The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Defense/Space
Breach intelligence, attack campaigns, and threat reports targeting the Defense/Space sector.
Explore Other Sectors
Defense/Space Threat Reports
Union County's $1 Million Data Extortion: A Wake-Up Call for Cybersecurity
In June 2025, a U.S. government entity, identified through leaked negotiation chats as Union County, Ohio, fell victim to a data-theft extortion by a group named Kairos. Unlike traditional ransomware attacks that encrypt data, Kairos exfiltrated over 2 terabytes of sensitive information, including files from the prosecutor's office, and threatened to release them publicly. After a month-long negotiation, the county paid approximately $1 million in Bitcoin to prevent the data's exposure. ([thehackernews.com](https://thehackernews.com/2026/07/us-government-entity-paid-kairos-group.html?utm_source=openai)) This incident underscores a growing trend where cybercriminals bypass encryption and directly leverage stolen data for extortion. Organizations must recognize that data exfiltration alone can serve as a potent extortion tool, emphasizing the need for robust data protection and incident response strategies.
2 months ago
Kill Chain
Critical Vulnerabilities in FatFs Expose Millions of Embedded Devices
In July 2026, security firm runZero disclosed seven vulnerabilities in FatFs, a widely used filesystem library for FAT and exFAT formats. These flaws, present in devices like security cameras, drones, and industrial controllers, allow attackers to exploit crafted storage media to corrupt memory and execute arbitrary code. The vulnerabilities, rated Medium to High severity, include issues like integer overflows and buffer overflows, leading to potential device crashes or unauthorized code execution. Notably, CVE-2026-6682 involves an integer overflow during FAT32 volume mounting, which can result in memory corruption and code execution. ([thehackernews.com](https://thehackernews.com/2026/07/unpatched-flaws-disclosed-in-filesystem.html?utm_source=openai)) The widespread use of FatFs in embedded systems, combined with the lack of upstream fixes and the absence of a responsive maintainer, poses significant security risks. Devices relying on FatFs remain vulnerable, and the exploitation of these flaws could lead to persistent operational denial of service or device bricking. Organizations must assess their exposure and implement mitigations to protect against potential attacks. ([thehackernews.com](https://thehackernews.com/2026/07/unpatched-flaws-disclosed-in-filesystem.html?utm_source=openai))
2 months ago
Kill Chain
Critical Vulnerabilities Discovered in ST Engineering iDirect iQ-Series Terminals
In July 2026, vulnerabilities were identified in ST Engineering iDirect's iQ-Series Terminals, specifically CVE-2026-38059 and CVE-2026-38057. These flaws allowed unauthenticated attackers to access sensitive device information and execute unauthorized device reboots, potentially leading to denial-of-service conditions. The affected products included Evolution iQ-Series terminals, 3315-Series terminals, and 9-Series terminals, all running firmware versions up to 4.5.2.1. The discovery of these vulnerabilities underscores the critical importance of securing networked devices in sectors such as Communications, Defense Industrial Base, Energy, Government Services, and Transportation Systems. Organizations are urged to update their devices to firmware version 4.5.2.2 or newer and implement recommended security practices to mitigate potential exploitation.
2 months ago
Kill Chain
Critical Vulnerability in CubeSpace CW0057 Reaction Wheel Firmware
In July 2026, CubeSpace disclosed a vulnerability (CVE-2026-13743) in its CW0057 Reaction Wheel firmware versions prior to 5.0.20. This flaw allows attackers with physical access to upload malicious firmware without authentication, potentially compromising satellite operations. The issue stems from the device's reliance on CRC-32 integrity checks, which verify data integrity but not the authenticity of the firmware source. CubeSpace has released firmware version 5.0.20, introducing cryptographically verified secure boot, though this feature is not enabled by default and requires user activation. This incident underscores the critical importance of robust firmware authentication mechanisms in aerospace components. As satellites become increasingly integral to global communications and defense, ensuring the integrity of onboard systems is paramount. Organizations must proactively implement and enable security features to mitigate risks associated with unauthorized firmware modifications.
2 months ago
Kill Chain
China-Linked Group Targets Southeast Asia Critical Systems
In mid-2025, the Chinese-speaking advanced persistent threat (APT) group CL-STA-1062 initiated a cyber espionage campaign targeting government entities and critical infrastructure in Southeast Asia. The group compromised at least 10 organizations, including state-owned enterprises in the energy and government sectors, deploying a custom backdoor named TinyRCT. This backdoor facilitated unauthorized access, data exfiltration, and system control, posing significant risks to national security and operational stability. ([thehackernews.com](https://thehackernews.com/2026/06/chinese-speaking-apt-deploys-new.html?utm_source=openai)) The emergence of TinyRCT underscores the evolving sophistication of state-sponsored cyber threats in the region. Organizations must enhance their cybersecurity measures to detect and mitigate such advanced persistent threats, ensuring the resilience of critical infrastructure against future attacks. ([thehackernews.com](https://thehackernews.com/2026/06/chinese-speaking-apt-deploys-new.html?utm_source=openai))
2 months ago
Kill Chain
U.S. Offers $10 Million Reward for Information on Russian Hackers Targeting Encrypted Messaging Apps
In June 2026, the U.S. Department of State announced a reward of up to $10 million for information leading to the identification or location of members of the Russian-linked cyber groups UNC5792 and UNC4221. These groups have been implicated in extensive phishing campaigns targeting Signal and WhatsApp accounts of U.S. government officials, military leaders, and allied personnel. The attackers employed social engineering tactics, impersonating support agents to deceive users into revealing their backup recovery keys, thereby gaining access to their encrypted communications. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/us-offers-10-million-for-hackers-targeting-whatsapp-signal-users/?utm_source=openai)) This incident underscores the evolving nature of cyber threats, particularly the sophisticated use of social engineering to bypass encryption safeguards. It highlights the critical need for heightened vigilance and robust security protocols to protect sensitive communications, especially for individuals in positions of authority or influence.
2 months ago
Kill Chain
Gamaredon's 2025 Cyber Offensive: Unveiling New Malware and Tactics
In 2025, the Russian-aligned APT group Gamaredon intensified its cyber operations against Ukrainian governmental and military institutions. ESET observed 35 distinct spear-phishing campaigns, primarily in the latter half of the year, utilizing archive attachments and XHTML files with HTML smuggling to deploy malicious HTA downloaders. These campaigns aimed to exfiltrate sensitive information to support Russian interests in the ongoing conflict. Gamaredon also exploited a WinRAR vulnerability (CVE-2025-8088) to achieve persistence by placing malicious files in the Windows Startup folder. Additionally, the group introduced six new PowerShell tools, including PteroDee and PteroCache, to enhance their malware arsenal. ([thehackernews.com](https://thehackernews.com/2026/06/gamaredon-expands-ukraine-attacks-with.html?utm_source=openai)) The group's reliance on third-party services grew significantly, employing tunnel services and serverless platforms to conceal their infrastructure. This evolution underscores the increasing sophistication of state-sponsored cyber threats and the necessity for robust cybersecurity measures to protect sensitive governmental data. ([thehackernews.com](https://thehackernews.com/2026/06/gamaredon-expands-ukraine-attacks-with.html?utm_source=openai))
2 months ago
Kill Chain
FBI Issues Alert on Russian Hackers Targeting Signal Backup Recovery Keys
In June 2026, the FBI and CISA issued a warning about a sophisticated phishing campaign by Russian intelligence services targeting Signal users. The attackers impersonated Signal support teams, sending messages that prompted users to enable backups and share their 64-character recovery keys. With these keys, the attackers could decrypt victims' entire message histories, compromising sensitive communications. The campaign primarily targeted individuals of high intelligence value, including government officials, military personnel, political figures, journalists, and key officials in Ukraine. This incident underscores the evolving tactics of state-sponsored cyber actors and highlights the critical importance of user vigilance against social engineering attacks. The exploitation of backup recovery keys represents a significant escalation in phishing techniques, emphasizing the need for robust security practices and user education to prevent unauthorized access to encrypted communications.
3 months ago
Kill Chain
FBI Issues Warning on Russian Hackers Exploiting Signal Backup Recovery Keys
In June 2026, the FBI and CISA issued an updated warning regarding Russian intelligence phishing campaigns targeting Signal users. Attackers impersonated Signal support, sending messages that prompted users to share their Backup Recovery Keys under the guise of preventing data loss. Once obtained, these keys allowed attackers to restore backups, access private messages, and take over accounts. The campaign primarily targeted individuals of high intelligence value, including government officials, military personnel, political figures, journalists, and Ukrainian officials. This incident underscores the evolving tactics of nation-state actors in exploiting legitimate features of secure messaging apps through social engineering. The focus on high-profile individuals highlights the strategic nature of the campaign, emphasizing the need for heightened vigilance and robust security practices among potential targets.
3 months ago
Kill Chain
Turla's STOCKSTAY Backdoor: A New Cyber Espionage Threat
In June 2026, Google's Threat Intelligence Group identified a new .NET backdoor named STOCKSTAY, attributed to the Russian state-sponsored group Turla. This malware has been deployed against government and military organizations in Ukraine and entities interested in Italian foreign policy. STOCKSTAY, developed since at least December 2022, shares significant code and functional overlaps with Turla's previous implant, Kazuar. The backdoor comprises multiple components that communicate via inter-process communication channels and utilize secure WebSocket connections for command-and-control communication. It supports various commands, including file manipulation, system information gathering, and screen capture. ([cloud.google.com](https://cloud.google.com/blog/topics/threat-intelligence/stockstay-turla-intelligence-gathering/?utm_source=openai)) The discovery of STOCKSTAY underscores the evolving sophistication of state-sponsored cyber espionage tools. Its deployment highlights the persistent threat posed by advanced persistent threats (APTs) like Turla, emphasizing the need for robust cybersecurity measures and continuous monitoring to protect sensitive governmental and military information.
3 months ago
Kill Chain
Gamaredon's 2025 Cyberespionage Tactics: A Deep Dive
In 2025, the Russian-aligned APT group Gamaredon intensified its cyberespionage operations against Ukrainian governmental and military institutions. The group executed 35 distinct spearphishing campaigns, primarily in the latter half of the year, utilizing new PowerShell tools and resurrecting older VBScript weaponizers. Gamaredon also enhanced its data exfiltration methods by upgrading file stealers to support cloud storage services like Wasabi, Tebi, and Intercolo. To conceal its command and control infrastructure, the group increasingly relied on legitimate third-party services, including tunnels, workers, dynamic DNS, and platform-as-a-service offerings. Additionally, Gamaredon exploited various messaging, social media, blogging, and paste services as dead drops for distributing payloads and resolving C&C servers. This evolution in tactics underscores the group's adaptability and the persistent cyber threat it poses to Ukrainian institutions.
3 months ago
Kill Chain
FortiBleed: Massive Credential Exposure in Fortinet Firewalls
In June 2026, the 'FortiBleed' campaign emerged as a significant cybersecurity threat, compromising over 86,000 Fortinet FortiGate firewalls across 194 countries. Attackers utilized a Golang-based tool, FortigateSniffer, to exploit default credentials and weak password practices, turning these devices into passive credential collectors across 24 authentication protocols. This led to the exposure of approximately 110 million credentials, affecting major corporations and government agencies worldwide. The incident underscores the critical importance of robust password policies and the implementation of multi-factor authentication (MFA). Organizations are urged to review and enhance their security measures to prevent similar breaches, as reliance on default credentials and inadequate password management continue to be exploited by threat actors.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports