Advanced Persistent Threat (APT) Stories - Page 2

Global Stories

Advanced Persistent Threat (APT) stories

China-aligned TA416 resumes spying on EU & Mideast

Diplomatic missions in Europe and the Middle East face renewed PlugX-backed espionage as TA416 shifts tactics and targets amid regional tensions.

By Sean Mitchell • 4 min read • Tue, 7th Apr 2026

Malware

DeepLoad malware steals credentials via ClickFix campaign

Businesses face credential theft and reinfection risks as DeepLoad hides inside trusted Windows processes and evades routine clean-up.

By Joseph Gabriel Lagonsin • 4 min read • Wed, 1st Apr 2026

Data Protection

Commvault adds threat-hunting tools to backup scans

Existing Threat Scan customers get new free tools to spot ransomware in backups before restoration, reducing the risk of reinfecting production systems.

By Mark Tarre • 3 min read • Tue, 31st Mar 2026

Unified Communications

China-linked Red Menshen hides inside telecoms networks

Dormant implants in carrier systems could expose subscriber data and signals across Europe and APAC, Rapid7 warned.

By Joseph Gabriel Lagonsin • 4 min read • Fri, 27th Mar 2026

Gaming

NCC Group warns Iran cyber threats spread worldwide

Iran-linked cyber attacks are spreading beyond the Middle East, with firms tied to Israel or the US warned they face heightened global risk.

By Joseph Gabriel Lagonsin • 4 min read • Tue, 24th Mar 2026

Disaster Recovery

Iranian cyber shift raises risk to Western infrastructure

Iranian state-aligned hackers are shifting from spying to destructive cyber strikes, putting Western critical infrastructure on high alert.

By Shannon Williams • 6 min read • Fri, 13th Mar 2026

Endpoint Protection

Fake Red Alert app used in Android spyware smishing

Attackers push fake Red Alert Android app via SMS, turning Israel rocket warning tool into spyware that steals messages, contacts and location.

By Sean Mitchell • 4 min read • Fri, 13th Mar 2026

Phishing

Conflict sparks surge in Middle East cyber espionage

New research links Iran conflict to a swift surge in tightly targeted cyber espionage across Middle Eastern governments and embassies.

By Mark Tarre • 4 min read • Thu, 12th Mar 2026

Malware

Google report warns identity is weak link in cloud

Attackers are ditching malware for stolen identities, misconfigurations and abused AI tools, Google warns in its latest cloud threat report.

By Sean Mitchell • 4 min read • Wed, 11th Mar 2026

Storage

Kernel in the crosshairs: The BlackSanta threat campaign targeting recruitment workflows

A stealthy BlackSanta malware spree is hijacking HR recruitment workflows, killing endpoint defence tools and exfiltrating sensitive data.

By Aditya K. Sood • 4 min read • Wed, 11th Mar 2026

Malware

Google disrupts China-linked cyber espionage on telecoms

Google says it has crippled a China-linked cyber espionage group accused of hacking telecoms and governments in at least 42 countries.

By Sean Mitchell • 3 min read • Thu, 26th Feb 2026

Malware

LockBit 5.0 ransomware targets Windows, Linux, ESXi

New LockBit 5.0 ransomware hits Windows, Linux and ESXi in single campaigns, widening blast radius across mixed and virtualised environments.

By Catherine Knowles • 3 min read • Wed, 18th Feb 2026

Data Protection

Okta warns of North Korean fraud in remote tech hiring

Okta warns North Korean operatives are landing remote tech jobs with stolen and synthetic identities to fund the regime and enable cyber attacks.

By Sofiah Nichole Salivio • 5 min read • Fri, 13th Feb 2026

Firewalls

Hackers ditch noisy ransomware for stealthy data theft

Hackers are abandoning noisy ransomware to quietly steal data, as a report finds 80% of top attack techniques now focus on evasion.

By Shannon Williams • 4 min read • Thu, 12th Feb 2026

Surveillance

Espionage Without Noise: Understanding APT36's Enduring Campaigns

Indian defence faces a decade-long silent siege as APT36 refines cross-platform cyber espionage with stealthy, persistent RAT campaigns.

By Dr Aditya Sood • 5 min read • Wed, 11th Feb 2026

Malware

CrowdStrike splits LABYRINTH CHOLLIMA into three units

CrowdStrike has split North Korea-linked LABYRINTH CHOLLIMA into three units, two for crypto theft and one for industrial espionage.

By Joseph Gabriel Lagonsin • 5 min read • Fri, 30th Jan 2026

Phishing

LOTUSLITE backdoor targets US policy bodies with lures

Politically themed LOTUSLITE phishing campaign hits US policy bodies, using DLL sideloading and espionage-focused backdoor tactics.

By Kaleah Salmon • 3 min read • Thu, 22nd Jan 2026

Stories from Other Regions

Advanced Persistent Threat (APT) stories

Malware

OT downtime costs firms up to GBP £5 million, survey finds

Operational technology outages are leaving most manufacturers and critical infrastructure firms facing losses of up to GBP £5 million, a survey found.

By Kaleah Salmon • 4 min read • Thu, 2nd Apr 2026