The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Defense/Space
Breach intelligence, attack campaigns, and threat reports targeting the Defense/Space sector.
Explore Other Sectors
Defense/Space Threat Reports
U.S. Nationals Sentenced for Facilitating North Korean IT Worker Infiltration
Between 2021 and October 2024, U.S. nationals Kejia Wang and Zhenxing Wang facilitated a scheme enabling North Korean IT workers to secure remote positions at over 100 U.S. companies, including Fortune 500 firms. By creating fake websites, shell companies, and hosting company-issued laptops in U.S. residences, they masked the workers' true identities, generating over $5 million for the North Korean government and causing approximately $3 million in damages to the affected companies. ([nationaltoday.com](https://nationaltoday.com/us/ma/boston/news/2026/04/16/two-americans-sentenced-for-helping-north-korea-obtain-remote-it-jobs/?utm_source=openai)) This incident underscores the evolving tactics of nation-state actors exploiting remote work infrastructures to infiltrate organizations, emphasizing the need for robust identity verification and cybersecurity measures to protect against such sophisticated schemes.
5 months ago
Kill Chain
AgingFly Malware: A New Threat to Critical Infrastructure
In March 2026, a sophisticated cyberattack targeted Ukrainian local governments and hospitals, deploying a new malware family named 'AgingFly.' The attack began with phishing emails offering humanitarian aid, leading recipients to compromised or fake websites. These sites delivered malicious files that, once executed, initiated a multi-stage infection process. The final payload, AgingFly, enabled attackers to steal authentication data from Chromium-based browsers and the WhatsApp messenger, and provided remote control capabilities over infected systems. CERT-UA attributed these attacks to the threat actor group UAC-0247. This incident underscores the evolving tactics of cyber adversaries, including the use of AI-generated content and advanced multi-stage malware delivery mechanisms. Organizations, especially those in critical sectors, must remain vigilant against such sophisticated social engineering attacks and enhance their cybersecurity defenses accordingly.
5 months ago
Kill Chain
Critical Vulnerability in wolfSSL: CVE-2026-5194 Allows ECDSA Certificate Authentication Bypass
In April 2026, a critical vulnerability identified as CVE-2026-5194 was discovered in the wolfSSL library, a widely used SSL/TLS implementation designed for embedded systems and IoT devices. This flaw arises from missing hash/digest size and Object Identifier (OID) checks during the verification of ECDSA certificates, allowing the acceptance of improperly small digests. Consequently, attackers could exploit this weakness to bypass ECDSA certificate-based authentication, potentially leading to unauthorized access and man-in-the-middle attacks. The issue affects configurations where both ECC and EdDSA or ML-DSA are enabled. wolfSSL addressed this vulnerability in version 5.9.1, released on April 8, 2026. The discovery of CVE-2026-5194 underscores the critical importance of rigorous certificate validation processes in cryptographic libraries. As wolfSSL is utilized in over 5 billion devices across various sectors, including industrial control systems, automotive, and aerospace, the potential impact of this vulnerability is extensive. Organizations relying on wolfSSL are urged to promptly update to the patched version to mitigate security risks.
5 months ago
Kill Chain
APT37's Facebook Social Engineering Tactics Unveiled
In April 2026, the North Korean state-sponsored hacking group APT37 (also known as ScarCruft) initiated a sophisticated social engineering campaign targeting individuals via Facebook. The attackers created fake profiles to befriend targets, eventually moving conversations to Facebook Messenger. They persuaded victims to install a tampered version of Wondershare PDFelement, claiming it was necessary to view encrypted military documents. This malicious software executed embedded shellcode upon launch, establishing a foothold for the attackers. The campaign utilized compromised infrastructure for command-and-control operations, leveraging a legitimate Japanese real estate website to issue malicious commands. Ultimately, the malware was disguised as a harmless JPG image, enabling extensive remote access capabilities while evading detection by security software. This incident underscores the evolving tactics of APT37, highlighting their ability to exploit social media platforms for initial access and their use of legitimate software and infrastructure to evade detection. The campaign's success emphasizes the need for heightened awareness and robust security measures against social engineering attacks, especially those leveraging trusted platforms and applications.
5 months ago
Kill Chain
APT28's PRISMEX Malware Campaign: A Threat to Global Security
In early 2026, the Russian state-sponsored group APT28, also known as Fancy Bear, launched a sophisticated cyber-espionage campaign targeting Ukraine and its NATO allies. The operation, active since at least September 2025 and intensifying in January 2026, involved the deployment of a modular malware suite named PRISMEX. This suite utilized advanced steganography, Component Object Model (COM) hijacking, and exploited newly disclosed vulnerabilities, including CVE-2026-21509 and CVE-2026-21513, to infiltrate defense supply chains and critical infrastructure sectors. The campaign's strategic focus on supply chains and operational planning capabilities underscores a shift toward operational disruption, potentially paving the way for more destructive activities. ([thehackernews.com](https://thehackernews.com/2026/04/apt28-deploys-prismex-malware-in.html?utm_source=openai)) The PRISMEX campaign highlights the persistent and evolving threat posed by APT28, emphasizing the necessity for organizations to adopt proactive cybersecurity measures. The rapid weaponization of vulnerabilities and the use of sophisticated techniques like steganography and cloud service abuse demonstrate the group's advanced capabilities. This incident serves as a critical reminder for entities within targeted sectors to enhance their security postures and remain vigilant against such advanced persistent threats. ([thehackernews.com](https://thehackernews.com/2026/04/apt28-deploys-prismex-malware-in.html?utm_source=openai))
5 months ago
Kill Chain
Iran-Linked Hackers Target U.S. Critical Infrastructure in 2026
In early April 2026, Iran-affiliated cyber actors targeted internet-facing operational technology (OT) devices across U.S. critical infrastructure sectors, including programmable logic controllers (PLCs) manufactured by Rockwell Automation. These attacks led to diminished PLC functionality, manipulation of display data, and, in some cases, operational disruption and financial loss. The Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI and NSA, issued warnings about these threats, emphasizing the need for immediate action to secure vulnerable OT assets. ([nextgov.com](https://www.nextgov.com/cybersecurity/2026/04/pro-iran-hackers-are-targeting-us-industrial-control-systems-advisory-says/412679/?utm_source=openai)) This incident underscores the escalating cyber threats from nation-state actors targeting critical infrastructure. The exploitation of internet-exposed PLCs highlights the urgent need for organizations to implement robust cybersecurity measures, including network segmentation, regular software updates, and the use of strong, unique passwords to protect against such sophisticated attacks.
5 months ago
Kill Chain
APT28's PRISMEX Malware Campaign: A 2026 Cyber-Espionage Threat
In early 2026, the Russian state-sponsored group APT28 (also known as Fancy Bear and Pawn Storm) initiated a sophisticated cyber-espionage campaign targeting Ukraine and its NATO allies. The operation employed a newly developed malware suite named PRISMEX, which utilizes advanced steganography, Component Object Model (COM) hijacking, and the exploitation of legitimate cloud services for command-and-control (C2) communications. The campaign began in September 2025 and intensified in January 2026, focusing on sectors such as defense, emergency services, and logistics across multiple countries, including Poland, Romania, Slovenia, Turkey, Slovakia, and the Czech Republic. ([thehackernews.com](https://thehackernews.com/2026/04/apt28-deploys-prismex-malware-in.html?utm_source=openai)) This campaign underscores the rapid weaponization of newly disclosed vulnerabilities by APT28, notably CVE-2026-21509 and CVE-2026-21513, to infiltrate target systems. The use of PRISMEX highlights a strategic shift towards more covert and resilient attack methodologies, posing significant challenges for detection and mitigation. ([thehackernews.com](https://thehackernews.com/2026/04/apt28-deploys-prismex-malware-in.html?utm_source=openai))
5 months ago
Kill Chain
Iran-Linked Password-Spraying Campaign Targets 300+ Israeli Microsoft 365 Organizations
In March 2026, an Iran-linked threat actor executed a coordinated password-spraying campaign targeting Microsoft 365 environments across Israel and the United Arab Emirates. The attacks occurred in three waves on March 3, 13, and 23, affecting over 300 organizations in Israel and more than 25 in the UAE. Primary targets included municipalities, technology firms, transportation, and healthcare sectors. Attackers utilized rotating Tor exit nodes for scanning and employed VPN services geolocated within Israel to bypass geo-fencing restrictions. Once valid credentials were obtained, they accessed and exfiltrated sensitive data, including personal emails. ([thehackernews.com](https://thehackernews.com/2026/04/iran-linked-password-spraying-campaign.html?utm_source=openai)) This incident underscores the escalating cyber threats in the Middle East, particularly those linked to nation-state actors. The use of password-spraying techniques highlights the critical need for robust authentication measures and vigilant monitoring to detect and mitigate unauthorized access attempts.
5 months ago
Kill Chain
North Korean Hackers Leverage GitHub for Command-and-Control in South Korean Cyberattacks
In April 2026, cybersecurity researchers identified a sophisticated cyberattack campaign attributed to North Korean state-sponsored actors targeting organizations in South Korea. The attackers employed obfuscated Windows shortcut (LNK) files distributed via phishing emails to initiate the infection chain. Upon execution, these LNK files deployed decoy PDF documents to distract victims while simultaneously executing malicious PowerShell scripts in the background. These scripts performed environment checks to evade analysis tools and established persistence through scheduled tasks. Notably, the attackers utilized GitHub as command-and-control (C2) infrastructure, exfiltrating system information and retrieving additional payloads from private repositories, thereby blending malicious traffic with legitimate network activity. ([thehackernews.com](https://thehackernews.com/2026/04/dprk-linked-hackers-use-github-as-c2-in.html?utm_source=openai)) This incident underscores a growing trend among threat actors to exploit trusted platforms like GitHub for C2 operations, enhancing their ability to evade detection. The use of native Windows tools and legitimate services in these attacks highlights the necessity for organizations to implement robust monitoring and anomaly detection systems to identify and mitigate such sophisticated threats.
5 months ago
Kill Chain
CoBRA: Revolutionizing Malware Analysis by Simplifying MBA Obfuscation
On April 3, 2026, Trail of Bits released CoBRA, an open-source tool designed to simplify Mixed Boolean-Arithmetic (MBA) obfuscation. MBA obfuscation, commonly used by malware authors and software protectors, disguises simple operations behind complex arithmetic and bitwise expressions, making analysis challenging. CoBRA effectively simplifies 99.86% of over 73,000 tested expressions, providing security professionals with a powerful resource for deobfuscating code and enhancing malware analysis. The release of CoBRA addresses a significant challenge in cybersecurity, as MBA obfuscation has been a persistent hurdle in malware analysis. By automating the simplification process, CoBRA enables faster and more accurate analysis of obfuscated code, thereby improving threat detection and response capabilities.
5 months ago
Kill Chain
Coruna iPhone Hacking Toolkit Leak: A Wake-Up Call for Cybersecurity
In early 2026, security researchers uncovered 'Coruna,' a sophisticated iPhone hacking toolkit comprising 23 exploits across five attack chains, targeting iOS versions 13.0 through 17.2.1. Initially developed by U.S. defense contractor L3Harris's division Trenchant, Coruna was intended for government use. However, it leaked and was subsequently utilized by Russian espionage groups and Chinese cybercriminals, leading to widespread data theft and compromising tens of thousands of devices. ([techcrunch.com](https://techcrunch.com/2026/03/09/an-iphone-hacking-toolkit-used-by-russian-spies-likely-came-from-u-s-military-contractor/?utm_source=openai)) The Coruna incident underscores the risks associated with the proliferation of advanced cyber tools beyond their original intent. It highlights the urgent need for robust security measures and timely software updates to protect against such sophisticated threats. ([techcrunch.com](https://techcrunch.com/2026/03/26/a-major-hacking-tool-has-leaked-online-putting-millions-of-iphones-at-risk-heres-what-you-need-to-know/?utm_source=openai))
5 months ago
Kill Chain
Operation TrueChaos: Exploiting Trust in Software Updates
In early 2026, a sophisticated cyber espionage campaign, dubbed 'Operation TrueChaos,' exploited a zero-day vulnerability (CVE-2026-3502) in the TrueConf video conferencing software. This flaw allowed attackers to manipulate the software's update mechanism, distributing malicious updates to all connected clients without proper integrity checks. The campaign primarily targeted government entities in Southeast Asia, enabling the execution of arbitrary code across multiple agencies simultaneously. The attackers leveraged this vulnerability to deploy the Havoc command-and-control framework, facilitating reconnaissance, privilege escalation, and persistent access within the compromised networks. The operation is attributed with moderate confidence to a Chinese-nexus threat actor, based on observed tactics, techniques, and infrastructure choices. This incident underscores the critical need for organizations to implement robust validation mechanisms for software updates and to monitor internal systems for signs of compromise, even within trusted environments. The exploitation of trusted update mechanisms highlights a growing trend where attackers target internal trust relationships to achieve widespread access and control.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports