Many networks have a gap in their defenses for detecting and blocking a malicious technique known as “fast flux.” This technique poses a significant threat to national security, enabling malicious cyber actors to consistently evade detection. Malicious cyber actors...
Iranian threat actors have deployed a new malware, IOCONTROL, to target Internet of Things (IoT) devices and Operational Technology (OT)/SCADA systems in critical infrastructure across Israel and the United States. Analysts have categorized IOCONTROL as a nation-state...
Analysts recently identified the resurgence of the KV botnet, an operational relay box (ORB) network associated with the Chinese APT group Volt Typhoon. Their modus operandi involves compromising outdated and end-of-life SOHO devices.
For over five years, Sophos analysts have monitored cyber threats from Chinese groups targeting its firewalls with advanced botnets and tailored malware. Collaborating cybersecurity organizations and law enforcement attributed clusters of activity to groups like Volt Typhoon, APT31, etc.
Recent open-source reporting details the activity of Chinese advanced persistent threat (APT) Salt Typhoon amidst the 2024 presidential election. Salt Typhoon has compromised telecommunications infrastructure, including infrastructure associated with court-ordered wiretaps
The CISA has received multiple reports of a large-scale spearphishing campaign targeting organizations in several sectors. The foreign threat actor, often posing as a trusted entity, is sending spearphishing emails containing malicious remote desktop protocol (RDP) files
The Federal Bureau of Investigation (FBI), US Department of Treasury, and Israel National Cyber Directorate released this Joint Cybersecurity Advisory to warn network defenders of new cyber tradecraft of the Iranian cyber group Emennet Pasargad, which has been operating under an alias...
In a joint statement released on October 25, the Office of the Director of National Intelligence (ODNI), the FBI, and the CISA assessed that Russian influence operations had manufactured and amplified a video falsely depicting ballots being destroyed in Pennsylvania
The FBI, the CISA, the NSA, the Communications Security Establishment Canada (CSE), Australian Federal Police (AFP), and others released this Joint Cybersecurity Advisory to warn network defenders of Iranian cyber actors’ use of brute force.
Since at least 2021, Russian SVR cyber threat actors – also tracked as APT29, Midnight Blizzard (formerly Nobelium), Cozy Bear, and the Dukes – have consistently targeted US, European, and global entities in the Defense Industrial Base, and other sectors.
