RuntimeRebel — #GovernmentCybersecurity articles tagged #Government on RuntimeRebel.https://runtimerebel.comBusySnake Infostealer Targets Critical Infrastructure: Armored Likho's TTPshttps://runtimerebel.com/blog/busysnake-infostealer-targets-critical-infrastructure-armored-likho-s-ttpshttps://runtimerebel.com/blog/busysnake-infostealer-targets-critical-infrastructure-armored-likho-s-ttpsBusySnake infostealer, deployed by Armored Likho, infiltrates critical infrastructure in Russia, Brazil, and Kazakhstan. Understand their TTPs and mitigation strategies.Tue, 07 Jul 2026 03:34:06 GMTBusySnakeInfostealerArmored LikhoCritical InfrastructureGovernmentElectrical PowerRussiaBrazilKazakhstanTurla's STOCKSTAY Backdoor: Analysis of Campaigns & WinRAR Exploithttps://runtimerebel.com/blog/turla-s-stockstay-backdoor-analysis-of-campaigns-winrar-exploithttps://runtimerebel.com/blog/turla-s-stockstay-backdoor-analysis-of-campaigns-winrar-exploitGoogle Threat Intelligence details STOCKSTAY, Turla's .NET backdoor for espionage targeting Ukraine and Europe, leveraging RDP & CVE-2025-8088.Fri, 26 Jun 2026 09:21:08 GMTTurlaSTOCKSTAYKAZUARAPTCyber EspionageUkraineGovernmentMilitaryCVE-2025-8088WinRARNET MalwareFSBGhostwriter Targets Ukraine Government with Prometheus Phishinghttps://runtimerebel.com/blog/ghostwriter-targets-ukraine-government-with-prometheus-phishinghttps://runtimerebel.com/blog/ghostwriter-targets-ukraine-government-with-prometheus-phishingBelarus-aligned Ghostwriter (UAC-0057) targets Ukrainian government entities with Prometheus-themed phishing emails to deploy sophisticated malware. Learn detection and…Fri, 22 May 2026 20:37:28 GMTGhostwriterUAC 0057UNC1151UkraineGovernmentPhishingPrometheusCERT UAAPTFrostyNeighbor APT Targets Poland/Ukraine Gov with Spear-Phishinghttps://runtimerebel.com/blog/frostyneighbor-apt-targets-poland-ukraine-gov-with-spear-phishinghttps://runtimerebel.com/blog/frostyneighbor-apt-targets-poland-ukraine-gov-with-spear-phishingBelarussian APT 'FrostyNeighbor' is deploying spear-phishing campaigns against Polish and Ukrainian government entities after unique victim fingerprinting, aiming for…Thu, 14 May 2026 20:38:13 GMTFrostyNeighborAPTBelarusPolandUkraineEspionageSpear PhishingGovernmentNation StateAgingFly Malware: Credential Theft Operations Against Ukrainehttps://runtimerebel.com/blog/agingfly-malware-credential-theft-operations-against-ukrainehttps://runtimerebel.com/blog/agingfly-malware-credential-theft-operations-against-ukraineAnalysis of AgingFly malware, a new threat observed actively targeting Ukrainian government and hospital entities to steal credentials from Chromium browsers and…Thu, 16 Apr 2026 00:47:01 GMTAgingFlyMalwareUkraineCredential TheftChromiumWhatsAppGovernmentHospitalsIranian APT Exploits Rockwell Automation PLCs: Securing Critical Infrastructure OT Deviceshttps://runtimerebel.com/blog/iranian-apt-exploits-rockwell-automation-plcs-securing-critical-infrastructure-ot-deviceshttps://runtimerebel.com/blog/iranian-apt-exploits-rockwell-automation-plcs-securing-critical-infrastructure-ot-devicesIranian-affiliated APT actors are exploiting internet-facing Rockwell Automation PLCs, disrupting US critical infrastructure. Learn how to secure your OT devices and…Tue, 07 Apr 2026 20:21:14 GMTIranian APTCyber Av3ngersRockwell AutomationAllen BradleyPLCOT SecurityCritical InfrastructureHMISCADAGovernmentWater and WastewaterEnergyCVE-2026-3502: TrueConf Zero-Day Exploited in Asia Gov Attackshttps://runtimerebel.com/blog/cve-2026-3502-trueconf-zero-day-exploited-in-asia-gov-attackshttps://runtimerebel.com/blog/cve-2026-3502-trueconf-zero-day-exploited-in-asia-gov-attacksTrueConf video conferencing zero-day [CVE-2026-3502] exploited to distribute tampered updates to Southeast Asian government networks in 'TrueChaos' campaign.Tue, 31 Mar 2026 20:18:22 GMTCVE-2026-3502TrueConfZero-DayTrueChaosSupply Chain AttackGovernmentSoutheast AsiaFBI Arrests Suspect in $46M US Marshals Crypto Thefthttps://runtimerebel.com/blog/fbi-arrests-suspect-in-46m-us-marshals-crypto-thefthttps://runtimerebel.com/blog/fbi-arrests-suspect-in-46m-us-marshals-crypto-theftA suspect linked to the theft of $46 million in cryptocurrency from the U.S. Marshals Service has been arrested. Runtime Rebel analyzes the incident and key takeaways…Thu, 05 Mar 2026 20:16:44 GMTCryptocurrencyTheftUS Marshals ServiceGovernmentCybercrimeFBIChinese Cyberspies Exploit SaaS APIs in Global Espionage Campaignhttps://runtimerebel.com/blog/chinese-cyberspies-exploit-saas-apis-in-global-espionage-campaignhttps://runtimerebel.com/blog/chinese-cyberspies-exploit-saas-apis-in-global-espionage-campaignA suspected Chinese threat actor breached dozens of telecom firms and government agencies, using SaaS API calls to evade detection in a global espionage campaign.Wed, 25 Feb 2026 20:16:16 GMTChinese Threat ActorEspionageSaaS API AbuseTelecomGovernmentMandiantGoogle GTIGGRIDTIDE Espionage: PRC-Nexus UNC2814 Targets Telecoms Globallyhttps://runtimerebel.com/blog/gridtide-espionage-prc-nexus-unc2814-targets-telecoms-globallyhttps://runtimerebel.com/blog/gridtide-espionage-prc-nexus-unc2814-targets-telecoms-globallyGoogle disrupts GRIDTIDE, a novel backdoor used by PRC-nexus UNC2814 for global cyber espionage against telecommunications and government entities.Wed, 25 Feb 2026 16:34:59 GMTUNC2814GRIDTIDEPRC NexusCyber EspionageTelecommunicationsGovernmentGoogle Sheets APISoftEther VPNC2Linux MalwareTTPs