Cybersecurity articles tagged #Cyber Espionage on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/u-s-sanctions-iran-linked-hackers-targeting-critical-infrastructurehttps://runtimerebel.com/blog/u-s-sanctions-iran-linked-hackers-targeting-critical-infrastructureU.S. Treasury sanctions Iran-linked cyber actors, including Mabna Institute members, for critical infrastructure breaches and cyber theft.Wed, 26 Aug 2026 00:41:56 GMTIranSanctionsCritical InfrastructureMOISCyber Espionagehttps://runtimerebel.com/blog/transparent-tribe-targets-afghan-and-indian-organizationshttps://runtimerebel.com/blog/transparent-tribe-targets-afghan-and-indian-organizationsPakistan-linked Transparent Tribe updates its malware toolset to target Afghan organizations and government agencies in India.Thu, 20 Aug 2026 16:25:29 GMTTransparent TribeAPTCyber EspionageMalwarehttps://runtimerebel.com/blog/us-charges-iranian-hackers-in-3-4b-intellectual-property-thefthttps://runtimerebel.com/blog/us-charges-iranian-hackers-in-3-4b-intellectual-property-theftUS charges 17 Iranian hackers from Mabna Institute for a state-sponsored campaign stealing 31.5 TB of academic and corporate intellectual property since 2013.Wed, 19 Aug 2026 16:22:00 GMTIranCyber EspionageDOJMabna InstituteIntellectual Property Thefthttps://runtimerebel.com/blog/ai-driven-cyberattack-targets-apac-government-agencieshttps://runtimerebel.com/blog/ai-driven-cyberattack-targets-apac-government-agenciesA China-linked actor reportedly deployed a near-autonomous AI framework to compromise government agencies in the APAC region, signaling a new threat landscape.Wed, 19 Aug 2026 08:27:30 GMTAICyber EspionageNation StateAPTAsia Pacifichttps://runtimerebel.com/blog/jewelbug-apt-dual-motivation-espionage-crypto-heistshttps://runtimerebel.com/blog/jewelbug-apt-dual-motivation-espionage-crypto-heistsJewelbug APT, a unique 'hackers-for-hire' group, conducts state-sponsored espionage and financially motivated cryptocurrency heists from a single operational panel.Thu, 13 Aug 2026 16:47:11 GMTCyber EspionageCryptocurrency TheftThreat ActorFinancially MotivatedJewelbug APThttps://runtimerebel.com/blog/cve-2025-66376-apt28-exploits-zimbra-zero-click-for-espionagehttps://runtimerebel.com/blog/cve-2025-66376-apt28-exploits-zimbra-zero-click-for-espionageRussian state-sponsored actors exploit a zero-click Zimbra vulnerability (CVE-2025-66376) to exfiltrate sensitive webmail data from targeted organizations.Sat, 08 Aug 2026 08:33:35 GMTCVE-2025-66376ZimbraCyber EspionageZero ClickPhishinghttps://runtimerebel.com/blog/eu-sanctions-russian-intel-officers-for-apt28-cyber-operationshttps://runtimerebel.com/blog/eu-sanctions-russian-intel-officers-for-apt28-cyber-operationsThe EU imposes sanctions on Russian GRU officers linked to APT28 for long-term cyber espionage and sabotage targeting government and infrastructure.Mon, 13 Jul 2026 11:22:06 GMTAPT28GRUEU SanctionsCyber EspionageCritical Infrastructurehttps://runtimerebel.com/blog/parallel-apt-cyber-espionage-targets-balochistan-policehttps://runtimerebel.com/blog/parallel-apt-cyber-espionage-targets-balochistan-policeAnalysis of parallel cyber espionage campaigns by China and India-linked APTs against Pakistan's Balochistan Police, detailed by SentinelOne.Fri, 10 Jul 2026 14:32:36 GMTChinaIndiaPakistanBalochistan PoliceAPTCyber EspionageSentinelOneNation Statehttps://runtimerebel.com/blog/iran-cyber-focus-expands-securing-internet-facing-vulnerabilitieshttps://runtimerebel.com/blog/iran-cyber-focus-expands-securing-internet-facing-vulnerabilitiesIranian state-sponsored cyber operations are broadening targets beyond critical infrastructure. All organizations must secure Internet-facing systems.Fri, 10 Jul 2026 03:33:44 GMTIranNation StateCyber EspionageVulnerability ManagementInternet Facing Vulnerabilitieshttps://runtimerebel.com/blog/armored-likho-leverages-busysnake-stealer-against-critical-sectorshttps://runtimerebel.com/blog/armored-likho-leverages-busysnake-stealer-against-critical-sectorsUndocumented threat actor Armored Likho targets government and electric power sectors in Russia, Brazil, and Kazakhstan with BusySnake Stealer.Fri, 03 Jul 2026 14:08:59 GMTArmored LikhoBusySnake StealerGovernment AgenciesElectric Power SectorCyber EspionageKasperskyhttps://runtimerebel.com/blog/turla-s-stockstay-backdoor-analysis-of-campaigns-winrar-exploithttps://runtimerebel.com/blog/turla-s-stockstay-backdoor-analysis-of-campaigns-winrar-exploitGoogle Threat Intelligence details STOCKSTAY, Turla's .NET backdoor for espionage targeting Ukraine and Europe, leveraging RDP & CVE-2025-8088.Fri, 26 Jun 2026 09:21:08 GMTTurlaSTOCKSTAYKAZUARAPTCyber EspionageUkraineGovernmentMilitaryCVE-2025-8088WinRARNET MalwareFSBhttps://runtimerebel.com/blog/chinese-espionage-google-workspace-rule-abuse-in-research-sectorshttps://runtimerebel.com/blog/chinese-espionage-google-workspace-rule-abuse-in-research-sectorsChina-linked threat actors exploited REDCap server backdoors and manipulated Google Workspace mail rules to exfiltrate North American research data.Tue, 16 Jun 2026 01:12:06 GMTREDCapGoogle WorkspaceCyber EspionageChinaData Exfiltrationhttps://runtimerebel.com/blog/unc6508-chinese-cyberespionage-targets-north-american-researchhttps://runtimerebel.com/blog/unc6508-chinese-cyberespionage-targets-north-american-researchGoogle's Threat Intelligence Group tracks UNC6508, a Chinese cyberespionage group targeting North American medical, military, and AI research sectors.Mon, 15 Jun 2026 14:23:41 GMTUNC6508Cyber EspionageChinaAPTNorth AmericaMedical ResearchMilitaryAI Researchhttps://runtimerebel.com/blog/iranian-handala-group-claims-cal-water-hack-exposing-piihttps://runtimerebel.com/blog/iranian-handala-group-claims-cal-water-hack-exposing-piiIranian cyber group Handala claims responsibility for breaching Cal Water, exposing 5GB of customer PII and RTKBase platform credentials.Fri, 12 Jun 2026 13:21:19 GMTHandalaCal WaterData BreachCritical InfrastructureRTKBaseCyber EspionagePIIhttps://runtimerebel.com/blog/oceanlotus-targets-vietnam-with-spectralviper-backdoor-in-fireant-attackhttps://runtimerebel.com/blog/oceanlotus-targets-vietnam-with-spectralviper-backdoor-in-fireant-attackOceanLotus APT targets Vietnamese infrastructure and stock investors with SPECTRALVIPER backdoor in multi-year cyber espionage and supply chain campaigns.Thu, 11 Jun 2026 13:34:13 GMTOceanLotusAPT32SPECTRALVIPERFireAnt AttackVietnamCyber EspionageSupply Chain AttackFinancial Sectorhttps://runtimerebel.com/blog/chinese-and-north-korean-apt-activity-surges-across-apac-marketshttps://runtimerebel.com/blog/chinese-and-north-korean-apt-activity-surges-across-apac-marketsChinese and North Korean threat groups are intensifying operations in Asia-Pacific, impacting regional economies and targeting financial institutions for profit.Thu, 11 Jun 2026 09:41:37 GMTLazarus GroupAsia PacificCyber EspionageFinancial CrimeAPThttps://runtimerebel.com/blog/pakistan-linked-espionage-targets-afghan-finance-ministry-via-xeno-rathttps://runtimerebel.com/blog/pakistan-linked-espionage-targets-afghan-finance-ministry-via-xeno-ratAnalysis of a Pakistan-linked cyber espionage campaign targeting the Afghan Ministry of Finance using the Xeno RAT malware and malicious LNK files.Thu, 04 Jun 2026 05:42:02 GMTXeno RATPakistanAfghanistanCyber EspionageLNK Malwarehttps://runtimerebel.com/blog/china-linked-apts-target-latin-american-critical-infrastructurehttps://runtimerebel.com/blog/china-linked-apts-target-latin-american-critical-infrastructureChina-linked APTs are conducting widespread cyber espionage against maritime shipping, oil production, and government sectors in Latin America, impacting over a dozen…Wed, 03 Jun 2026 21:11:36 GMTChina Linked APTCyber EspionageLatin AmericaCritical InfrastructureMaritime ShippingOil Productionhttps://runtimerebel.com/blog/iranian-apt33-targets-aviation-with-updated-mimicc2-and-powerlesshttps://runtimerebel.com/blog/iranian-apt33-targets-aviation-with-updated-mimicc2-and-powerlessIranian APT Nimbus Manticore (APT33) targets aviation and software firms using new MimicC2 framework and updated PowerLess tools for stealthy operations.Tue, 26 May 2026 20:46:55 GMTAPT33Nimbus ManticoreIranAviationSoftwareMimicC2PowerLessCyber EspionageCritical Infrastructurehttps://runtimerebel.com/blog/muddywater-targets-south-korean-electronics-maker-in-espionage-campaignhttps://runtimerebel.com/blog/muddywater-targets-south-korean-electronics-maker-in-espionage-campaignIran-linked MuddyWater (Seedworm) group launched a cyber-espionage campaign against a major South Korean electronics maker and other global entities.Thu, 14 May 2026 00:55:56 GMTMuddyWaterSeedwormStatic KittenIranCyber EspionageSouth KoreaElectronics MakerAPThttps://runtimerebel.com/blog/pamdoora-backdoor-and-windows-phone-link-otp-theft-analysishttps://runtimerebel.com/blog/pamdoora-backdoor-and-windows-phone-link-otp-theft-analysisRecent intelligence highlights the PamDOORa Linux backdoor and malware leveraging Windows Phone Link to bypass OTP-based authentication mechanisms.Fri, 08 May 2026 16:37:45 GMTPamDOORaLinux BackdoorWindows Phone LinkOTP TheftCyber Espionagehttps://runtimerebel.com/blog/china-linked-uat-8302-targets-governments-with-custom-apt-malwarehttps://runtimerebel.com/blog/china-linked-uat-8302-targets-governments-with-custom-apt-malwareUAT-8302, a China-linked threat group, targets government entities in South America and SE Europe using custom malware and shared APT toolsets.Tue, 05 May 2026 16:39:00 GMTUAT 8302ChinaAPTCisco TalosCyber Espionagehttps://runtimerebel.com/blog/alleged-silk-typhoon-hacker-extradited-cyberespionage-threathttps://runtimerebel.com/blog/alleged-silk-typhoon-hacker-extradited-cyberespionage-threatAn alleged Silk Typhoon hacker, associated with Chinese intelligence, has been extradited to the US, highlighting persistent nation-state cyberespionage threats.Mon, 27 Apr 2026 20:30:07 GMTSilk TyphoonVolt TyphoonCyber EspionageNation StateChinaExtraditionAPThttps://runtimerebel.com/blog/chinese-state-backed-actors-industrialize-botnets-for-covert-opshttps://runtimerebel.com/blog/chinese-state-backed-actors-industrialize-botnets-for-covert-opsChinese state-backed groups are adopting industrialized botnets, utilizing compromised devices for low-cost, low-risk, and deniable cyber operations.Fri, 24 Apr 2026 00:47:01 GMTChinaState BackedBotnetAPTCyber EspionageIndustrialized Botnetshttps://runtimerebel.com/blog/chinese-apt-targeting-indian-banks-and-korean-policy-circleshttps://runtimerebel.com/blog/chinese-apt-targeting-indian-banks-and-korean-policy-circlesChinese state-sponsored threat actors are conducting cyber-espionage against Indian financial institutions and South Korean policy entities using recycled TTPs.Tue, 21 Apr 2026 12:33:56 GMTChinese APTIndia BankingSouth KoreaCyber EspionageFinancial Sectorhttps://runtimerebel.com/blog/apt28-forest-blizzard-dns-manipulation-targets-soho-routershttps://runtimerebel.com/blog/apt28-forest-blizzard-dns-manipulation-targets-soho-routersRussian APT28, or Forest Blizzard, is conducting malwareless cyber espionage by manipulating DNS settings on vulnerable SOHO routers to steal credentials from global…Thu, 09 Apr 2026 04:53:01 GMTAPT28Forest BlizzardSOHO RoutersDNS ManipulationCredential TheftCyber EspionageNation Statehttps://runtimerebel.com/blog/apt28-exploits-mikrotik-tp-link-routers-in-dns-hijackinghttps://runtimerebel.com/blog/apt28-exploits-mikrotik-tp-link-routers-in-dns-hijackingRussian state-linked APT28 (Forest Blizzard) is compromising insecure SOHO routers globally, employing DNS hijacking for cyber espionage since May 2025.Tue, 07 Apr 2026 20:18:04 GMTAPT28Forest BlizzardSOHO RoutersMikroTikTP LinkDNS HijackingCyber Espionagehttps://runtimerebel.com/blog/pro-iranian-group-claims-hack-of-fbi-director-s-personal-accounthttps://runtimerebel.com/blog/pro-iranian-group-claims-hack-of-fbi-director-s-personal-accountA pro-Iranian hacking group claims to have compromised the personal account of FBI Director Kash Patel, exfiltrating emails and documents.Fri, 27 Mar 2026 20:15:51 GMTPro Iranian Hacking GroupKash PatelFBIAccount CompromiseCyber EspionageGeopoliticalhttps://runtimerebel.com/blog/earth-kaluu-cyberespionage-campaign-targets-se-asian-military-orgshttps://runtimerebel.com/blog/earth-kaluu-cyberespionage-campaign-targets-se-asian-military-orgsAn investigation into the China-nexus Earth Kaluu campaign reveals long-term persistence in Southeast Asian military networks using custom backdoors.Tue, 17 Mar 2026 04:40:49 GMTEarth KaluuMustang PandaSoutheast AsiaCyber EspionageDLL Side Loadinghttps://runtimerebel.com/blog/cl-sta-1087-chinese-hackers-target-se-asian-military-with-applechrishttps://runtimerebel.com/blog/cl-sta-1087-chinese-hackers-target-se-asian-military-with-applechrisChinese threat actor CL-STA-1087 leverages AppleChris and MemFun malware to target Southeast Asian military organizations in long-term espionage campaigns.Fri, 13 Mar 2026 20:12:54 GMTCL STA 1087AppleChrisMemFunUnit 42Southeast AsiaCyber Espionagehttps://runtimerebel.com/blog/nation-state-cyber-operation-israel-s-compromise-of-iranian-traffic-camerashttps://runtimerebel.com/blog/nation-state-cyber-operation-israel-s-compromise-of-iranian-traffic-camerasAnalysis of the reported Israeli cyber operation targeting Iranian traffic cameras, detailing implications for critical infrastructure security and cyber-physical…Thu, 05 Mar 2026 20:17:25 GMTIsraelIranTraffic CamerasCyber EspionageNation State AttackCritical InfrastructureOT Securityhttps://runtimerebel.com/blog/chinese-police-use-chatgpt-in-influence-operations-against-japanhttps://runtimerebel.com/blog/chinese-police-use-chatgpt-in-influence-operations-against-japanChinese police reportedly used ChatGPT for politically motivated influence operations to smear Japan's PM Takaichi, highlighting AI's role in disinformation campaigns.Thu, 26 Feb 2026 00:33:49 GMTChatGPTInfluence OperationsDisinformationNation StateChinaJapanAICyber Espionagehttps://runtimerebel.com/blog/gridtide-espionage-prc-nexus-unc2814-targets-telecoms-globallyhttps://runtimerebel.com/blog/gridtide-espionage-prc-nexus-unc2814-targets-telecoms-globallyGoogle disrupts GRIDTIDE, a novel backdoor used by PRC-nexus UNC2814 for global cyber espionage against telecommunications and government entities.Wed, 25 Feb 2026 16:34:59 GMTUNC2814GRIDTIDEPRC NexusCyber EspionageTelecommunicationsGovernmentGoogle Sheets APISoftEther VPNC2Linux MalwareTTPshttps://runtimerebel.com/blog/google-disrupts-chinese-espionage-actor-unc2814-targeting-telecomshttps://runtimerebel.com/blog/google-disrupts-chinese-espionage-actor-unc2814-targeting-telecomsGoogle and Mandiant disrupt UNC2814, a Chinese state-sponsored actor active since 2017, targeting 42 countries across telecom and government sectors.Wed, 25 Feb 2026 16:34:10 GMTUNC2814ChinaCyber EspionageGoogle TAGMandiantTelecommunicationsState Sponsoredhttps://runtimerebel.com/blog/us-treasury-sanctions-russian-broker-for-stolen-zero-day-exploitshttps://runtimerebel.com/blog/us-treasury-sanctions-russian-broker-for-stolen-zero-day-exploitsThe US sanctions Artem Kruglov and associated firms for brokering stolen hacking tools and zero-day exploits for Russian intelligence services.Wed, 25 Feb 2026 12:24:10 GMTOFACSanctionsZero-DayArtem KruglovRussiaCyber EspionageSVRhttps://runtimerebel.com/blog/muddywater-deploys-bugsleep-backdoor-in-targeted-regional-campaignshttps://runtimerebel.com/blog/muddywater-deploys-bugsleep-backdoor-in-targeted-regional-campaignsIranian state actor MuddyWater introduces the custom BugSleep backdoor, targeting Middle Eastern and African entities using spear-phishing and RMM abuse.Tue, 24 Feb 2026 08:22:38 GMTMuddyWaterBugSleepMOISSpear PhishingRMM AbuseIranCyber Espionage