OceanLotus (APT32) Threat Actor Profile
OceanLotus, also known as APT32, is a Vietnam-aligned advanced persistent threat group active since 2012. It has historically targeted foreign entities, including…
Tag: cyber espionage
Chinese Hackers Abused Google Workspace Rules to Steal Research and Defense Emails
A China-linked espionage group tracked as UNC6508 compromised REDCap research servers across North American medical, academic, and military institutions, stealing sensitive research…
APT37 (ScarCruft) – North Korean Cyber Espionage Group
APT37, also known as ScarCruft, is a North Korean cyber espionage group that has been active since at least 2012. They are…
UNC1069: North Korean Cyber Espionage Group
UNC1069 is a threat group attributed to North Korea, associated with the WAVESHAPER.V2 backdoor and activities overlapping with Sapphire Sleet. It has…
Famous Chollima: North Korea’s IT Worker Operation
Famous Chollima is the name used by CrowdStrike to describe North Korea's IT worker operation, which involves placing operatives in companies worldwide…
APT31: Chinese Cyber Espionage Group
APT31, also known as Zirconium, is a Chinese state-sponsored cyber espionage group that has used Tailscale for tunneling in attacks against Russian…
Cobalt Strike: Commercial Penetration Testing Tool Abused by Threat Actors
Cobalt Strike is a commercial penetration testing tool frequently abused by threat actors for command-and-control. In this campaign, it was used by…
Canada’s Spy Agency Uses First-of-Its-Kind Warrant to Clean Botnet-Infected Devices
Canada's spy service, the Canadian Security Intelligence Service (CSIS), obtained a judge's permission to remotely clean botnet-infected devices on Canadian soil, marking…