The KeyHunter operation is a multi-vector cyber campaign by the Chinese-speaking threat actor leepsmarts targeting academic institutions and cloud infrastructure. It involves theft of large numbers of LLM API keys from misconfigured cloud platforms, creation of fraudulent student accounts at multiple universities, and processing of stolen Harvard alumni data. The operation uses AI agent frameworks and Telegram bots for automation. Parallel financial fraud includes cryptocurrency draining and credit card validation using stolen credentials. The infrastructure spans multiple countries and has been active since early 2026.
A Korean-speaking threat actor linked with moderate confidence to North Korea's Lazarus Group is conducting a global campaign exploiting two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that allow unauthenticated remote code execution. The campaign targets government agencies, financial institutions, manufacturing, logistics, aviation, and trading platforms across multiple countries including the US, Japan, and EU. Exploitation attempts have been observed since 17 October 2026, involving web shell deployment and session poisoning. The vulnerabilities affect all internet-facing PHP installations below versions 8.5.12, 8.4.27, 8.3.36, or 8.2.35, with Apache mod_php being at highest risk.
BigBear 2.0 is a phishing-as-a-service campaign leveraging Evilginx2 to target Microsoft 365 credentials worldwide. It uses adversary-in-the-middle techniques combined with geo-matched residential proxies to bypass multi-factor authentication, including disabling FIDO2/WebAuthn MFA. The campaign has exfiltrated thousands of credentials and session cookies, impacting over 3,300 unique victim IPs across more than 40 countries. The platform is operated by an entity known as 'General Boss' and leased to multiple affiliates. It automates cookie replay and real-time data exfiltration via Telegram.
The Iranian-linked cyber-espionage group Tortoiseshell has expanded its malware toolkit with a new reverse SSH tunneling utility disguised as wtsapi32.dll and a C++ backdoor similar to TWOSTROKE malware. The SSH tunnel uses the Windows OpenSSH client to connect to command-and-control servers. The backdoor supports executing files, shell commands, in-memory DLL execution, and file manipulation. Infrastructure analysis shows domains linked to multiple countries including the UAE, Saudi Arabia, UK, Belgium, Canada, Australia, Japan, and the United States, indicating broader targeting beyond the Middle East and US defense and military sectors. The group has been active since 2018 and maintains persistent infrastructure despite domain suspensions. No known exploits in the wild or patches are reported.
Mirage2FA is an active phishing-as-a-service toolkit built to steal Microsoft 365 credentials and authenticated sessions through Adversary-in-the-Middle attacks. Analysis shows 63.7% of identified victims are in the US, with Technology, Manufacturing, and Education among the most targeted industries. The operation generated thousands of compromise events between 2024 and 2026, including stolen session cookies, passwords, and SSO access. Once a Microsoft 365 session is hijacked, attackers gain access to corporate email, sensitive data, and trusted business accounts. The toolkit uses browser-based delivery through .htm, .xhtml, and .svg stagers, QR codes, JavaScript obfuscation, and WebSocket-based AiTM activity. Of 9,426 unique targeted email addresses, 4,532 were potentially compromised, representing approximately 48% success rate.
This report highlights a cyber espionage campaign attributed to the Iranian APT group Charming Kitten, targeting eight countries and eight critical sectors simultaneously. The campaign, dubbed Operation Olalampo, affects Egypt, Saudi Arabia, UAE, Turkey, Hungary, Turkmenistan, Israel, and South America, focusing on government, healthcare, financial services, energy, education, telecommunications, defense, and industrial sectors. The information is sourced from a Reddit post linking to a GitHub repository simulating adversary tactics. No specific vulnerabilities or exploits are detailed, and no affected software versions are identified.
Beginning in August 2025, a sophisticated intrusion was discovered where attackers used log poisoning techniques to deploy a web shell on vulnerable phpMyAdmin panels. The threat actors exploited misconfigured web applications to plant China Chopper web shells, controlled via AntSword, before deploying Nezha, an open-source monitoring tool, to facilitate remote command execution. This led to the deployment of Ghost RAT on compromised systems. Analysis revealed over 100 compromised machines, predominantly located in Taiwan, Japan, South Korea, and Hong Kong. The attackers demonstrated technical proficiency through multi-stage operations, utilizing AWS and VPS infrastructure, with indicators pointing to China-nexus threat actors. The campaign highlights increasing abuse of legitimate publicly available tools to achieve malicious objectives while maintaining plausible deniability.
The Iranian IRGC-affiliated threat actor Nimbus Manticore launched sophisticated cyber operations during Operation Epic Fury, the US military campaign against Iran beginning February 28, 2026. The campaigns targeted organizations in aviation and software sectors across the United States, Europe, and Middle East using career-themed phishing lures. For the first time, the actor employed SEO poisoning techniques and introduced MiniFast, a previously undocumented backdoor showing signs of AI-assisted development. The operations leveraged AppDomain hijacking and abused legitimate Zoom installer execution flows for malware deployment. The actor demonstrated rapid adaptation capabilities during wartime conditions, maintaining high operational availability while expanding targeting to US-based aviation companies. Multiple campaign waves were observed from February through April 2026, with persistent infrastructure and evolving techniques.
DarkSword and Coruna are new iOS malware strains that infect devices through zero-click attacks. Learn how these threats operate, which iOS versions are at risk, and how to protect your devices.
In March 2026, a China-nexus threat actor launched a sophisticated campaign targeting countries in the Arabian Gulf region, exploiting renewed Middle East conflict themes within 24 hours of escalation. The attack utilized Arabic-language lures depicting missile strikes and employed a multi-stage infection chain beginning with weaponized ZIP archives containing malicious LNK and CHM files. The campaign deployed a heavily obfuscated PlugX backdoor variant through DLL sideloading, with components using control flow flattening and mixed boolean arithmetic techniques. The backdoor supports HTTPS command-and-control communications, DNS-over-HTTPS resolution, and multiple plugins for system manipulation. Based on tools, techniques, and procedures including specific RC4 decryption keys and rapid geopolitical weaponization, the activity is attributed with medium confidence to Mustang Panda.
Iran-linked hacking groups are turning to high-volume, low-impact cyberattacks, and AI is providing a boost. The post Hacked Hospitals, Hidden Spyware: Iran Conflict Shows How Digital Fight Is Ingrained in Warfare appeared first on SecurityWeek .
The group that it was making available for download emails and other documents from Patel’s account. The post Pro-Iranian Hacking Group Claims Credit for Hack of FBI Director Kash Patel’s Personal Account appeared first on SecurityWeek .
The role of Israel’s hijacking of Iran’s street cameras in the killing of the country’s supreme leader underscores how surveillance systems are increasingly being targeted by adversaries in wartime. The post Iran Built a Vast Camera Network to Control Dissent. Israel Turned It Into a Targeting Tool appeared first on SecurityWeek .
The FBI has issued an alert regarding malware linked to Iranian government hackers, discovered during an investigation involving the company Stryker. This malware represents a targeted cyber threat attributed to state-sponsored actors from Iran. While specific technical details and affected software versions are not disclosed, the medium severity rating suggests moderate risk to confidentiality, integrity, or availability. No known exploits are currently active in the wild, and no specific indicators of compromise have been publicly shared. The threat highlights ongoing geopolitical cyber tensions and the use of malware for espionage or disruption. Organizations in sectors with strategic importance or those operating in regions targeted by Iranian cyber operations should remain vigilant. Mitigation involves enhanced monitoring for suspicious files, network traffic analysis, and applying threat intelligence updates from trusted sources. Countries with significant exposure include the United States, Israel, Saudi Arabia, United Arab Emirates, and other Western and Middle Eastern nations. Given the medium severity, the threat requires proactive defense but is not currently critical. Defenders should focus on early detection and incident response readiness to mitigate potential impacts.
A new cybercriminal group, Nasir Security, believed to be associated with Iran, is targeting energy organizations in the Middle East. They focus on attacking supply chain vendors involved in engineering, safety, and construction. The group emerged in October 2025 and has claimed attacks on various energy sector companies, including Dubai Petroleum, CC Energy Development, and Al-Safi Oil Company. However, their claims are likely exaggerated, and the actual breaches appear to be of third-party contractors. The group's tactics include business email compromise, spear phishing, and exploiting public-facing applications. Their activities are seen as part of a broader Iranian strategy to conduct cyberattacks and spread misinformation during ongoing geopolitical conflicts.
A series of attacks targeting Libyan organizations, including an oil refinery, a telecoms organization, and a state institution, occurred between November 2025 and February 2026. The campaign utilized the AsyncRAT backdoor, delivered through spear-phishing emails with Libya-themed lure documents. The attackers exploited current events, such as the assassination of Saif al-Gaddafi, to gain access to networks. The modular nature of AsyncRAT and the targeted organizations suggest possible state sponsorship. The campaign's focus on Libya and its oil industry is notable, given the country's increased oil production and global energy supply concerns amidst Middle East conflicts.
The US has seized several domains used by Handala in cyber-enabled psychological operations. The post US Confirms Handala Link to Iran Government Amid Takedown of Hackers’ Sites appeared first on SecurityWeek .
Analysis reveals a six-month buildup of Iran-linked cyber infrastructure, including US-based shell companies, designed to weather kinetic strikes and ensure the resilience of its global hacking operations. The post Iran Readied Cyberattack Capabilities for Response Prior to Epic Fury appeared first on SecurityWeek .
The medtech giant has been working on restoring systems affected by the cyberattack conducted by the Handala hackers. The post Iranian Hackers Likely Used Malware-Stolen Credentials in Stryker Breach appeared first on SecurityWeek .
A China-nexus threat actor targeted countries in the Persian Gulf region using a multi-stage attack chain to deploy a PlugX backdoor variant. The campaign exploited the renewed Middle East conflict, using an Arabic-language document lure depicting missile attacks. The attack utilized a ZIP archive containing a malicious Windows shortcut file, which downloaded a CHM file leading to the deployment of PlugX. The malware employed various obfuscation techniques, including control flow flattening and mixed boolean arithmetic. The PlugX variant supported HTTPS for command-and-control communication and DNS-over-HTTPS for domain resolution. Based on the tools and tactics used, the activity is attributed to a China-nexus actor, possibly linked to Mustang Panda.
