Russian nation-state cyber actors remain among the most persistent, capable, and strategically aligned threats in the global cyber landscape. Their operations routinely target Western governments, critical infrastructure, defense contractors, and political institutions.

The NJCCIC’s email security solution observed an uptick in campaigns spreading Astaroth malware from TA2725 . Astaroth, first spotted in 2017, is an information-stealing trojan that primarily targets businesses in Brazil, Europe, and other countries throughout Latin America.

China is engaging in sustained cyber operations against US critical infrastructure. The NJCCIC's latest threat analysis report analyzes Chinese state-sponsored cyber campaigns targeting key sectors with the intent to disrupt vital services during a geopolitical conflict.

This Joint Cybersecurity Advisory highlights a Russian state-sponsored cyber campaign targeting Western logistics entities and technology companies. This campaign includes those involved in the coordination, transport, and delivery of foreign assistance to Ukraine.

Many networks have a gap in their defenses for detecting and blocking a malicious technique known as “fast flux.” This technique poses a significant threat to national security, enabling malicious cyber actors to consistently evade detection. Malicious cyber actors...

Iranian threat actors have deployed a new malware, IOCONTROL, to target Internet of Things (IoT) devices and Operational Technology (OT)/SCADA systems in critical infrastructure across Israel and the United States. Analysts have categorized IOCONTROL as a nation-state...

Analysts recently identified the resurgence of the KV botnet, an operational relay box (ORB) network associated with the Chinese APT group Volt Typhoon. Their modus operandi involves compromising outdated and end-of-life SOHO devices.

For over five years, Sophos analysts have monitored cyber threats from Chinese groups targeting its firewalls with advanced botnets and tailored malware. Collaborating cybersecurity organizations and law enforcement attributed clusters of activity to groups like Volt Typhoon, APT31, etc.

Recent open-source reporting details the activity of Chinese advanced persistent threat (APT) Salt Typhoon amidst the 2024 presidential election. Salt Typhoon has compromised telecommunications infrastructure, including infrastructure associated with court-ordered wiretaps

The CISA has received multiple reports of a large-scale spearphishing campaign targeting organizations in several sectors. The foreign threat actor, often posing as a trusted entity, is sending spearphishing emails containing malicious remote desktop protocol (RDP) files