✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Defense/Space
Breach intelligence, attack campaigns, and threat reports targeting the Defense/Space sector.
Explore Other Sectors
Defense/Space Threat Reports
Chinese APT Exploits Dell RecoverPoint Zero-Day Since 2024
In mid-2024, a Chinese state-sponsored threat group, identified as UNC6201, began exploiting a critical zero-day vulnerability (CVE-2026-22769) in Dell's RecoverPoint for Virtual Machines. This flaw, stemming from hardcoded credentials, allowed unauthenticated remote attackers to gain root-level access to affected systems. The attackers utilized this access to deploy backdoors such as BRICKSTORM and later GRIMBOLT, facilitating persistent access and lateral movement within compromised networks. Dell released a patch for this vulnerability in February 2026, urging immediate remediation to prevent further exploitation. ([securityweek.com](https://www.securityweek.com/dell-recoverpoint-zero-day-exploited-by-chinese-cyberespionage-group/?utm_source=openai)) This incident underscores the persistent threat posed by nation-state actors targeting critical infrastructure through zero-day vulnerabilities. The prolonged undetected exploitation highlights the necessity for robust monitoring and rapid response mechanisms to mitigate such sophisticated cyber threats. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/chinese-hackers-exploiting-dell-zero-day-flaw-since-mid-2024/?utm_source=openai))
5 months ago
Kill Chain
Operation Absolute Resolve: Cyber-Physical Tactics in Modern Warfare
On January 3, 2026, during Operation Absolute Resolve, U.S. forces executed a mission to capture Venezuelan President Nicolás Maduro. The operation involved over 150 aircraft conducting airstrikes on key military installations in Caracas, including Fuerte Tiuna and La Carlota Air Base. Concurrently, cyber capabilities were deployed to disrupt Venezuela's power grid, resulting in widespread blackouts across the capital. This multi-domain approach combined kinetic strikes with cyber operations to disable critical infrastructure and facilitate the extraction of Maduro. The operation led to significant physical damage to military facilities and substations, causing prolonged power outages in several districts. The integration of cyber and kinetic tactics underscores the evolving nature of modern military engagements, highlighting the strategic use of cyber operations to achieve tactical objectives. This incident serves as a case study in the application of cyber-physical strategies in contemporary warfare, emphasizing the need for robust cybersecurity measures to protect national infrastructure.
5 months ago
Kill Chain
Poland's Energy Sector Thwarts Major Cyberattack by Sandworm Group
In late December 2025, Poland's energy infrastructure was targeted by a coordinated cyberattack involving the deployment of a new data-wiping malware named DynoWiper. The attack focused on over 30 wind and solar farms, a combined heat and power plant serving nearly half a million customers, and a manufacturing company. The attackers exploited exposed FortiGate devices lacking multi-factor authentication to gain initial access, then moved laterally within networks to deploy the wiper malware. Despite the sophisticated nature of the attack, endpoint detection and response systems successfully blocked the malware's execution, preventing any disruption to energy production or distribution. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/06/poland-cyberattacks-energy-sector-industrial-organizations/?utm_source=openai)) This incident underscores the escalating threat posed by state-sponsored cyber actors targeting critical infrastructure. The use of destructive malware like DynoWiper highlights the need for robust cybersecurity measures, including the implementation of multi-factor authentication and regular security audits, to protect against such sophisticated attacks. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/06/poland-cyberattacks-energy-sector-industrial-organizations/?utm_source=openai))
5 months ago
Kill Chain
Siemens Simcenter Femap and Nastran 2026 File Parsing Vulnerabilities
In February 2026, Siemens disclosed multiple vulnerabilities in its Simcenter Femap and Nastran products, specifically affecting versions prior to V2512. These vulnerabilities, identified as CVE-2026-23715 through CVE-2026-23720, involve out-of-bounds read and write errors, as well as heap-based buffer overflows, which can be exploited by attackers through specially crafted NDB and XDB files. Successful exploitation could lead to application crashes or arbitrary code execution within the context of the current process. Siemens has released version V2512 to address these issues and recommends users update to this latest version. ([cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-965753.html?utm_source=openai)) The disclosure of these vulnerabilities underscores the persistent risks associated with file parsing mechanisms in critical engineering software. Organizations utilizing Simcenter Femap and Nastran should prioritize updating to the patched version to mitigate potential exploitation. This incident highlights the importance of regular software updates and vigilance against malicious file-based attacks in industrial environments.
5 months ago
Kill Chain
Polish Authorities Arrest Phobos Ransomware Affiliate in 2026
In February 2026, Polish authorities arrested a 47-year-old man in the Małopolska region, suspected of affiliating with the Phobos ransomware group. The arrest was part of Operation Aether, a Europol-coordinated effort targeting Phobos affiliates. During the raid, officials seized computers and mobile phones containing stolen credentials, credit card numbers, and server IP addresses. The suspect allegedly used encrypted messaging to communicate with Phobos members and faces charges under Poland's Criminal Code for creating and distributing software designed to illegally access computer systems. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/17/phobos-ransomware-affiliate-arrested-in-poland/?utm_source=openai)) This arrest underscores the persistent threat posed by ransomware groups like Phobos, which have targeted over 1,000 victims globally, including critical infrastructure sectors such as healthcare and education. The incident highlights the importance of international collaboration in combating cybercrime and the need for organizations to bolster their cybersecurity defenses against evolving ransomware tactics. ([justice.gov](https://www.justice.gov/opa/pr/phobos-ransomware-affiliates-arrested-coordinated-international-disruption?utm_source=openai))
5 months ago
Kill Chain
Germany 2026: Signal Account Hijacking Targets Senior Figures
In February 2026, Germany's Federal Office for the Protection of the Constitution (BfV) and the Federal Office for Information Security (BSI) issued a warning about state-sponsored threat actors targeting high-ranking individuals through phishing attacks on messaging apps like Signal. The attackers employed social engineering tactics, impersonating support teams to deceive politicians, military officers, diplomats, and investigative journalists into granting access to their accounts. This campaign did not exploit technical vulnerabilities or deploy malware but leveraged legitimate app features to gain unauthorized access to sensitive communications. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/germany-warns-of-signal-account-hijacking-targeting-senior-figures/?utm_source=openai)) This incident underscores a growing trend of sophisticated social engineering attacks that exploit trust in legitimate platforms. Organizations must enhance user awareness and implement robust security measures to mitigate such threats, especially as attackers increasingly target high-profile individuals through commonly used communication tools.
5 months ago
Kill Chain
Iranian Cyber Espionage Intensifies: Middle East Expatriates Targeted in 2026
In early 2026, Iranian state-sponsored cyber actors intensified their espionage activities targeting Middle Eastern expatriates, Syrians, and Israelis. Utilizing sophisticated social engineering techniques, these actors created credible fake personas on multiple platforms, engaging targets over extended periods to build trust. Once rapport was established, they employed spear-phishing campaigns, often delivering malicious links or documents under the guise of legitimate communications. These operations aimed to steal sensitive information, monitor communications, and track the movements of individuals of interest. The impact of these campaigns has been significant, compromising personal and professional data, and posing threats to the safety and privacy of the targeted individuals. The use of advanced social engineering tactics underscores the evolving nature of cyber threats emanating from state-sponsored actors. This incident highlights the urgent need for heightened vigilance and robust cybersecurity measures, especially for individuals and organizations operating in or related to the Middle East. The increasing sophistication of these attacks, coupled with their targeted nature, reflects a broader trend of state actors leveraging cyber capabilities for intelligence gathering and influence operations.
5 months ago
Kill Chain
Salt Typhoon 2025: Unveiling the Global Espionage Campaign
In 2025, the Chinese state-sponsored cyber group known as Salt Typhoon orchestrated a sophisticated global espionage campaign, compromising government and critical infrastructure across 37 countries and conducting reconnaissance in 155 nations. The attackers exploited unpatched vulnerabilities in networking equipment, including those from Ivanti, Palo Alto, and Cisco, to gain initial access. Once inside, they established persistent access by modifying access control lists, creating privileged accounts, and enabling remote management on unusual high ports. This allowed them to monitor communications, harvest administrator credentials, and exfiltrate sensitive data through covert tunnels, all while remaining undetected for extended periods. The campaign's targets included telecommunications networks, government systems, transportation hubs, lodging networks, and military infrastructure, enabling continuous surveillance of individuals, communications, and movements globally. ([forbes.com](https://www.forbes.com/sites/emilsayegh/2025/08/30/us-and-allies-declare-salt-typhoon-hack-a-national-defense-crisis/?utm_source=openai)) The Salt Typhoon campaign underscores the escalating threat posed by state-sponsored cyber actors and the vulnerabilities within critical infrastructure. The attackers' ability to exploit known vulnerabilities and maintain long-term access highlights the urgent need for organizations to prioritize timely patching, robust access controls, and comprehensive monitoring to detect and mitigate such sophisticated threats.
5 months ago
Kill Chain
Amaranth-Dragon's 2025 Exploitation of WinRAR Vulnerability: A Cybersecurity Wake-Up Call
In 2025, the China-linked cyber espionage group Amaranth-Dragon exploited a critical vulnerability in WinRAR (CVE-2025-8088) to target government and law enforcement agencies across Southeast Asia. By crafting malicious RAR archives, they executed arbitrary code upon extraction, leading to unauthorized access and data exfiltration. The campaigns were highly controlled, leveraging spear-phishing emails with tailored lures related to regional political developments, and utilized cloud platforms like Dropbox to distribute the malicious files. The exploitation of this vulnerability underscores the persistent threat posed by nation-state actors and the importance of timely software updates. Despite the release of WinRAR version 7.13, which addressed the flaw, many users remained vulnerable due to delayed patching. This incident highlights the critical need for organizations to maintain up-to-date software and implement robust security measures to defend against sophisticated cyber threats.
5 months ago
Kill Chain
APT28's Operation Neusploit: Exploiting Microsoft Office Zero-Day in 2026
In January 2026, the Russian state-sponsored group APT28 launched 'Operation Neusploit,' targeting users in Ukraine, Slovakia, and Romania. They exploited CVE-2026-21509, a vulnerability in Microsoft Office, by sending specially crafted Rich Text Format (RTF) documents via phishing emails. Opening these documents triggered a multi-stage infection chain, deploying malware such as MiniDoor, an Outlook email stealer, and PixyNetLoader, which installed the Covenant Grunt implant for command-and-control operations. Microsoft released an out-of-band patch on January 26, 2026, but active exploitation was observed as early as January 29, 2026. This incident underscores the rapid weaponization of newly disclosed vulnerabilities by advanced persistent threat actors and highlights the critical need for organizations to promptly apply security patches. The use of localized social engineering tactics and sophisticated evasion techniques in this campaign reflects an evolving threat landscape, emphasizing the importance of comprehensive cybersecurity measures.
5 months ago
Kill Chain
APT28's Operation Neusploit: Exploiting Microsoft Office Vulnerability CVE-2026-21509
In January 2026, the Russian state-sponsored threat actor APT28 launched 'Operation Neusploit,' targeting users in Ukraine, Slovakia, and Romania. The group exploited CVE-2026-21509, a zero-day vulnerability in Microsoft Office, by distributing malicious RTF documents via phishing emails. These documents, when opened, executed a multi-stage infection chain deploying backdoors like MiniDoor and PixyNetLoader, enabling email theft and persistent access to compromised systems. Microsoft released an emergency patch on January 26, 2026, but exploitation continued until at least January 29. This incident underscores the rapid weaponization of newly disclosed vulnerabilities by sophisticated threat actors, emphasizing the need for immediate patching and heightened vigilance against phishing campaigns.
5 months ago
Kill Chain
AI Coding Assistants Found Exfiltrating Code to China in 2026
In January 2026, security researchers uncovered that two AI coding assistant extensions, 'ChatGPT - 中文版' and 'ChatMoss (CodeMoss)', available on the Visual Studio Code Marketplace, were surreptitiously exfiltrating developers' source code to servers in China. These extensions, collectively installed by approximately 1.5 million users, functioned as advertised but secretly transmitted entire file contents and user data without consent. The campaign, dubbed 'MaliciousCorgi', exploited the trust developers place in marketplace extensions, leading to significant exposure of proprietary code and sensitive information. This incident underscores the escalating risks associated with supply chain attacks targeting developer tools. The widespread adoption of AI-powered extensions, combined with insufficient vetting processes in extension marketplaces, has created a fertile ground for malicious actors. Organizations must prioritize stringent security assessments of third-party tools to safeguard intellectual property and maintain operational integrity.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports