✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Defense/Space
Breach intelligence, attack campaigns, and threat reports targeting the Defense/Space sector.
Explore Other Sectors
Defense/Space Threat Reports
Authorities Dismantle Major IoT Botnets Behind Massive DDoS Attacks
In March 2026, the U.S. Department of Justice, in collaboration with Canadian and German authorities, dismantled the infrastructure of four significant IoT botnets—Aisuru, Kimwolf, JackSkid, and Mossad. These botnets had compromised over three million devices, including routers and web cameras, and were responsible for numerous large-scale distributed denial-of-service (DDoS) attacks. The operators of these botnets launched hundreds of thousands of DDoS attacks, often extorting victims for payments, leading to substantial financial losses and operational disruptions. ([cybernews.com](https://cybernews.com/security/lumen-strikes-aisuru-kimwolf-botnet/?utm_source=openai)) This takedown underscores the escalating threat posed by IoT-based botnets, which have been increasingly utilized to execute record-breaking DDoS attacks. The incident highlights the critical need for enhanced security measures for IoT devices and the importance of international cooperation in combating cyber threats. ([thehackernews.com](https://thehackernews.com/2026/02/aisurukimwolf-botnet-launches-record.html?utm_source=openai))
4 months ago
Kill Chain
Justice Department Dismantles Major Botnets in 2026
In March 2026, the U.S. Department of Justice, in collaboration with international law enforcement agencies, successfully dismantled four major botnets—Aisuru, Kimwolf, JackSkid, and Mossad—that collectively hijacked over 3 million devices worldwide. These botnets were responsible for launching more than 300,000 distributed denial-of-service (DDoS) attacks, including record-breaking incidents such as a 31.4 terabits-per-second attack attributed to Aisuru. The compromised devices included digital video recorders, web cameras, Wi-Fi routers, and TV boxes, many of which were located in the United States. The operation involved seizing the command-and-control infrastructure, effectively disrupting the botnets' ability to launch further attacks. This takedown underscores the escalating threat posed by large-scale botnets and highlights the critical need for robust cybersecurity measures to protect internet-connected devices from exploitation. The incident also reflects a growing trend of cybercriminals leveraging vast networks of compromised devices to conduct massive DDoS attacks, emphasizing the importance of international cooperation in combating cyber threats.
4 months ago
Kill Chain
Konni's 2026 Phishing Attack Deploys AI-Generated EndRAT via KakaoTalk
In early 2026, the North Korean state-sponsored hacking group Konni launched a sophisticated phishing campaign targeting blockchain developers in Japan, Australia, and India. The attackers utilized AI-generated PowerShell malware, delivered through malicious emails disguised as financial notices. These emails contained ZIP files with Windows shortcuts that executed embedded PowerShell loaders, leading to the deployment of the EndRAT backdoor. This malware enabled the attackers to establish persistence, evade detection, and gain unauthorized access to development environments, potentially compromising sensitive blockchain-related resources and infrastructure. This incident underscores a significant evolution in cyber threat tactics, highlighting the increasing use of artificial intelligence by threat actors to enhance the sophistication and effectiveness of their attacks. The targeting of blockchain developers indicates a strategic shift towards compromising emerging financial technologies, emphasizing the need for heightened vigilance and advanced security measures within the industry.
4 months ago
Kill Chain
Unveiling the Stealth: China's Prolonged Cyber Espionage in Southeast Asia
In March 2026, Palo Alto Networks' Unit 42 uncovered a prolonged cyber espionage campaign attributed to Chinese state-sponsored actors, targeting military organizations in Southeast Asia since at least 2020. The attackers employed novel backdoors, including 'AppleChris' and 'MemFun,' and utilized dead-drop resolvers on platforms like Pastebin and Dropbox to maintain covert command-and-control channels. Their operations focused on exfiltrating sensitive military data, such as information on capabilities, organizational structures, and collaborations with Western forces. The campaign demonstrated strategic patience, with attackers maintaining undetected access for extended periods and employing advanced evasion techniques like delayed execution and timestomping to avoid detection. This incident underscores the evolving sophistication of state-sponsored cyber threats, highlighting the need for organizations to enhance their cybersecurity measures. The use of legitimate web services for malicious activities and the deployment of custom malware with advanced evasion tactics reflect a broader trend in cyber espionage, emphasizing the importance of proactive threat intelligence and robust security protocols.
4 months ago
Kill Chain
PLUGGYAPE Malware: A New Cyber Threat Targeting Defense Sectors
Between October and December 2025, Ukrainian defense forces were targeted by a cyber-espionage campaign attributed to the Russian-affiliated group Void Blizzard (also known as Laundry Bear or UAC-0190). The attackers utilized messaging platforms such as Signal and WhatsApp to impersonate charitable organizations, distributing password-protected archives containing the PLUGGYAPE backdoor malware. Once executed, PLUGGYAPE enabled remote code execution, system reconnaissance, and data exfiltration, maintaining persistence through Windows Registry modifications. This campaign underscores the evolving tactics of state-sponsored actors in leveraging social engineering and trusted communication channels to infiltrate sensitive targets. The incident highlights the increasing sophistication of cyber threats facing defense sectors, emphasizing the need for enhanced vigilance and robust security measures to counteract such espionage activities.
4 months ago
Kill Chain
Poland's Nuclear Research Center Successfully Defends Against Cyberattack
In March 2026, Poland's National Centre for Nuclear Research (NCBJ) successfully thwarted a cyberattack targeting its IT infrastructure. The institute's security systems and internal procedures detected the intrusion early, preventing any compromise to their systems. Notably, the MARIA reactor, Poland's sole nuclear reactor used for scientific research and medical isotope production, remained unaffected and continued to operate safely at full capacity. While the NCBJ did not attribute the attack to any specific entity, reports suggest potential involvement of Iranian actors, though investigators caution that these indicators may be deceptive. This incident underscores the escalating cyber threats faced by critical infrastructure globally, particularly in the nuclear sector. Organizations must remain vigilant, continuously enhancing their cybersecurity measures to detect and respond to such sophisticated attacks promptly.
4 months ago
Kill Chain
Authorities Dismantle SocksEscort Botnet Exploiting 369,000 IPs
In March 2026, an international law enforcement operation dismantled the SocksEscort botnet, which had infected approximately 369,000 residential routers across 163 countries since 2020. The botnet, powered by the AVrecon malware, allowed cybercriminals to route malicious internet traffic through compromised devices, facilitating large-scale fraud and other illicit activities. The operation, codenamed Operation Lightning, resulted in the seizure of 34 domains, 23 servers, and the freezing of $3.5 million in cryptocurrency assets. This takedown underscores the persistent threat posed by botnets leveraging residential devices and highlights the importance of securing home and small business routers against exploitation. The incident serves as a critical reminder for organizations and individuals to regularly update and monitor their network devices to prevent similar compromises.
4 months ago
Kill Chain
Chinese Hackers Infiltrate Southeast Asian Militaries Using Advanced Malware
In March 2026, a China-based cyber espionage operation, identified as CL-STA-1087 by Palo Alto Networks Unit 42, targeted Southeast Asian military organizations. The attackers employed sophisticated malware tools, including AppleChris and MemFun backdoors, and a credential harvester named Getpass, to infiltrate systems and exfiltrate sensitive information related to military capabilities and collaborations with Western armed forces. The campaign demonstrated strategic patience, utilizing advanced techniques such as DLL hijacking and sandbox evasion to maintain prolonged unauthorized access. This incident underscores the persistent threat posed by state-sponsored cyber actors to national security infrastructures. The use of advanced malware and evasion tactics highlights the evolving sophistication of cyber espionage campaigns, necessitating enhanced vigilance and robust cybersecurity measures within military and governmental networks.
4 months ago
Kill Chain
Iran MOIS's 2026 Cyber Collaboration with Criminal Groups
In March 2026, Iran's Ministry of Intelligence and Security (MOIS) intensified its cyber operations by collaborating with cybercriminal groups to enhance the scale and effectiveness of its attacks. This partnership led to a series of sophisticated cyberattacks targeting critical infrastructure and private sector entities in the United States and Europe. The MOIS leveraged the expertise and tools of cybercriminals to conduct operations that included data breaches, ransomware attacks, and disruptive activities against government and corporate networks. ([forbes.com](https://www.forbes.com/sites/steveweisman/2026/03/03/irans-cyberwarfare-attacks-will-be-targeting-critical-infrastructure/?utm_source=openai)) This incident underscores a concerning trend where state-sponsored actors are increasingly partnering with cybercriminal organizations to achieve geopolitical objectives. Such collaborations blur the lines between nation-state and criminal cyber activities, complicating attribution and response efforts. Organizations must remain vigilant and adapt their cybersecurity strategies to address this evolving threat landscape.
4 months ago
Kill Chain
Stryker's 2026 Cyberattack: A Wake-Up Call for Healthcare Cybersecurity
In March 2026, Stryker, a leading U.S. medical technology company, experienced a significant cyberattack attributed to the Iranian-linked hacking group Handala. The attackers claimed to have wiped over 200,000 systems and extracted 50 terabytes of critical data, leading to widespread operational disruptions across Stryker's global network. The attack was reportedly in retaliation for U.S. military actions in Iran. ([techradar.com](https://www.techradar.com/pro/security/an-unprecedented-blow-us-medtech-giant-stryker-suffers-global-outage-after-apparent-iranian-cyberattack?utm_source=openai)) This incident underscores the escalating cyber threats targeting critical healthcare infrastructure, highlighting the need for robust cybersecurity measures to protect sensitive data and ensure operational continuity in the face of nation-state-sponsored cyberattacks.
4 months ago
Kill Chain
Apple's Response to Coruna Exploit Kit: Critical Security Updates Released
In March 2026, Apple released security updates for older iOS devices to address vulnerabilities exploited by the Coruna exploit kit. This sophisticated toolkit targeted iOS versions from 13.0 to 17.2.1, leveraging 23 vulnerabilities across five exploit chains. The Coruna kit was utilized by various threat actors, including state-sponsored groups and financially motivated cybercriminals, to gain unauthorized access to iPhones through malicious web content. The vulnerabilities allowed attackers to execute arbitrary code with kernel privileges, leading to potential data theft and device compromise. ([9to5mac.com](https://9to5mac.com/2026/03/11/apple-confirms-todays-ios-and-ipados-updates-for-older-devices-address-the-coruna-exploit/?utm_source=openai)) The Coruna exploit kit's widespread use underscores the critical importance of timely software updates and robust security measures. Its ability to bypass multiple layers of defense highlights the evolving sophistication of cyber threats targeting mobile devices. Organizations and individuals must remain vigilant, ensuring devices are updated to the latest software versions to mitigate such risks. ([arstechnica.com](https://arstechnica.com/security/2026/03/cisa-adds-3-ios-flaws-to-its-catalog-of-known-exploited-vulnerabilities/?utm_source=openai))
4 months ago
Kill Chain
APT28's 2026 Espionage Campaign: Exploiting Office Vulnerabilities with Advanced Malware
In early 2026, the Russian state-sponsored threat actor APT28, also known as Fancy Bear, launched a sophisticated cyber-espionage campaign targeting Ukrainian military personnel. The attackers utilized spear-phishing emails containing malicious Microsoft Office documents to exploit the CVE-2026-21509 vulnerability, allowing them to execute code via OLE objects without macros or warnings. This method facilitated the deployment of two advanced malware implants: BeardShell, a custom C++ backdoor leveraging the Icedrive cloud service for command-and-control communications, and Covenant, a heavily modified open-source .NET post-exploitation framework. These tools enabled APT28 to conduct long-term surveillance, data exfiltration, and maintain persistent access to compromised systems. ([cyberpress.org](https://cyberpress.org/apt28-exploits-office-vulnerability/?utm_source=openai)) This incident underscores a significant evolution in APT28's tactics, techniques, and procedures (TTPs), highlighting their ability to rapidly weaponize newly disclosed vulnerabilities and integrate legitimate cloud services into their command-and-control infrastructure. The campaign's success emphasizes the urgent need for organizations to promptly apply security patches, enhance phishing defenses, and monitor for abuse of legitimate services in cyber operations. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/03/10/sednit-espionage-toolkit-stealing-data/?utm_source=openai))
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports