The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Defense/Space
Breach intelligence, attack campaigns, and threat reports targeting the Defense/Space sector.
Explore Other Sectors
Defense/Space Threat Reports
Russian Hackers Exploit Zimbra Zero-Click Vulnerability (CVE-2025-66376) for Email Theft
In July 2026, the Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, exploited a zero-click vulnerability (CVE-2025-66376) in Zimbra Collaboration Suite's Classic UI to target organizations across various sectors, including defense, government, education, and technology. By embedding malicious JavaScript in specially crafted HTML emails, the attackers executed scripts automatically upon email viewing, enabling the theft of account data without user interaction. This campaign led to unauthorized access to sensitive information, including emails, credentials, and two-factor authentication tokens, significantly compromising organizational security. The incident underscores the critical importance of timely software updates and robust email security measures. Despite the vulnerability being patched in November 2025, many organizations remained unpatched, highlighting a persistent challenge in cybersecurity hygiene. The exploitation of this flaw by a sophisticated threat actor emphasizes the need for continuous vigilance and proactive defense strategies to mitigate emerging cyber threats.
2 months ago
Kill Chain
Russian Espionage Group Exploits Zimbra Zero-Day Vulnerability
In July 2025, the Russian state-sponsored threat group known as Laundry Bear initiated a sophisticated cyber-espionage campaign targeting Western government and commercial organizations. By exploiting a zero-day vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite's webmail client, the attackers deployed a 'view-based exploit' that activated upon merely viewing a malicious email. This allowed them to exfiltrate sensitive data, including recent emails, entire email directories, browser-saved passwords, and two-factor authentication recovery codes. The vulnerability was patched in November 2025, but unpatched systems remain at risk. ([nsa.gov](https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4553352/nsa-and-partners-alert-zimbra-collaboration-suite-users-of-a-russian-state-supp/?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber actors exploiting zero-day vulnerabilities. The use of 'zero-click' exploits, which require no user interaction beyond viewing an email, highlights the evolving sophistication of cyber threats and the critical need for timely patch management and robust cybersecurity measures. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/russian-hackers-zimbra-zero-day-us-ukraine-targets?utm_source=openai))
2 months ago
Kill Chain
Russian Cyberespionage Campaign Exploits Zimbra Vulnerability CVE-2025-66376
In July 2025, a Russian state-sponsored cyberespionage group, identified as CL-STA-1114 (also known as Void Blizzard and LAUNDRY BEAR), initiated a campaign targeting Zimbra webmail users across sectors such as government, defense, transportation, and finance in regions including NATO member states, Ukraine, CIS countries, and Africa. The attackers exploited a zero-click vulnerability in the Zimbra Collaboration Suite (CVE-2025-66376), allowing them to inject malicious JavaScript payloads via specially crafted HTML emails. This exploit enabled the exfiltration of sensitive data, including login credentials, email archives, and search histories, without any user interaction. The continued exploitation of CVE-2025-66376 underscores the critical need for organizations to promptly apply security patches and enhance their email security measures. The sophistication of this attack, particularly its zero-click nature, highlights the evolving tactics of nation-state actors and the importance of proactive defense strategies to protect sensitive information.
2 months ago
Kill Chain
White House Accuses Moonshot AI of Distilling Anthropic's Fable Model
In July 2026, the White House accused Chinese AI company Moonshot AI of illicitly distilling Anthropic's Fable model to develop their own Kimi K3 model. This process involved creating a sophisticated internal platform to conduct large-scale distillation against U.S. models, allowing them to switch between multiple methods of access to avoid detection. The U.S. government expressed concerns over the unauthorized use of proprietary technology and the potential national security implications. ([cyberscoop.com](https://cyberscoop.com/white-house-accuses-moonshot-ai-anthropic-model-distillation/?utm_source=openai)) This incident underscores the escalating tensions in the global AI race, highlighting the challenges in protecting intellectual property and the need for robust cybersecurity measures to prevent unauthorized access and replication of advanced AI models.
2 months ago
Kill Chain
Stadler Rail Rejects $12.3M Ransom After Cyberattack
In mid-July 2026, Swiss rail manufacturer Stadler Rail experienced a cyberattack when the Everest ransomware group accessed a data exchange platform shared with one of its suppliers. The attackers demanded a ransom of 10 million Swiss francs (approximately $12.3 million) after obtaining technical information. Stadler's internal IT systems and production operations remained unaffected, and the company refused to pay the ransom, filing a criminal complaint with the Thurgau cantonal police. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/swiss-rail-giant-stadler-rejects-123m-ransom-demand-after-cyberattack/?utm_source=openai)) This incident underscores the growing threat of supply chain attacks, where cybercriminals exploit vulnerabilities in third-party vendors to infiltrate larger organizations. The Everest group's focus on data theft and extortion, rather than traditional ransomware encryption, highlights the evolving tactics of threat actors in the cybersecurity landscape.
2 months ago
Kill Chain
Critical Vulnerabilities Discovered in Siemens CADRA Software
In July 2026, Siemens disclosed multiple vulnerabilities in its CADRA software, primarily stemming from outdated zlib and Foxit components. These vulnerabilities, including improper input validation and buffer overflows, could allow remote attackers to execute arbitrary code or cause denial-of-service conditions. Siemens has released version V2511 to address these issues and recommends users update promptly. This incident underscores the critical importance of maintaining up-to-date software components to mitigate security risks. Organizations should prioritize regular software updates and vulnerability assessments to protect against potential exploits targeting outdated libraries.
2 months ago
Kill Chain
Siemens RUGGEDCOM APE1808 Vulnerabilities: What You Need to Know
In July 2026, Siemens disclosed multiple vulnerabilities in its RUGGEDCOM APE1808 devices configured with Palo Alto Networks Virtual NGFW. These vulnerabilities include cross-site scripting (CVE-2026-0266), privilege escalation (CVE-2026-0272), and command injection (CVE-2026-0273). Exploitation could allow authenticated administrators to execute arbitrary commands with root privileges, potentially compromising system integrity. Siemens has advised customers to consult Palo Alto Networks' security notifications for workarounds and to contact customer support for patch information. This incident underscores the critical importance of timely vulnerability management in industrial control systems. Organizations should prioritize applying patches and implementing recommended security measures to mitigate risks associated with these vulnerabilities.
2 months ago
Kill Chain
Unveiling North Korea's IT Worker Scheme Funding Russia's Military Operations
In July 2026, DTEX researchers uncovered that North Korea's IT worker scheme is funneling money through a network of front companies and intermediaries, including sanctioned entities, to support Russia's military efforts in Ukraine. The investigation revealed that between December 2025 and February 2026, approximately $1.97 million from North Korean IT workers flowed through Korea Ryonbong General Corp, a sanctioned defense entity procuring weapons for North Korea's military programs. This scheme extends beyond funding North Korea's weapons program, contributing to various regime objectives, including manufacturing weapons supplied to Russia's military. ([cyberscoop.com](https://cyberscoop.com/north-korea-it-worker-scheme-funds-russia-war-ukraine/?utm_source=openai)) This incident highlights the evolving nature of cyber-enabled financial schemes and the increasing collaboration between sanctioned states to circumvent international restrictions. The use of IT worker schemes to fund military operations underscores the need for heightened vigilance and robust compliance measures within the global tech industry.
2 months ago
Kill Chain
HollowGraph Malware: Exploiting Microsoft 365 Calendars for Covert C2 Operations
In June 2026, cybersecurity researchers identified a sophisticated malware component named HollowGraph, which exploits Microsoft 365 calendar events to establish covert command-and-control (C2) channels. By leveraging the Microsoft Graph API, the malware communicates through calendar entries dated May 13, 2050, embedding commands and exfiltrated data within event attachments. This technique allows the malware to blend seamlessly with legitimate network traffic, evading traditional detection mechanisms. The campaign primarily targets Israeli organizations, with evidence suggesting links to the Iranian-nexus threat actor Lyceum. The use of trusted cloud services for C2 communications underscores the evolving tactics of state-sponsored cyber espionage groups. ([thehackernews.com](https://thehackernews.com/2026/07/hollowgraph-malware-hides-c2-and-stolen.html?utm_source=openai)) The discovery of HollowGraph highlights a concerning trend in cyber threats: the abuse of legitimate cloud services to mask malicious activities. As organizations increasingly rely on cloud-based platforms, adversaries are adapting their methods to exploit these trusted environments. This incident serves as a critical reminder for enterprises to enhance monitoring of cloud service activities and implement robust security measures to detect and mitigate such sophisticated threats.
2 months ago
Kill Chain
Russian Hackers Exploit IP Cameras to Monitor NATO Military Logistics
In July 2026, Dutch intelligence agencies AIVD and MIVD disclosed that Russian state-backed hackers systematically compromised internet-connected IP cameras across Europe and Ukraine. By exploiting devices with default passwords and outdated firmware, these actors accessed video feeds to monitor military transport routes and weapons shipments bound for Kyiv. In Ukraine, the compromised cameras were used to identify the locations of Ukrainian military personnel, leading to targeted attacks on troops and equipment. This operation highlights the vulnerability of unsecured IoT devices and their potential exploitation for espionage and military purposes. The incident underscores the critical need for robust cybersecurity measures, especially for devices connected to the internet. Organizations are urged to secure IP cameras by updating firmware, changing default credentials, and restricting public internet access to prevent unauthorized surveillance and data breaches.
2 months ago
Kill Chain
UAC-0145's Use of ClickFix CAPTCHAs: A New Cyber Threat in Ukraine
In July 2026, the Russian state-sponsored hacking group UAC-0145, also known as Sandworm or APT44, launched a campaign targeting Ukrainian organizations. The attackers employed a technique called ClickFix, which involves fake CAPTCHA prompts on compromised websites. These prompts instructed users to execute PowerShell commands, leading to the installation of data-stealing malware such as GHETTOVIBE and SCOUTCURL. The campaign compromised at least ten websites and utilized tools like SMARTAXE to dynamically alter web content, displaying deceptive CAPTCHA checks. Additionally, the attackers distributed malicious Android APK files via messaging apps, deploying the COWARDDUCK backdoor to exfiltrate sensitive information from infected devices. This incident underscores the evolving tactics of state-sponsored threat actors, who are increasingly adopting social engineering techniques traditionally associated with financially motivated cybercriminals. The use of ClickFix by UAC-0145 highlights the need for heightened vigilance and user education to recognize and avoid such deceptive tactics.
2 months ago
Kill Chain
Critical Vulnerability in NASA's cFS Health & Safety Application: CVE-2026-15352
In July 2026, a critical vulnerability (CVE-2026-15352) was identified in NASA's Core Flight System (cFS) Health & Safety (HS) Application. This flaw allows attackers to trigger a segmentation fault by sending a routine Housekeeping Telemetry request, leading to a denial-of-service condition. The vulnerability affects versions of the HS application prior to v7.0.1. NASA has released an update to address this issue and recommends users upgrade to v7.0.1 to mitigate the risk. ([software.nasa.gov](https://software.nasa.gov/software/GSC-18476-1?utm_source=openai)) This incident underscores the importance of timely software updates in mission-critical systems. As space exploration technologies become increasingly reliant on software, ensuring the security and reliability of these systems is paramount to prevent potential disruptions and maintain operational integrity.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports