Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

International Affairs

Breach intelligence, attack campaigns, and threat reports targeting the International Affairs sector.

48 threat reports
Page 1 of 4
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

International Affairs Threat Reports

Showing 1–12 / 48 reports
BlackX UEFI Bootkit: How APT41 Exploits a 'Patched' Windows Flaw to Own Diplomatic Networks
BlackX UEFI Bootkit: How APT41 Exploits a 'Patched' Windows Flaw to Own Diplomatic Networks
Government Administration2 weeks ago

BlackX UEFI Bootkit: How APT41 Exploits a 'Patched' Windows Flaw to Own Diplomatic Networks

In early 2026, APT41-affiliated threat actors deployed a sophisticated UEFI bootkit dubbed BlackX against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. Derived from the notorious BlackLotus bootkit, BlackX exploits CVE-2022-21894 (Baton Drop) to bypass Secure Boot on fully patched Windows systems where administrators failed to apply mandatory manual revocation steps—specifically blocklisting the 'Windows Production PCA 2011' certificate in the UEFI DBX. After gaining administrator privileges through an undisclosed initial access vector, attackers installed a kernel-level driver, a RAT using Google Drive and OneDrive for C2, and the OxiDLLRunner DLL sideloader, achieving persistent, covert espionage access across high-value government networks. This incident underscores a growing APT trend of repurposing commercial crimeware tooling—bridging cybercrime and state-sponsored espionage—to maintain firmware-level persistence that survives OS reinstalls and endpoint detection. As UEFI-based implants proliferate among nation-state actors, organizations face pressure to close patch-management gaps that go beyond standard Windows Update cycles and require manual firmware-layer hardening.

Medium impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
APT41's BlackX Bootkit: How a Cybercriminal Tool Became a Nation-State Weapon Against Diplomats
Government Administration2 weeks ago

APT41's BlackX Bootkit: How a Cybercriminal Tool Became a Nation-State Weapon Against Diplomats

In early 2026, Kaspersky GReAT uncovered a sophisticated APT campaign attributed with medium confidence to APT41 (FishMonger), targeting diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. The attackers deployed a UEFI bootkit dubbed BlackX—a reverse-engineered or purchased derivative of the BlackLotus bootkit—exploiting the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot on fully patched machines. Post-exploitation payloads included a cloud-storage-based RAT communicating over Google Drive, OneDrive, and Yandex.Disk, and a Rust-based implant (OxiDLLRunner) for plugin-based command execution, enabling persistent kernel-level espionage against high-value diplomatic targets. This incident highlights a dangerous patch-activation gap: Microsoft's CVE-2022-21894 fix requires manual registry and scheduled-task steps most administrators never take. As APT groups increasingly borrow cybercriminal tooling and exploit dormant patch gaps, organizations running unactivated UEFI mitigations across hybrid and cloud-connected endpoints face heightened espionage risk in 2026 and beyond.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
TAG-193 Silent Lynx Espionage Campaign: How Zero Trust Could Have Protected Central Asian Governments
TAG-193 Silent Lynx Espionage Campaign: How Zero Trust Could Have Protected Central Asian Governments
Government Administration3 weeks ago

TAG-193 Silent Lynx Espionage Campaign: How Zero Trust Could Have Protected Central Asian Governments

TAG-193, also known as Silent Lynx and tracked as UAT-6275, conducted sustained cyber-espionage operations targeting government organizations across Central Asia and the Commonwealth of Independent States throughout 2024. The threat actor focused on diplomatic institutions, economic development agencies, and environmental policy organizations, leveraging evolving malware delivery techniques and expanded toolkits. The campaign demonstrated particular interest in water resources, forestry management, and regional infrastructure information with potential strategic value for negotiations and economic planning. Research by Cisco Talos and Recorded Future's Insikt Group revealed possible links to Kazakhstan, though the group's exact origins remain unclear. This incident highlights the growing trend of nation-state actors targeting regional governance and resource management data as geopolitical tensions increase around critical infrastructure and environmental policies in Central Asia.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
North Korean Kimsuky APT Targets Ukraine with Sophisticated Phishing Campaign
North Korean Kimsuky APT Targets Ukraine with Sophisticated Phishing Campaign
Government Administration3 weeks ago

North Korean Kimsuky APT Targets Ukraine with Sophisticated Phishing Campaign

North Korean state-sponsored hackers, primarily the Kimsuky APT group (also tracked as TA406, Konni, or Opal Sleet), have been conducting sophisticated spear-phishing campaigns against Ukrainian government agencies, policy experts, and academic institutions since February 2025. The attacks employ reply-baiting tactics, impersonating legitimate conference organizers and offering speaking opportunities to build rapport before delivering malicious LNK files disguised as PDFs. The campaign aims to gather intelligence on the Russia-Ukraine war, including North Korean military casualties, prisoner handling procedures, and the status of two North Korean soldiers transferred to South Korea. This espionage operation reflects the evolving threat landscape where nation-state actors are increasingly targeting geopolitical intelligence through cyber means. The campaign demonstrates how traditional phishing techniques remain effective when combined with social engineering and current events exploitation, highlighting the need for enhanced email security and user awareness training in high-value target organizations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
China-Nexus UAT-11587 Weaponizes Microsoft 365 in Multi-Nation Government Espionage Campaign
China-Nexus UAT-11587 Weaponizes Microsoft 365 in Multi-Nation Government Espionage Campaign
Government Administration1 month ago

China-Nexus UAT-11587 Weaponizes Microsoft 365 in Multi-Nation Government Espionage Campaign

Government and policy organizations across eight Asian countries including Taiwan, India, Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria became targets of a sophisticated China-nexus espionage campaign orchestrated by threat actor UAT-11587 between September 2025 and June 2026. The attackers deployed a previously undocumented Rust-compiled backdoor called Antino, which uniquely leverages Microsoft 365 services including Outlook and OneDrive as command-and-control infrastructure instead of traditional C2 servers. The campaign utilized highly targeted spear-phishing emails with spoofed sender identities and fake Gmail attachment widgets to deliver multi-stage payloads, ultimately enabling host reconnaissance, shell execution, file transfer, and persistent access to compromised government systems. This incident demonstrates the evolving sophistication of nation-state actors who are increasingly abusing legitimate cloud services to blend malicious traffic with normal business communications, making detection significantly more challenging for traditional security controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Serbian Government Spyware Campaign Threatens EU Accession Amid Surveillance Scandal
Serbian Government Spyware Campaign Threatens EU Accession Amid Surveillance Scandal
Government Administration2 months ago

Serbian Government Spyware Campaign Threatens EU Accession Amid Surveillance Scandal

In 2024, Serbian government authorities conducted systematic surveillance operations against student activists and political opposition using Pegasus and NoviSpy spyware. The SHARE Foundation, in collaboration with Amnesty International and The Citizen Lab, discovered infections on activists' phones, with evidence linking NoviSpy deployments directly to Serbian state authorities. The campaign targeted individuals ahead of elections, representing a coordinated effort to suppress political dissent through digital surveillance. This surveillance operation has prompted 29 European Parliament members to demand delays in Serbia's EU accession process until a full investigation is completed and rule-of-law accountability is established. This incident exemplifies the growing trend of nation-state actors weaponizing commercial spyware against civil society, particularly in countries seeking international legitimacy while simultaneously suppressing domestic opposition through sophisticated surveillance technologies.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
APT28 Deploys New HOOKEDGE Backdoor Against European Diplomatic Targets
Government Administration2 months ago

APT28 Deploys New HOOKEDGE Backdoor Against European Diplomatic Targets

Between September 2025 and April 2026, Russian state-sponsored threat actor APT28 (Fancy Bear) conducted cyber espionage campaigns against government and diplomatic organizations in Romania, Spain, and Turkey using a previously undocumented backdoor called HOOKEDGE. The lightweight Windows batch script was delivered through macro-enabled Microsoft Word documents with diplomatic-themed lures, representing an evolution of APT28's HEADLACE backdoor with improved evasion capabilities and webhook-based command-and-control infrastructure. This incident highlights the persistent targeting of European diplomatic entities by Russian APT groups amid ongoing geopolitical tensions, demonstrating how threat actors continuously refine lightweight tooling to maintain access while adapting to defensive countermeasures and infrastructure limitations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
BlueDelta's HOOKEDGE Campaign: How Russian APT28 Evolved Diplomatic Espionage Tactics
Defense/Space2 months ago

BlueDelta's HOOKEDGE Campaign: How Russian APT28 Evolved Diplomatic Espionage Tactics

Between September 2025 and April 2026, Russian state-sponsored threat group BlueDelta (APT28, Fancy Bear) conducted sophisticated espionage campaigns targeting government and diplomatic organizations in Romania, Spain, and Turkey. The group deployed HOOKEDGE, a lightweight batch-script backdoor delivered through macro-enabled Microsoft Word documents using diplomatic-themed lures, including materials impersonating Spain's Ministry of the Presidency. HOOKEDGE represents an evolution of BlueDelta's earlier HEADLACE malware, utilizing legitimate webhook services for command-and-control operations to blend malicious traffic with normal network activity while targeting European diplomatic entities for intelligence collection. This campaign demonstrates the continuing evolution of state-sponsored espionage tactics, particularly the refinement of lightweight malware tools that can evade detection while maintaining operational effectiveness. As geopolitical tensions escalate and diplomatic intelligence becomes increasingly valuable, threat actors are adapting their methods to exploit legitimate cloud services and social engineering techniques.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Russian APTs Exploit Messaging App Trust to Compromise EU Government Officials
Government Administration2 months ago

Russian APTs Exploit Messaging App Trust to Compromise EU Government Officials

In 2026, Russian state-sponsored threat actors conducted a sophisticated spear-phishing campaign targeting high-ranking EU government officials through encrypted messaging applications like WhatsApp and Signal. The attackers impersonated platform support teams and used QR code social engineering tactics to compromise accounts, successfully breaching officials including German Bundestag President Julia Klöeckner. Eight significant incidents were documented across EU governments, exposing the vulnerability of consumer messaging platforms used for official communications and prompting several nations to develop sovereign messaging solutions. This incident highlights the critical shift in nation-state attack vectors as threat actors exploit the inherent trust users place in encrypted messaging platforms, moving beyond traditional email-based phishing to leverage communication channels with less security oversight and monitoring capabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
South Korea's Diplomatic Academy Data Breach: A 10-Month Undetected Cyberattack
Government Administration3 months ago

South Korea's Diplomatic Academy Data Breach: A 10-Month Undetected Cyberattack

In April 2025, an unidentified threat actor exploited a zero-day vulnerability in the Korea National Diplomatic Academy's online education system, maintaining unauthorized access until February 2026. This breach exposed personal information—including names, user IDs, email addresses, and encrypted passwords—of approximately 10,000 individuals associated with South Korea's Ministry of Foreign Affairs, including current and former diplomats. The compromised system, established in 2022 for remote training during the COVID-19 pandemic, was taken offline in February 2026 upon detection of the intrusion. This incident underscores the escalating sophistication of cyberattacks targeting governmental institutions and the critical need for robust cybersecurity measures. The prolonged undetected access highlights vulnerabilities in monitoring and threat detection systems, emphasizing the importance of regular security audits and timely patch management to mitigate potential breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
GoSerpent Malware: A Persistent Threat to Southeast Asian Governments
Government Administration3 months ago

GoSerpent Malware: A Persistent Threat to Southeast Asian Governments

In late 2025, cybersecurity researchers identified a new malware strain named GoSerpent, actively targeting government and diplomatic entities in Southeast Asia. Discovered by Kaspersky in February 2026, GoSerpent is designed to establish long-term access for intelligence gathering by connecting to external servers and deploying secondary payloads for data collection and credential dumping. The malware's capabilities include setting up SOCKS5 proxy servers, enabling attackers to route traffic through compromised hosts and mask their true IP addresses. Additional tools such as ThumbcacheService for file collection and Mimikatz for credential extraction have been employed to facilitate data exfiltration through network shared drives. ([thehackernews.com](https://thehackernews.com/2026/07/new-goserpent-malware-targets-southeast.html?utm_source=openai)) The resurgence of GoSerpent in May 2026, with evolved tools like the Stowaway RAT and enhanced data exfiltration methods, underscores the persistent and adaptive nature of cyber threats targeting sensitive government information. This incident highlights the critical need for robust cybersecurity measures and continuous monitoring to detect and mitigate sophisticated espionage campaigns. ([thehackernews.com](https://thehackernews.com/2026/07/new-goserpent-malware-targets-southeast.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
GoSerpent Backdoor: A Persistent Threat to Southeast Asian Governments
Government Administration3 months ago

GoSerpent Backdoor: A Persistent Threat to Southeast Asian Governments

The GoSerpent campaign is a sophisticated, multi-stage attack targeting government and diplomatic entities in Southeast Asia since at least 2021, with evolved variants deployed through 2026. The Go-based GoSerpent backdoor establishes persistent access and deploys ThumbcacheService for document collection, Mimikatz and QuarksDumpLocalHash for credential dumping, and later stages use Stowaway RAT and TmcLoader/TmcPayload to exfiltrate collected data via network shares using stolen credentials. The tight integration between collection, credential theft, and exfiltration components demonstrates advanced operational planning and long-term intelligence gathering objectives.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports