RedEcho: China-Linked Cyber Campaign
RedEcho is a cyber campaign attributed to China-linked actors targeting India's power sector, notably using ShadowPad malware in 2021.
Category: Attack Groups
MITRE ATT&CK groups, threat actors, intrusion sets and activity clusters.
Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse
Russian APT group Gamaredon has continued its cyber onslaught against Ukraine throughout 2025, deploying new malware and increasingly abusing legitimate cloud services.…
ShadyPanda: Browser Extension Malware Campaign
ShadyPanda is a browser extension malware campaign linked to the DarkSpectre threat actor. It shares techniques with StegoAd, including hiding code in…
GhostPoster: Browser Extension Malware Campaign
GhostPoster is a browser extension malware campaign associated with DarkSpectre. It uses steganography to hide malicious code in extension icons, similar to…
DarkSpectre: Chinese Threat Actor Behind Browser Extension Malware
DarkSpectre is a Chinese threat actor linked by Koi Security to the StegoAd campaign. It has been active since at least 2021,…
Fake Font: Malicious npm and Go Packages Disguised as Font Files
A cluster of malicious packages that use fake .woff2 font files to conceal JavaScript payloads. Tactically overlaps with TaskJacker and PolinRider, using…
North Korean Cyber Threat Actors
State-sponsored hackers from North Korea engaged in cyber espionage and cryptocurrency theft, often targeting developers and supply chains.
Ukraine and FBI Uncover Russian Intelligence Campaign Using Fake Support Texts to Steal Messaging Credentials
The Security Service of Ukraine (SSU), in coordination with the U.S. Federal Bureau of Investigation (FBI), has uncovered a long-running cyber espionage…
Star Blizzard: Russian Threat Actor Targeting Messaging Platforms
Star Blizzard is a Russian threat activity cluster known for phishing campaigns targeting messaging app users, including Signal and WhatsApp, to steal…
UNC1151 (Ghostwriter, UAC-0057): Belarus-Aligned Threat Actor
UNC1151, also known as Ghostwriter and UAC-0057, is a Belarus-aligned threat actor that conducted spear-phishing campaigns targeting Ukrainian government organizations, delivering the…