Cybersecurity articles tagged #State Sponsored on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/purpledelta-north-korean-it-workers-exploit-remote-hiringhttps://runtimerebel.com/blog/purpledelta-north-korean-it-workers-exploit-remote-hiringRecorded Future exposes PurpleDelta, North Korean IT workers using sophisticated fraudulent employment, AI, and extensive vetting evasion to fund DPRK military programs.Tue, 18 Aug 2026 16:25:57 GMTNorth KoreaState SponsoredSupply Chain RiskPurpleDeltaFraudulent Employmenthttps://runtimerebel.com/blog/microsoft-owa-exploit-russian-hackers-bypass-credential-rotationshttps://runtimerebel.com/blog/microsoft-owa-exploit-russian-hackers-bypass-credential-rotationsRussian threat actors exploit a Microsoft Outlook Web Access (OWA) flaw to maintain persistent mailbox access even after passwords are changed or rotated.Thu, 30 Jul 2026 10:25:52 GMTAPT28Microsoft OWACredential Rotation BypassState Sponsoredhttps://runtimerebel.com/blog/zimbra-zero-day-exploited-by-laundry-bear-against-us-ukrainehttps://runtimerebel.com/blog/zimbra-zero-day-exploited-by-laundry-bear-against-us-ukraineRussian state-sponsored group 'Laundry Bear' exploits a Zimbra zero-day via 'half-click' phishing, targeting US and Ukrainian entities for credential theft and backdoor…Fri, 24 Jul 2026 02:47:14 GMTLaundry BearZimbraZero-DayPhishingUSUkraineState Sponsoredhttps://runtimerebel.com/blog/iran-linked-hackers-deploy-new-cavern-c2-against-israeli-targetshttps://runtimerebel.com/blog/iran-linked-hackers-deploy-new-cavern-c2-against-israeli-targetsIranian state-sponsored threat actors are using a novel modular C2 framework, Cavern (Cav3rn), to compromise Israeli IT and government entities.Mon, 06 Jul 2026 21:38:48 GMTCavernCav3rnIranMOISIsraeli OrganizationsState SponsoredThreat Clusterhttps://runtimerebel.com/blog/china-linked-apt-targets-southeast-asia-critical-systems-with-new-backdoorhttps://runtimerebel.com/blog/china-linked-apt-targets-southeast-asia-critical-systems-with-new-backdoorA China-linked APT group has compromised ten organizations, including state-owned entities in Southeast Asia, deploying a new backdoor.Wed, 01 Jul 2026 05:41:17 GMTChina Linked APTSoutheast AsiaCritical InfrastructureBackdoorState SponsoredEspionageCyber Warfarehttps://runtimerebel.com/blog/us-targets-russian-linked-unc5792-unc4221-hackers-of-messaging-appshttps://runtimerebel.com/blog/us-targets-russian-linked-unc5792-unc4221-hackers-of-messaging-appsUS State Dept. offers $10M for info on Russian-linked UNC5792 & UNC4221 groups targeting WhatsApp, Signal users. Learn about nation-state threats.Mon, 29 Jun 2026 17:06:46 GMTUNC5792UNC4221RussiaState SponsoredWhatsAppSignalTargetinghttps://runtimerebel.com/blog/jdy-botnet-expansion-china-linked-reconnaissance-on-soho-iot-deviceshttps://runtimerebel.com/blog/jdy-botnet-expansion-china-linked-reconnaissance-on-soho-iot-devicesChina-linked JDY botnet now controls 1,500+ SOHO/IoT devices, actively expanding cyber reconnaissance for state-sponsored operations.Wed, 10 Jun 2026 17:13:48 GMTJDYBotnetChinaSOHOIoTCyber ReconnaissanceState SponsoredThreat Intelligencehttps://runtimerebel.com/blog/uae-critical-infrastructure-faces-surge-in-geopolitical-cyberattackshttps://runtimerebel.com/blog/uae-critical-infrastructure-faces-surge-in-geopolitical-cyberattacksBreach attempts against the UAE have tripled following regional tensions, specifically targeting critical infrastructure and government sectors.Wed, 06 May 2026 12:49:45 GMTUAEMiddle EastCritical InfrastructureState SponsoredGeopolitical Conflicthttps://runtimerebel.com/blog/darksword-analyzing-the-gtig-ios-full-chain-zero-day-exploithttps://runtimerebel.com/blog/darksword-analyzing-the-gtig-ios-full-chain-zero-day-exploitGoogle Threat Intelligence Group uncovers DarkSword, a sophisticated iOS exploit chain leveraging multiple zero-days for state-sponsored surveillance.Tue, 05 May 2026 12:39:04 GMTDarkSwordiOSGTIGSpywareState Sponsoredhttps://runtimerebel.com/blog/fast16-malware-analyzing-the-precursor-to-stuxnet-sabotagehttps://runtimerebel.com/blog/fast16-malware-analyzing-the-precursor-to-stuxnet-sabotageAnalysis of the Fast16 malware, a state-sponsored tool designed to sabotage high-precision mathematical simulations and physical computation processes.Thu, 30 Apr 2026 12:42:39 GMTFast16StuxnetIcs SabotageState SponsoredIranhttps://runtimerebel.com/blog/grinex-exchange-shuts-down-after-13-74m-state-sponsored-hackhttps://runtimerebel.com/blog/grinex-exchange-shuts-down-after-13-74m-state-sponsored-hackSanctioned exchange Grinex halts operations following a $13.74M hack attributed to Western intelligence agencies. Analysis of TTPs and geopolitical impact.Sat, 18 Apr 2026 12:18:02 GMTGrinexCryptocurrencyState SponsoredSanctionsFinancial Cybercrimehttps://runtimerebel.com/blog/apple-darksword-protection-expands-mitigating-cve-2023-38604-zero-click-exploitshttps://runtimerebel.com/blog/apple-darksword-protection-expands-mitigating-cve-2023-38604-zero-click-exploitsApple expands DarkSword exploit protection to all users, enhancing defenses against state-sponsored and commercial zero-click attacks like CVE-2023-38604.Thu, 02 Apr 2026 16:27:21 GMTAppleDarkSwordCVE-2023-38604Zero ClickExploit KitState SponsoredCommercial SpywareiOSmacOSiPadOSwatchOStvOShttps://runtimerebel.com/blog/coruna-sophisticated-iphone-hacking-toolkit-bypasses-ios-defenseshttps://runtimerebel.com/blog/coruna-sophisticated-iphone-hacking-toolkit-bypasses-ios-defensesGoogle researchers uncovered "Coruna," a powerful iOS exploit kit leveraging 23 vulnerabilities to silently install malware on iPhones, likely state-sponsored.Thu, 02 Apr 2026 12:30:01 GMTCorunaiOSiPhoneExploit KitState SponsoredMobile Securityhttps://runtimerebel.com/blog/star-blizzard-apt28-adopts-darksword-ios-exploit-kithttps://runtimerebel.com/blog/star-blizzard-apt28-adopts-darksword-ios-exploit-kitRussian APT Star Blizzard (APT28) now uses the DarkSword iOS exploit kit to target government, finance, and academia, increasing mobile threat exposure.Mon, 30 Mar 2026 12:35:23 GMTStar BlizzardAPT28Fancy BearNobeliumDarkSwordiOSExploit KitState SponsoredMobile SecuritySpear Phishinghttps://runtimerebel.com/blog/iranian-hackers-target-kash-patel-us-offers-10m-bountyhttps://runtimerebel.com/blog/iranian-hackers-target-kash-patel-us-offers-10m-bountyThe FBI confirms Iranian state-sponsored hackers compromised Kash Patel’s personal email, leading the U.S. to offer a $10M reward for information.Mon, 30 Mar 2026 08:42:33 GMTIranFBIKash PatelElection InterferenceState SponsoredAPThttps://runtimerebel.com/blog/iranian-cyber-infrastructure-hardening-ahead-of-operation-epic-furyhttps://runtimerebel.com/blog/iranian-cyber-infrastructure-hardening-ahead-of-operation-epic-furyAnalysis of Iran's six-month buildup of US-based shell companies and resilient cyber infrastructure to survive kinetic strikes and maintain hacking operations.Thu, 19 Mar 2026 16:25:33 GMTIranEmennet PasargadEpic FuryInfrastructure HardeningState Sponsoredhttps://runtimerebel.com/blog/google-disrupts-chinese-espionage-actor-unc2814-targeting-telecomshttps://runtimerebel.com/blog/google-disrupts-chinese-espionage-actor-unc2814-targeting-telecomsGoogle and Mandiant disrupt UNC2814, a Chinese state-sponsored actor active since 2017, targeting 42 countries across telecom and government sectors.Wed, 25 Feb 2026 16:34:10 GMTUNC2814ChinaCyber EspionageGoogle TAGMandiantTelecommunicationsState Sponsored