Turla Backdoor Activity Resurfaces in Recent Campaigns
The Russian-linked Turla APT group has been deploying backdoors in new campaigns, continuing its long-standing espionage operations.
Category: Attack Groups
MITRE ATT&CK groups, threat actors, intrusion sets and activity clusters.
Sandworm: Russian GRU-Linked Cyber Espionage Group
Sandworm, also known as APT44, Seashell Blizzard, and UAC-0002, is a sophisticated hacking group affiliated with the GRU, Russia's military intelligence agency.…
Gamaredon: Russian APT Targeting Ukraine
Gamaredon is a Russian advanced persistent threat group that has been highly active against Ukrainian governmental and military institutions, using spear-phishing, custom…
MuddyWater: Iranian State-Sponsored Group
MuddyWater is an Iranian state-sponsored hacking group that shares overlaps with Cavern Manticore. It is known for cyber espionage operations, often targeting…
OceanLotus Targets Vietnam Investors With SPECTRALVIPER in FireAnt Supply Chain Attack
ESET has uncovered two campaigns by the Vietnam-aligned threat actor OceanLotus (APT32) targeting domestic entities and stock investors with the SPECTRALVIPER backdoor.…
OceanLotus (APT32) Threat Actor Profile
OceanLotus, also known as APT32, is a Vietnam-aligned advanced persistent threat group active since 2012. It has historically targeted foreign entities, including…
APT32 — Attack group profile
APT32 was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
ThreatsDay Bulletin: Worm Code Leaked, AI Agent Phished, Claude Code Patch + 28 New Stories
ThreatsDay Bulletin: Worm Code Leaked, AI Agent Phished, Claude Code Patch + 28 New Stories Ravie LakshmananJun 11, 2026Hacking News / Cybersecurity…
ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities
The ShinyHunters extortion crew exploited an unpatched remote code execution vulnerability in Oracle PeopleSoft (CVE-2026-35273) to breach enterprise systems, primarily targeting universities.…
UNC6240: Mandiant’s Tracking Name for ShinyHunters
Mandiant tracks the ShinyHunters group as UNC6240, attributing the Oracle PeopleSoft zero-day exploitation campaign to them.