostyNeighbor' is deploying spear-phishing campaigns against Polish and Ukrainian government entities after unique victim fingerprinting, aiming for…Thu, 14 May 2026 20:38:13 GMTFrostyNeighborAPTBelarusPolandUkraineEspionageSpear PhishingGovernmentNation Statehttps://runtimerebel.com/blog/ghostwriter-targets-ukraine-with-geofenced-pdf-phishing-cobalt-strikehttps://runtimerebel.com/blog/ghostwriter-targets-ukraine-with-geofenced-pdf-phishing-cobalt-strikeGhostwriter (UAC-0057) leverages geofenced PDF phishing to deliver Cobalt Strike against Ukrainian government entities, combining espionage and influence.Thu, 14 May 2026 16:45:40 GMTGhostwriterUAC 0057UkrainePhishingCobalt StrikeAPThttps://runtimerebel.com/blog/muddywater-targets-south-korean-electronics-maker-in-espionage-campaignhttps://runtimerebel.com/blog/muddywater-targets-south-korean-electronics-maker-in-espionage-campaignIran-linked MuddyWater (Seedworm) group launched a cyber-espionage campaign against a major South Korean electronics maker and other global entities.Thu, 14 May 2026 00:55:56 GMTMuddyWaterSeedwormStatic KittenIranCyber EspionageSouth KoreaElectronics MakerAPThttps://runtimerebel.com/blog/muddywater-exploits-microsoft-teams-for-false-flag-ransomwarehttps://runtimerebel.com/blog/muddywater-exploits-microsoft-teams-for-false-flag-ransomwareIranian APT MuddyWater is leveraging Microsoft Teams social engineering to deploy false flag ransomware, obscuring state-sponsored espionage activities.Wed, 06 May 2026 16:38:58 GMTMuddyWaterMicrosoft TeamsRansomwareAPTSocial Engineeringhttps://runtimerebel.com/blog/china-linked-uat-8302-targets-governments-with-custom-apt-malwarehttps://runtimerebel.com/blog/china-linked-uat-8302-targets-governments-with-custom-apt-malwareUAT-8302, a China-linked threat group, targets government entities in South America and SE Europe using custom malware and shared APT toolsets.Tue, 05 May 2026 16:39:00 GMTUAT 8302ChinaAPTCisco TalosCyber Espionagehttps://runtimerebel.com/blog/silver-fox-apt-tax-themed-phishing-delivers-abcdoor-to-india-russiahttps://runtimerebel.com/blog/silver-fox-apt-tax-themed-phishing-delivers-abcdoor-to-india-russiaChina-backed Silver Fox APT targets organizations in India and Russia with over 1,600 tax-themed phishing messages to deploy ABCDoor backdoor and ValleyRAT.Mon, 04 May 2026 16:46:54 GMTSilver FoxABCSDoorValleyRATPhishingIndiaRussiaAPTBackdoorTax Themed Attackshttps://runtimerebel.com/blog/20-years-of-threat-intel-analyzing-adversarial-evolution-since-2006https://runtimerebel.com/blog/20-years-of-threat-intel-analyzing-adversarial-evolution-since-2006Historical analysis of cybersecurity threat evolution over two decades, focusing on the transition from simple exploits to complex APT campaigns.Fri, 01 May 2026 12:30:26 GMTThreat IntelligenceCyber HistoryAPTRansomware Evolutionhttps://runtimerebel.com/blog/lazarus-group-s-2b-crypto-theft-defending-against-supply-chain-attackshttps://runtimerebel.com/blog/lazarus-group-s-2b-crypto-theft-defending-against-supply-chain-attacksAn analysis of Lazarus Group's persistent and financially motivated cyber operations, highlighting over $2B in crypto theft and critical supply chain attack risks.Tue, 28 Apr 2026 16:47:53 GMTLazarus GroupDPRKCryptocurrency TheftSupply Chain AttackFinancial CybercrimeAPThttps://runtimerebel.com/blog/alleged-silk-typhoon-hacker-extradited-cyberespionage-threathttps://runtimerebel.com/blog/alleged-silk-typhoon-hacker-extradited-cyberespionage-threatAn alleged Silk Typhoon hacker, associated with Chinese intelligence, has been extradited to the US, highlighting persistent nation-state cyberespionage threats.Mon, 27 Apr 2026 20:30:07 GMTSilk TyphoonVolt TyphoonCyber EspionageNation StateChinaExtraditionAPThttps://runtimerebel.com/blog/chinese-state-backed-actors-industrialize-botnets-for-covert-opshttps://runtimerebel.com/blog/chinese-state-backed-actors-industrialize-botnets-for-covert-opsChinese state-backed groups are adopting industrialized botnets, utilizing compromised devices for low-cost, low-risk, and deniable cyber operations.Fri, 24 Apr 2026 00:47:01 GMTChinaState BackedBotnetAPTCyber EspionageIndustrialized Botnetshttps://runtimerebel.com/blog/firestarter-backdoor-persistent-threat-to-cisco-firepower-secure-firewallhttps://runtimerebel.com/blog/firestarter-backdoor-persistent-threat-to-cisco-firepower-secure-firewallCISA and NCSC warn of FIRESTARTER, an APT-deployed backdoor maintaining persistence on Cisco Firepower and Secure Firewall devices post-patching.Thu, 23 Apr 2026 16:44:19 GMTFIRESTARTERCisco FirepowerCisco Secure FirewallCisco ASABackdoorAPTCVE-2025-20333CVE-2025-20362LINE VIPERPersistencehttps://runtimerebel.com/blog/gopherwhisper-apt-abuses-outlook-and-slack-for-stealthy-c2https://runtimerebel.com/blog/gopherwhisper-apt-abuses-outlook-and-slack-for-stealthy-c2Newly discovered GopherWhisper APT group uses a Go-based toolkit and legitimate SaaS platforms like Slack and Outlook to conduct espionage against governments.Thu, 23 Apr 2026 12:29:29 GMTGopherWhisperAPTC2OutlookSlackDiscordGo Malwarehttps://runtimerebel.com/blog/sapphire-sleet-s-clickfix-north-korea-targets-macos-usershttps://runtimerebel.com/blog/sapphire-sleet-s-clickfix-north-korea-targets-macos-usersNorth Korea-backed Sapphire Sleet is deploying ClickFix malware via fake job offers and phony Zoom updates to steal macOS user credentials and data.Thu, 16 Apr 2026 20:22:49 GMTSapphire SleetClickFixmacOSNorth KoreaPhishingData TheftAPThttps://runtimerebel.com/blog/iran-geopolitical-tensions-cyber-implications-preparednesshttps://runtimerebel.com/blog/iran-geopolitical-tensions-cyber-implications-preparednessExamine the potential cybersecurity implications of escalating geopolitical tensions involving Iran, focusing on nation-state TTPs and organizational preparedness…Tue, 14 Apr 2026 20:28:00 GMTIranNation StateGeopolitical ThreatCyber WarfareCritical InfrastructureAPTThreat Intelligencehttps://runtimerebel.com/blog/uat-10362-targets-taiwanese-ngos-with-lucidrook-malwarehttps://runtimerebel.com/blog/uat-10362-targets-taiwanese-ngos-with-lucidrook-malwareRuntime Rebel analyzes UAT-10362's sophisticated spear-phishing campaigns deploying new Lua-based LucidRook malware against Taiwanese NGOs and universities.Fri, 10 Apr 2026 00:40:34 GMTUAT 10362LucidRookTaiwanNGOSpear PhishingLua MalwareRust MalwareAPThttps://runtimerebel.com/blog/ta416-targets-european-govts-with-plugx-oauth-phishinghttps://runtimerebel.com/blog/ta416-targets-european-govts-with-plugx-oauth-phishingChina-linked TA416 has resumed targeting European government and diplomatic entities since mid-2025 using PlugX and OAuth-based phishing attacks.Fri, 03 Apr 2026 20:13:24 GMTTA416DarkPeonyPlugXOauth PhishingAPTEuropean GovernmentsChina Linkedhttps://runtimerebel.com/blog/quantum-geopolitics-cyber-threats-in-an-era-of-iran-conflicthttps://runtimerebel.com/blog/quantum-geopolitics-cyber-threats-in-an-era-of-iran-conflictAnalyze how the shift toward quantum geopolitics and Iranian proxy conflicts impact global cyber stability and critical infrastructure protection.Thu, 02 Apr 2026 08:35:45 GMTIranGeopoliticsAPTMiddle EastCritical Infrastructurehttps://runtimerebel.com/blog/iranian-hackers-target-kash-patel-us-offers-10m-bountyhttps://runtimerebel.com/blog/iranian-hackers-target-kash-patel-us-offers-10m-bountyThe FBI confirms Iranian state-sponsored hackers compromised Kash Patel’s personal email, leading the U.S. to offer a $10M reward for information.Mon, 30 Mar 2026 08:42:33 GMTIranFBIKash PatelElection InterferenceState SponsoredAPThttps://runtimerebel.com/blog/china-linked-apt-clusters-target-se-asian-government-via-hiupanhttps://runtimerebel.com/blog/china-linked-apt-clusters-target-se-asian-government-via-hiupanThree China-linked threat clusters targeted a Southeast Asian government in 2025 using HIUPAN, PUBLOAD, and EggStremeFuel malware in a complex espionage operation.Mon, 30 Mar 2026 08:39:27 GMTChinaHiupanPubloadEggstremefuelSoutheast AsiaAPTMalwarehttps://runtimerebel.com/blog/red-menshen-apt-deploys-upgraded-bpfdoor-backdoor-against-telcoshttps://runtimerebel.com/blog/red-menshen-apt-deploys-upgraded-bpfdoor-backdoor-against-telcosChinese APT Red Menshen utilizes an upgraded BPFdoor backdoor to target global telecommunication companies, bypassing traditional defenses.Fri, 27 Mar 2026 20:16:14 GMTRed MenshenBPFdoorAPTTelecommunicationsChinaBackdoorEspionagehttps://runtimerebel.com/blog/red-menshen-bpfdoor-implants-target-telecom-networks-for-espionagehttps://runtimerebel.com/blog/red-menshen-bpfdoor-implants-target-telecom-networks-for-espionageAnalysis of China-linked Red Menshen's long-term campaign using stealthy BPFDoor implants within telecom networks to conduct espionage against government entities.Thu, 26 Mar 2026 20:14:16 GMTRed MenshenEarth BluecrowBPFdoorTelecomEspionageChina NexusAPThttps://runtimerebel.com/blog/russian-intelligence-phishing-targets-signal-and-whatsapp-usershttps://runtimerebel.com/blog/russian-intelligence-phishing-targets-signal-and-whatsapp-usersThe FBI warns of sophisticated phishing campaigns by Russian intelligence targeting Signal and WhatsApp users to harvest credentials and bypass encryption.Sat, 21 Mar 2026 00:33:28 GMTSignalWhatsAppPhishingRussian IntelligenceAPTSocial Engineeringhttps://runtimerebel.com/blog/bitrefill-attributes-cyberattack-to-north-korean-lazarus-grouphttps://runtimerebel.com/blog/bitrefill-attributes-cyberattack-to-north-korean-lazarus-groupBitrefill identifies North Korean Lazarus Group as the perpetrator of a recent cyberattack, underscoring the persistent threat to crypto-focused businesses.Thu, 19 Mar 2026 20:16:23 GMTLazarus GroupBlueNoroffBitrefillCryptocurrencyAPTNorth Koreahttps://runtimerebel.com/blog/sidewinder-apt-expands-southeast-asia-espionage-campaignhttps://runtimerebel.com/blog/sidewinder-apt-expands-southeast-asia-espionage-campaignSideWinder APT targets government and telecom sectors in Southeast Asia using spear-phishing and rotating infrastructure for persistent espionage operations.Wed, 18 Mar 2026 16:31:14 GMTSideWinderAPTSoutheast AsiaSpear PhishingCVE-2017-11882https://runtimerebel.com/blog/konni-group-deploys-endrat-via-phishing-and-kakaotalk-hijackinghttps://runtimerebel.com/blog/konni-group-deploys-endrat-via-phishing-and-kakaotalk-hijackingNorth Korean threat actor Konni leverages spear-phishing and KakaoTalk desktop exploitation to distribute EndRAT malware and facilitate lateral movement.Tue, 17 Mar 2026 12:30:14 GMTKonniEndratKakaotalkAPTSpear Phishinghttps://runtimerebel.com/blog/polands-nuclear-center-targeted-in-suspected-iranian-cyberattackhttps://runtimerebel.com/blog/polands-nuclear-center-targeted-in-suspected-iranian-cyberattackPolish officials investigate a cyberattack at the NCBJ nuclear center. Initial evidence points to Iran, but investigators warn of potential false flag tactics.Mon, 16 Mar 2026 12:25:26 GMTNCBJPolandCritical InfrastructureIranAPThttps://runtimerebel.com/blog/iranian-mois-collusion-with-cybercriminals-evolving-hybrid-threathttps://runtimerebel.com/blog/iranian-mois-collusion-with-cybercriminals-evolving-hybrid-threatIranian state-sponsored APTs, linked to MOIS, are now directly collaborating with cybercriminal organizations, escalating hybrid cyber operations. Defenders must adapt.Fri, 13 Mar 2026 00:35:19 GMTIranMOISNation StateCybercrimeAPTHybrid WarfareThreat Intelligencehttps://runtimerebel.com/blog/tfl-data-breach-and-avira-security-flaws-weekly-threat-briefinghttps://runtimerebel.com/blog/tfl-data-breach-and-avira-security-flaws-weekly-threat-briefingAnalysis of the Transport for London breach affecting 10 million users, Avira antivirus security flaws, and North Korean cyber actor attribution.Fri, 06 Mar 2026 16:21:41 GMTData BreachAvira AntivirusLazarus GroupTfl BreachAPThttps://runtimerebel.com/blog/coruna-exploit-kit-ios-13-17-2-1-targeted-by-multiple-aptshttps://runtimerebel.com/blog/coruna-exploit-kit-ios-13-17-2-1-targeted-by-multiple-aptsGoogle Threat Intelligence Group details Coruna, a powerful iOS exploit kit targeting versions 13.0 to 17.2.1, used by commercial vendors and nation-state actors for…Tue, 03 Mar 2026 16:26:20 GMTCorunaiOSExploit KitWebKit RCEAPTUNC6353UNC6691Commercial SurveillanceZero-DayCVE-2024-23222CVE-2022-48503CVE-2023-43000CVE-2021-30952CVE-2023-32409CVE-2020-27932CVE-2020-27950CVE-2023-32434CVE-2023-41974CVE-2023-38606CVE-2024-23225CVE-2024-23296https://runtimerebel.com/blog/google-disrupts-unc2814-gridtide-infrastructure-after-53-breacheshttps://runtimerebel.com/blog/google-disrupts-unc2814-gridtide-infrastructure-after-53-breachesGoogle disrupts infrastructure of China-nexus threat actor UNC2814 (GRIDTIDE) after 53 breaches across 42 countries targeting government and telecom sectors.Wed, 25 Feb 2026 20:15:13 GMTUNC2814GRIDTIDEChina NexusAPTTelecommunicationsEspionage