Iranian state-sponsored cyber threat actors—including groups operating under the direction of the Islamic Revolutionary Guard Corps (IRGC) and the Ministry of Intelligence and Security (MOIS)—represent a persistent and strategically motivated threat.
The Cybersecurity and Infrastructure Security Agency (CISA), along with the NSA, FBI, and international partners released this Joint Cybersecurity Advisory on People’s Republic of China (PRC) state-sponsored Advanced Persistent Threat (APT) actors targeting critical infrastructure.
Russian nation-state cyber actors remain among the most persistent, capable, and strategically aligned threats in the global cyber landscape. Their operations routinely target Western governments, critical infrastructure, defense contractors, and political institutions.
The NJCCIC’s email security solution observed an uptick in campaigns spreading Astaroth malware from TA2725 . Astaroth, first spotted in 2017, is an information-stealing trojan that primarily targets businesses in Brazil, Europe, and other countries throughout Latin America.
China is engaging in sustained cyber operations against US critical infrastructure. The NJCCIC's latest threat analysis report analyzes Chinese state-sponsored cyber campaigns targeting key sectors with the intent to disrupt vital services during a geopolitical conflict.
This Joint Cybersecurity Advisory highlights a Russian state-sponsored cyber campaign targeting Western logistics entities and technology companies. This campaign includes those involved in the coordination, transport, and delivery of foreign assistance to Ukraine.
Many networks have a gap in their defenses for detecting and blocking a malicious technique known as “fast flux.” This technique poses a significant threat to national security, enabling malicious cyber actors to consistently evade detection. Malicious cyber actors...
Iranian threat actors have deployed a new malware, IOCONTROL, to target Internet of Things (IoT) devices and Operational Technology (OT)/SCADA systems in critical infrastructure across Israel and the United States. Analysts have categorized IOCONTROL as a nation-state...
Analysts recently identified the resurgence of the KV botnet, an operational relay box (ORB) network associated with the Chinese APT group Volt Typhoon. Their modus operandi involves compromising outdated and end-of-life SOHO devices.
For over five years, Sophos analysts have monitored cyber threats from Chinese groups targeting its firewalls with advanced botnets and tailored malware. Collaborating cybersecurity organizations and law enforcement attributed clusters of activity to groups like Volt Typhoon, APT31, etc.
