State-Sponsored

Russia's FSB-linked Star Blizzard used a new delivery technique, RedFlick, in 13 phishing campaigns affecting 100+ US and UK organizations to deploy its CosmicPulse backdoor in 2026.

China-nexus actor UAT-11587 hit ~350 endpoints across 8 countries with Antino, a Rust backdoor that uses Outlook and OneDrive via Microsoft Graph for stealth C2, per Cisco Talos.

Rapid7 found 'ted', a backdoor a DPRK-linked APT compiled into victims' HAProxy load balancers as a native plugin — reading their decrypted traffic and routing C2 through the load balancer itself. A companion CurlRAT toolkit hid in five trojanized Linux daemons; targets were South Korean firms.

Proofpoint documented BlueMoon, an exploit chain (CVE-2026-85046, -87491, -85880) four espionage clusters — led by China's TA412/APT31 — adopted within days to go from a web page to SYSTEM on patched Windows. Two V8 bugs were patch-gap zero-days; TA412 delivered a 'Google Gemini' spyware extension.

A maximum-severity SonicWall SMA1000 SSRF was exploited as a zero-day three weeks before its July patch. Volexity's UTA0533, a separate credential-harvesting operator, and an INC Ransomware affiliate all piled on — one ran Impacket secretsdump from the appliance to DCSync seven domain controllers.

ESET Research documents SparroWocky, a new C++ backdoor from the China-aligned FamousSparrow APT that has almost exclusively targeted Latin American government organizations since mid-2025 — including an entity directly involved in Panama's contested port concession dispute.

A joint NCSC/FBI/AIVD advisory published September 15, 2026 details HEAVYGRAM (CHOSEN BRICK), a Telegram-controlled Windows backdoor Iran's MOIS-linked Handala Hack uses to surveil dissidents and journalists — the same actor behind the Stryker wiper attack and DOJ domain seizures.

CVE-2023-46805 and CVE-2024-21887 gave a suspected China-nexus actor unauthenticated code execution on Ivanti VPN gateways from December 2023. Disclosure turned it into 2,100 compromised appliances in a week, a bypassed mitigation and CISA's order to unplug every federal device.

Anthropic's September threat report describes a Midnight Blizzard-linked operator running eight AI workflows — phishing, hotel Wi-Fi hijack, malware evasion — against 24 targets in Ukraine and Europe. Microsoft's CaptiveCrunch report, from the other side, lists four of the same domains.

Attackers put a request for nuclear weapon instructions inside a malicious script, not to attack anyone, but so an AI reviewing the code would refuse to read further. The defender's safety guardrail becomes the evasion.

A North Korean-linked actor compromised Trading Technologies' X_TRADER, used it to breach 3CX, and shipped signed, trojanised VoIP clients to its customers — the first documented case of one software supply chain attack causing another.

The cyber espionage landscape has evolved toward an industrialized 'quartermaster' model of network obfuscation and reconnaissance. On August 26, 2026, the United States Department of Justice (DOJ)...

CISA, NSA, and FBI confirmed that PRC state-sponsored actor Volt Typhoon maintained undetected access to multiple US critical infrastructure networks for at least five years, extracting NTDS.dit databases and pre-positioning for potential OT disruption.

Russian state-sponsored group Midnight Blizzard (APT29) breached Microsoft's corporate environment via password spray against a legacy non-production test tenant, accessed executive and security team email, and exfiltrated OAuth tokens and source code — demonstrating sophisticated identity-based tradecraft without malware.