ATT-systeme Intrusion

19
Jul
Poland's water utilities become the latest target in Russia's shadow campaign- 218

Poland's water utilities become the latest target in Russia's shadow campaign- 218

May 7, 2026 Poland's domestic intelligence service has confirmed what regional cybersecurity researchers had already begun tracking: hackers
2 min read
19
Jul
Beijing's Deniable Army: A Breach in Rome and a Warrant in Washington- 216

Beijing's Deniable Army: A Breach in Rome and a Warrant in Washington- 216

May 10, 2026 Two stories surfaced within days of each other in the spring of 2026, on opposite sides of
3 min read
19
Jul
Belarus's Oldest Digital Weapon Returns to Kyiv- 215

Belarus's Oldest Digital Weapon Returns to Kyiv- 215

June 28, 2026 Nearly a decade into its operational life, the Belarus-aligned threat group known as Ghostwriter has not
3 min read
19
Jul
MuddyWater's Double Game: Iran's Cyber Unit Trades Precision for Reach- 213

MuddyWater's Double Game: Iran's Cyber Unit Trades Precision for Reach- 213

June 28, 2026 An intrusion that looks like a ransomware shakedown and a breach wave spanning nine countries on four
3 min read
05
Jul
Proprietary by Design: The Ransomware Ecosystem's Shift Toward Custom Tooling- 207

Proprietary by Design: The Ransomware Ecosystem's Shift Toward Custom Tooling- 207

June 17, 2026 The commodity toolchain is becoming a liability. Rclone gets flagged. Cobalt Strike beacon patterns get detected. The
3 min read
05
Jul
The Art of Looking Innocent: Iran's Dual-Track Tradecraft Evolution- 198

The Art of Looking Innocent: Iran's Dual-Track Tradecraft Evolution- 198

June 23, 2026 Iran's most effective cyber operations in 2026 do not announce themselves. One looked like routine
4 min read
05
Jul
Humanitarian Cover: Operation HumanitarianBait and the Surveillance Campaign Nobody Has Attributed- 190

Humanitarian Cover: Operation HumanitarianBait and the Surveillance Campaign Nobody Has Attributed- 190

June 15, 2026 A humanitarian aid application form, written in Russian, realistic enough that someone waiting for assistance would read
3 min read
05
Jul
The Door Left Open: FamousSparrow's Three-Wave Intrusion into Azerbaijani Energy Infrastructure- 187

The Door Left Open: FamousSparrow's Three-Wave Intrusion into Azerbaijani Energy Infrastructure- 187

June 7, 2026 ProxyNotShell was publicly disclosed in October 2022. The Exchange server at the center of the FamousSparrow intrusion
3 min read
05
Jul
The Elected Leader: How Turla Rebuilt Kazuar as a Peer-to-Peer Espionage Botnet- 186

The Elected Leader: How Turla Rebuilt Kazuar as a Peer-to-Peer Espionage Botnet- 186

June 13, 2026 Turla has been running espionage operations for more than two decades. In that time, defenders have learned
3 min read
05
Jul
The Disgruntled Researcher and the Dead Man's Switch: Nightmare-Eclipse's Zero-Day Campaign- 184

The Disgruntled Researcher and the Dead Man's Switch: Nightmare-Eclipse's Zero-Day Campaign- 184

June 5, 2026 Five Windows zero-days in a single year, released by a single anonymous researcher, timed to maximally
2 min read