Cybersecurity articles tagged #Espionage on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/silkparasite-espionage-campaign-targets-central-asian-governmentshttps://runtimerebel.com/blog/silkparasite-espionage-campaign-targets-central-asian-governmentsSilkParasite espionage campaign targets Central Asian governments with seven remote access tools, including five newly documented RAT families.Wed, 19 Aug 2026 16:20:56 GMTEspionageRATMalwareSilkParasiteShadowPadhttps://runtimerebel.com/blog/suspected-chinese-speaking-hackers-deploy-octlurk-silklurk-backdoorshttps://runtimerebel.com/blog/suspected-chinese-speaking-hackers-deploy-octlurk-silklurk-backdoorsOngoing cyberattacks by a suspected Chinese-speaking threat actor target Central Asian governments with OctLurk and SilkLurk backdoors for espionage and data theft.Sat, 01 Aug 2026 02:54:42 GMTChinese Speaking HackersOctLurkSilLurkCentral AsiaGovernment TargetsEspionageBackdoorhttps://runtimerebel.com/blog/us-humanoid-robot-ban-mitigating-chinese-supply-chain-riskshttps://runtimerebel.com/blog/us-humanoid-robot-ban-mitigating-chinese-supply-chain-risksThe U.S. ban on foreign-made humanoid robots highlights growing concerns over data exfiltration and national security risks linked to Chinese manufacturing.Wed, 29 Jul 2026 14:14:03 GMTChinaSupply ChainNational SecurityRoboticsEspionagehttps://runtimerebel.com/blog/ai-agent-espionage-against-thai-ministry-of-finance-hermes-yolo-modehttps://runtimerebel.com/blog/ai-agent-espionage-against-thai-ministry-of-finance-hermes-yolo-modeAttackers leveraged the Hermes AI agent in 'YOLO mode' to perform an espionage operation targeting Thailand's Ministry of Finance. Learn TTPs and defense.Tue, 28 Jul 2026 02:39:41 GMTHermes AI AgentEspionageYOLO ModeThai Ministry of FinanceNation State ThreatAutonomous AIhttps://runtimerebel.com/blog/hollowgraph-malware-leverages-microsoft-365-calendar-for-stealthy-c2https://runtimerebel.com/blog/hollowgraph-malware-leverages-microsoft-365-calendar-for-stealthy-c2HollowGraph, a new espionage malware, hides C2 commands and exfiltrates data via legitimate Microsoft 365 calendar events, mimicking normal Graph API traffic.Mon, 20 Jul 2026 18:05:24 GMTHollowGraphMicrosoft 365Microsoft Graph APIEspionageC2Data ExfiltrationGroup IBhttps://runtimerebel.com/blog/balochistan-police-portal-exploited-in-multi-group-espionage-campaignhttps://runtimerebel.com/blog/balochistan-police-portal-exploited-in-multi-group-espionage-campaignMultiple threat actors weaponize Balochistan Police infrastructure, compromising criminal records and citizen data in a multi-year espionage operation.Sat, 11 Jul 2026 20:51:09 GMTBalochistan PolicePakistanEspionageData BreachLaw Enforcementhttps://runtimerebel.com/blog/roundcube-flaw-exploited-by-china-linked-group-against-academicshttps://runtimerebel.com/blog/roundcube-flaw-exploited-by-china-linked-group-against-academicsA China-linked threat cluster is actively exploiting a Roundcube webmail vulnerability to steal credentials and deploy backdoors at U.S./Canadian universities.Wed, 08 Jul 2026 21:35:37 GMTRoundcubeAcademic SectorCredential TheftBackdoorChina LinkedEspionageUniversitieshttps://runtimerebel.com/blog/google-disrupts-netnut-malicious-residential-proxy-networkhttps://runtimerebel.com/blog/google-disrupts-netnut-malicious-residential-proxy-networkGoogle, in coordination with the FBI and Lumen, has significantly disrupted the NetNut residential proxy network, impacting millions of compromised devices.Fri, 03 Jul 2026 07:31:53 GMTNetNutResidential ProxyBotnetC2Google Play ProtectMalwareIPIDEACybercrimeEspionagehttps://runtimerebel.com/blog/china-linked-apt-targets-southeast-asia-critical-systems-with-new-backdoorhttps://runtimerebel.com/blog/china-linked-apt-targets-southeast-asia-critical-systems-with-new-backdoorA China-linked APT group has compromised ten organizations, including state-owned entities in Southeast Asia, deploying a new backdoor.Wed, 01 Jul 2026 05:41:17 GMTChina Linked APTSoutheast AsiaCritical InfrastructureBackdoorState SponsoredEspionageCyber Warfarehttps://runtimerebel.com/blog/mustang-panda-exploits-zoho-workdrive-for-c2-in-indian-govt-attackshttps://runtimerebel.com/blog/mustang-panda-exploits-zoho-workdrive-for-c2-in-indian-govt-attacksMustang Panda, a China-aligned APT, targets Indian government and hydropower entities, leveraging Zoho WorkDrive as a C2 channel and deploying new malware.Mon, 29 Jun 2026 17:06:24 GMTMustang PandaAPTZoho WorkDriveIndian GovernmentEspionageC2Cloud Securityhttps://runtimerebel.com/blog/unc5792-unc4221-target-us-officials-via-messaging-appshttps://runtimerebel.com/blog/unc5792-unc4221-target-us-officials-via-messaging-appsRussian state-linked groups UNC5792 and UNC4221 are actively targeting US government, military, and allied personnel through evolving messaging app attacks.Mon, 29 Jun 2026 10:10:24 GMTUNC5792UNC4221Russian APTMessaging App AttacksGovernment TargetingEspionageMobile Securityhttps://runtimerebel.com/blog/turla-apt-deploys-stockstay-backdoor-in-ukraine-espionage-campaignhttps://runtimerebel.com/blog/turla-apt-deploys-stockstay-backdoor-in-ukraine-espionage-campaignRussian APT Turla targets Ukrainian government and military entities with the custom StockStay backdoor for persistent access and cyber espionage.Fri, 26 Jun 2026 09:18:02 GMTTurlaSTOCKSTAYUkraineEspionageRussian APTMalwarehttps://runtimerebel.com/blog/turla-deploys-new-stockstay-backdoor-in-ukraine-espionage-operationshttps://runtimerebel.com/blog/turla-deploys-new-stockstay-backdoor-in-ukraine-espionage-operationsGoogle identifies STOCKSTAY, a new .NET backdoor by Russian actor Turla targeting Ukrainian military and Italian foreign policy interests via Windows systems.Fri, 26 Jun 2026 09:17:20 GMTTurlaSTOCKSTAYUkraineEspionageTAG 70KRYPTONNEThttps://runtimerebel.com/blog/unc6508-targets-redcap-servers-espionage-via-infinitered-malwarehttps://runtimerebel.com/blog/unc6508-targets-redcap-servers-espionage-via-infinitered-malwarePRC-nexus threat actor UNC6508 exploits REDCap servers in North America's medical and military research sectors, deploying INFINITERED malware for long-term espionage…Mon, 15 Jun 2026 17:51:05 GMTUNC6508INFINITEREDREDCapPRC NexusEspionageMedical ResearchMilitary Researchhttps://runtimerebel.com/blog/china-nexus-actor-year-long-espionage-against-us-researchershttps://runtimerebel.com/blog/china-nexus-actor-year-long-espionage-against-us-researchersA China-nexus actor spied on US researchers for a year, stealing RedCAP credentials and exfiltrating sensitive data from numerous institutions, discovered by Google.Mon, 15 Jun 2026 17:49:38 GMTChina Nexus ActorEspionageUS ResearchersRedCAP CredentialsData ExfiltrationNation State Threathttps://runtimerebel.com/blog/china-linked-espionage-targets-redcap-servers-stealing-medical-datahttps://runtimerebel.com/blog/china-linked-espionage-targets-redcap-servers-stealing-medical-dataChina-linked threat actors breached exposed REDCap servers, deploying InfiniteRed malware to steal sensitive medical research from a North American institution.Mon, 15 Jun 2026 14:23:10 GMTChina LinkedREDCapINFINITEREDMedical SectorData BreachEspionagehttps://runtimerebel.com/blog/chinese-hackers-hijack-auth-flow-for-decade-long-espionagehttps://runtimerebel.com/blog/chinese-hackers-hijack-auth-flow-for-decade-long-espionageChinese state-sponsored hackers maintained long-term access to an isolated network by hijacking the authentication flow, enabling a decade of espionage.Sat, 13 Jun 2026 16:36:15 GMTChinese HackersAuthentication BypassLong Term PersistenceEspionageIsolated NetworkAPThttps://runtimerebel.com/blog/chinese-apt-unc5221-deploys-new-malware-for-m365-persistencehttps://runtimerebel.com/blog/chinese-apt-unc5221-deploys-new-malware-for-m365-persistenceChinese APT UNC5221 leverages new malware, Plenet and AgentPSD, alongside Brickstorm backdoor to maintain persistent access in compromised Microsoft 365 environments for…Fri, 05 Jun 2026 20:41:36 GMTUNC5221Microsoft 365BRICKSTORMPlenetAgentPSDAPTEspionagehttps://runtimerebel.com/blog/op-512-analyzing-the-custom-web-shell-framework-targeting-microsoft-iishttps://runtimerebel.com/blog/op-512-analyzing-the-custom-web-shell-framework-targeting-microsoft-iisSecurity researchers have identified OP-512, a China-nexus threat cluster targeting Microsoft IIS servers with a bespoke web shell framework for espionage.Fri, 05 Jun 2026 16:54:33 GMTOP 512Microsoft IISWebshellEspionageChina Nexushttps://runtimerebel.com/blog/handala-brand-evolution-iran-mois-shifts-to-hybrid-physical-attackshttps://runtimerebel.com/blog/handala-brand-evolution-iran-mois-shifts-to-hybrid-physical-attacksIran’s MOIS expands the Handala brand into hybrid operations, combining cyber espionage with physical sabotage targeting U.S. and Israeli interests.Tue, 02 Jun 2026 17:39:53 GMTHandalaMOISIranCyber PhysicalEspionageIsraelProxy Warfarehttps://runtimerebel.com/blog/muddywater-2026-espionage-dll-side-loading-across-9-countrieshttps://runtimerebel.com/blog/muddywater-2026-espionage-dll-side-loading-across-9-countriesIranian group MuddyWater targets industrial manufacturing and financial sectors in a global 2026 espionage campaign using DLL side-loading techniques.Tue, 26 May 2026 17:14:39 GMTMuddyWaterAPT33DLL Side LoadingEspionageIranhttps://runtimerebel.com/blog/frostyneighbor-apt-targets-poland-ukraine-gov-with-spear-phishinghttps://runtimerebel.com/blog/frostyneighbor-apt-targets-poland-ukraine-gov-with-spear-phishingBelarussian APT 'FrostyNeighbor' is deploying spear-phishing campaigns against Polish and Ukrainian government entities after unique victim fingerprinting, aiming for…Thu, 14 May 2026 20:38:13 GMTFrostyNeighborAPTBelarusPolandUkraineEspionageSpear PhishingGovernmentNation Statehttps://runtimerebel.com/blog/yorotrooper-campaign-hits-500-orgs-espionage-and-malware-tacticshttps://runtimerebel.com/blog/yorotrooper-campaign-hits-500-orgs-espionage-and-malware-tacticsAnalysis of the multi-year YoroTrooper phishing campaign targeting critical infrastructure, aviation, and government sectors with custom malware stealers.Mon, 11 May 2026 05:25:02 GMTYoroTrooperEspionageStink StealerCritical InfrastructurePhishinghttps://runtimerebel.com/blog/shadow-earth-053-china-linked-apt-targets-nato-and-asian-governmentshttps://runtimerebel.com/blog/shadow-earth-053-china-linked-apt-targets-nato-and-asian-governmentsTrend Micro uncovers SHADOW-EARTH-053, a China-aligned espionage group targeting defense sectors in Asia and a NATO member through advanced TTPs.Fri, 01 May 2026 16:26:03 GMTSHADOW EARTH 053China AlignedEspionageNATOSouth Asiahttps://runtimerebel.com/blog/tropic-trooper-apt-targets-home-routers-and-japanese-infrastructurehttps://runtimerebel.com/blog/tropic-trooper-apt-targets-home-routers-and-japanese-infrastructureTropic Trooper expands operations to target Japanese entities and home routers using specialized malware like Chinoiserie to obfuscate attack origins.Fri, 24 Apr 2026 05:07:08 GMTTropic TrooperKey BoyJapanSOHOChinoiserieEspionagehttps://runtimerebel.com/blog/chinese-apt-leverages-plugx-shadowpad-with-cloud-c2-for-mongolian-espionagehttps://runtimerebel.com/blog/chinese-apt-leverages-plugx-shadowpad-with-cloud-c2-for-mongolian-espionageA Chinese state-sponsored APT is exploiting Microsoft Outlook, Slack, Discord, and file.io for C2, deploying PlugX and ShadowPad in espionage operations targeting…Thu, 23 Apr 2026 16:42:54 GMTChinese APTCloud SecurityEspionageMongoliaCommand and ControlMicrosoft OutlookSlackDiscordFile IoPlugXShadowPadDLL Side LoadingPhishinghttps://runtimerebel.com/blog/mustang-panda-targets-indian-banks-with-new-lotuslite-varianthttps://runtimerebel.com/blog/mustang-panda-targets-indian-banks-with-new-lotuslite-variantMustang Panda deploys a new LOTUSLITE malware variant against Indian financial institutions and South Korean policy entities for cyber espionage operations.Wed, 22 Apr 2026 08:41:58 GMTMustang PandaLotusliteEspionageFinancial SectorSouth Koreahttps://runtimerebel.com/blog/russian-hackers-exploit-routers-to-steal-microsoft-office-tokenshttps://runtimerebel.com/blog/russian-hackers-exploit-routers-to-steal-microsoft-office-tokensRussian military intelligence-linked hackers exploited known router flaws to harvest Microsoft Office authentication tokens from over 18,000 networks, posing a…Tue, 07 Apr 2026 20:19:57 GMTRussiaMilitary IntelligenceRouter SecurityMicrosoft OfficeAuthentication TokensNation StateEspionagehttps://runtimerebel.com/blog/brickstorm-malware-hardening-vsphere-vcsa-against-advanced-threatshttps://runtimerebel.com/blog/brickstorm-malware-hardening-vsphere-vcsa-against-advanced-threatsDefend VMware vSphere and VCSA against BRICKSTORM malware. Learn hardening strategies, identity management, Zero Trust networking, and advanced logging to thwart…Thu, 02 Apr 2026 16:29:31 GMTBRICKSTORMvSphereVCSAESXiVMwarePhoton OSHardeningVirtualizationTTPsRansomwareEspionageCVE-2021-21972Mandianthttps://runtimerebel.com/blog/iranian-linked-handala-group-breaches-kash-patel-s-personal-emailhttps://runtimerebel.com/blog/iranian-linked-handala-group-breaches-kash-patel-s-personal-emailFBI confirms Iranian-linked Handala hackers breached Director nominee Kash Patel's personal email, leaking documents and highlighting spear-phishing risks.Mon, 30 Mar 2026 00:41:00 GMTHandalaIranKash PatelFBISpear PhishingEspionagehttps://runtimerebel.com/blog/red-menshen-apt-deploys-upgraded-bpfdoor-backdoor-against-telcoshttps://runtimerebel.com/blog/red-menshen-apt-deploys-upgraded-bpfdoor-backdoor-against-telcosChinese APT Red Menshen utilizes an upgraded BPFdoor backdoor to target global telecommunication companies, bypassing traditional defenses.Fri, 27 Mar 2026 20:16:14 GMTRed MenshenBPFdoorAPTTelecommunicationsChinaBackdoorEspionagehttps://runtimerebel.com/blog/red-menshen-bpfdoor-implants-target-telecom-networks-for-espionagehttps://runtimerebel.com/blog/red-menshen-bpfdoor-implants-target-telecom-networks-for-espionageAnalysis of China-linked Red Menshen's long-term campaign using stealthy BPFDoor implants within telecom networks to conduct espionage against government entities.Thu, 26 Mar 2026 20:14:16 GMTRed MenshenEarth BluecrowBPFdoorTelecomEspionageChina NexusAPThttps://runtimerebel.com/blog/m-trends-2026-evolving-ransomware-persistence-and-saas-attack-vectorshttps://runtimerebel.com/blog/m-trends-2026-evolving-ransomware-persistence-and-saas-attack-vectorsM-Trends 2026 reveals critical shifts in adversary TTPs: destructive ransomware, zero-day exploitation for persistence, and voice phishing for SaaS access.Mon, 23 Mar 2026 16:28:06 GMTM Trends 2026RansomwareEspionageVoice PhishingSaaS SecurityZero-DayEdge DevicesUNC3944REDBIKEAGENDABRICKSTORMPROMPTFLUXAI Securityhttps://runtimerebel.com/blog/darksword-iphone-exploit-kit-zero-day-attacks-on-ios-usershttps://runtimerebel.com/blog/darksword-iphone-exploit-kit-zero-day-attacks-on-ios-usersDarkSword, an advanced iPhone exploit kit, leverages multiple zero-day vulnerabilities to target users in Saudi Arabia, Turkey, Malaysia, and Ukraine for espionage and…Thu, 19 Mar 2026 00:37:39 GMTDarkSwordiOSiPhoneZero-DayExploit KitNation StateCybercrimeEspionageTurkeySaudi ArabiaMalaysiaUkrainehttps://runtimerebel.com/blog/chinese-nexus-actors-pivot-to-qatar-geopolitical-espionagehttps://runtimerebel.com/blog/chinese-nexus-actors-pivot-to-qatar-geopolitical-espionageAnalysis of Chinese Nexus actors' shift to targeting Qatari entities amid Iranian conflict. Understand their adaptable TTPs and fortify defenses.Wed, 11 Mar 2026 16:31:22 GMTChinese Nexus ActorsQatarIranGeopoliticsEspionageNation State APThttps://runtimerebel.com/blog/chinese-cyber-threat-persistent-espionage-in-critical-asian-sectorshttps://runtimerebel.com/blog/chinese-cyber-threat-persistent-espionage-in-critical-asian-sectorsAn undefined Chinese-speaking actor conducts long-term cyber espionage against critical Asian sectors using custom malware and living-off-the-land binaries.Mon, 09 Mar 2026 16:35:16 GMTChinese APTEspionageWindowsLinuxLOTLCustom MalwareCritical InfrastructureThreat Actorhttps://runtimerebel.com/blog/coruna-ios-exploit-kit-spyware-grade-threat-targets-cryptohttps://runtimerebel.com/blog/coruna-ios-exploit-kit-spyware-grade-threat-targets-cryptoThe sophisticated Coruna iOS exploit kit, leveraging 23 undocumented vulnerabilities, is now deployed in targeted espionage and crypto theft attacks.Wed, 04 Mar 2026 20:15:16 GMTCorunaiOSExploit KitMobile SecurityCrypto TheftEspionageZero-Dayhttps://runtimerebel.com/blog/chinese-cyberspies-exploit-saas-apis-in-global-espionage-campaignhttps://runtimerebel.com/blog/chinese-cyberspies-exploit-saas-apis-in-global-espionage-campaignA suspected Chinese threat actor breached dozens of telecom firms and government agencies, using SaaS API calls to evade detection in a global espionage campaign.Wed, 25 Feb 2026 20:16:16 GMTChinese Threat ActorEspionageSaaS API AbuseTelecomGovernmentMandiantGoogle GTIGhttps://runtimerebel.com/blog/google-disrupts-unc2814-gridtide-infrastructure-after-53-breacheshttps://runtimerebel.com/blog/google-disrupts-unc2814-gridtide-infrastructure-after-53-breachesGoogle disrupts infrastructure of China-nexus threat actor UNC2814 (GRIDTIDE) after 53 breaches across 42 countries targeting government and telecom sectors.Wed, 25 Feb 2026 20:15:13 GMTUNC2814GRIDTIDEChina NexusAPTTelecommunicationsEspionagehttps://runtimerebel.com/blog/ex-l3harris-executive-sentenced-for-selling-zero-days-to-russiahttps://runtimerebel.com/blog/ex-l3harris-executive-sentenced-for-selling-zero-days-to-russiaFormer Trenchant CEO James Michael Robinson sentenced to 90 months for stealing zero-day exploits and selling them to a Russian state-linked broker.Wed, 25 Feb 2026 12:25:01 GMTL3HarrisTrenchantZero-DayInsider ThreatRussiaEspionageCyber Exploitshttps://runtimerebel.com/blog/l3harris-insider-sentenced-for-selling-zero-days-to-russian-brokerhttps://runtimerebel.com/blog/l3harris-insider-sentenced-for-selling-zero-days-to-russian-brokerFormer defense contractor Peter Williams sentenced to seven years for selling eight zero-day exploits to Russian broker Operation Zero for millions in profit.Wed, 25 Feb 2026 12:22:37 GMTInsider ThreatZero-DayOperation ZeroL3HarrisEspionageTrade Secretshttps://runtimerebel.com/blog/uac-0050-targets-european-financial-institutions-with-rms-malwarehttps://runtimerebel.com/blog/uac-0050-targets-european-financial-institutions-with-rms-malwareRussia-aligned actor UAC-0050 expands operations beyond Ukraine, targeting European financial entities with spoofed domains and RMS malware for espionage.Wed, 25 Feb 2026 00:37:36 GMTUAC 0050RMS MalwarePhishingFinancial SectorEspionagehttps://runtimerebel.com/blog/unsolicitedbooker-targets-central-asian-telecoms-via-lucidoor-backdoorhttps://runtimerebel.com/blog/unsolicitedbooker-targets-central-asian-telecoms-via-lucidoor-backdoorThe UnsolicitedBooker threat actor has pivoted to targeting telecommunications providers in Kyrgyzstan and Tajikistan using LuciDoor and MarsSnake backdoors.Tue, 24 Feb 2026 12:21:43 GMTUnsolicitedBookerLuciDoorMarsSnakeTelecommunicationsKyrgyzstanTajikistanEspionagehttps://runtimerebel.com/blog/apt28-operation-macromaze-webhook-driven-macro-execution-targeting-western-europehttps://runtimerebel.com/blog/apt28-operation-macromaze-webhook-driven-macro-execution-targeting-western-europeAnalysis of a targeted campaign attributed to APT28, utilizing macro-enabled documents and legitimate webhook services for command-and-control obfuscation.Tue, 24 Feb 2026 04:40:50 GMTAPT28MacroMazeWebhooksRussiaEspionagehttps://runtimerebel.com/blog/iranian-apt-muddywater-orchestrates-operation-olalampo-targeting-mena-infrastructurehttps://runtimerebel.com/blog/iranian-apt-muddywater-orchestrates-operation-olalampo-targeting-mena-infrastructureAnalysis of a new Iranian cyber-espionage campaign utilizing GhostFetch, CHAR, and HTTP_VIP malware families against organizations in the Middle East and North Africa.Mon, 23 Feb 2026 08:19:55 GMTMuddyWaterAPTEspionageMENAGhostFetch