APT28

Autonomous LLMjacking: ‘Skynet’ Agent Hijacks Exposed AI Models to Run Attacks

Swallowtail: Russian Espionage Group Targets Defense Firms in Two NATO Countries

Blog

Midnight Mimosa Malware Campaign Exploits Android Firmware Supply Chain

Chinese State-Linked Hackers Target US Critical Infrastructure with Automated Scanning and Cyber Espionage Tools

ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure

China Linked Warlock Ransomware Campaign Targets Critical Infrastructure

CLOSEDQUORUM: Malware Puts AI in the C2 Loop

Lunex Uses BYOVD to Disable Security Monitoring and Deploy Persistent Stealer

BraZetsu: AI-Enhanced Reconnaissance Fuels Exilware’s Access Marketplace

The Job Offer Has Claws: Mirage Kitten Deploys NodeRabbit and PollCat

Targeting the Systems Behind the Mission: OT Threats to US Critical Infrastructure and Military Operations

Gamers Get Played: Fake GTA6 Leaks Deliver a Grab Bag of Malware

BlueMoon Exploit Kit Rapidly Targets Key Verticals Across Multiple Espionage Campaigns

China and the Cyber Arms Race for AI Supremacy

FamousSparrow Takes Flight with New SparroWocky Backdoor

APT28 Leverages CVE-2026-21509 in Operation Neusploit

TA488 Targets Zimbra Mailservers with Half-Click Exploits

ta458 roundpress exploits

Microsoft Tracks NeedyMantis Post-Compromise Malware Targeting Telecoms and Government Contractors

Russian APT28-Linked Hackers Deploy HOOKEDGE Backdoor in European Espionage Attacks

APT28 HOOKEDGE Backdoor Abuses Microsoft Edge and webhook.site for C2 and Data Exfiltration

NSFOCUS Monthly APT Insights – April 2026

Hackers Hijack Hotel Wi-Fi Gateways to Steal Microsoft 365 Accounts Without Phishing

Explorer COM Hijacking Attack Loads Shellcode From AES-Encrypted Steganographic PNG

APT28 Weaponizes Outlook Zero-Click Flaw to Steal Net-NTLMv2 Hashes From NATO Targets

January 2026 CVE Landscape: 23 Critical Vulnerabilities Mark 5% Increase, APT28 Exploits Microsoft Office Zero-Day

ClickFix Campaigns Targeting Windows and macOS

February 2026 CVE Landscape: 13 Critical Vulnerabilities Mark 43% Drop from January

APT28: Geofencing as a Targeting Signal (CVE-2026-21509 Campaign)