✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
International Affairs
Breach intelligence, attack campaigns, and threat reports targeting the International Affairs sector.
Explore Other Sectors
International Affairs Threat Reports
GoSerpent Malware: A Persistent Threat to Southeast Asian Governments
In late 2025, cybersecurity researchers identified a new malware strain named GoSerpent, actively targeting government and diplomatic entities in Southeast Asia. Discovered by Kaspersky in February 2026, GoSerpent is designed to establish long-term access for intelligence gathering by connecting to external servers and deploying secondary payloads for data collection and credential dumping. The malware's capabilities include setting up SOCKS5 proxy servers, enabling attackers to route traffic through compromised hosts and mask their true IP addresses. Additional tools such as ThumbcacheService for file collection and Mimikatz for credential extraction have been employed to facilitate data exfiltration through network shared drives. ([thehackernews.com](https://thehackernews.com/2026/07/new-goserpent-malware-targets-southeast.html?utm_source=openai)) The resurgence of GoSerpent in May 2026, with evolved tools like the Stowaway RAT and enhanced data exfiltration methods, underscores the persistent and adaptive nature of cyber threats targeting sensitive government information. This incident highlights the critical need for robust cybersecurity measures and continuous monitoring to detect and mitigate sophisticated espionage campaigns. ([thehackernews.com](https://thehackernews.com/2026/07/new-goserpent-malware-targets-southeast.html?utm_source=openai))
1 day ago
Kill Chain
GoSerpent Backdoor: A Persistent Threat to Southeast Asian Governments
The GoSerpent campaign is a sophisticated, multi-stage attack targeting government and diplomatic entities in Southeast Asia since at least 2021, with evolved variants deployed through 2026. The Go-based GoSerpent backdoor establishes persistent access and deploys ThumbcacheService for document collection, Mimikatz and QuarksDumpLocalHash for credential dumping, and later stages use Stowaway RAT and TmcLoader/TmcPayload to exfiltrate collected data via network shares using stolen credentials. The tight integration between collection, credential theft, and exfiltration components demonstrates advanced operational planning and long-term intelligence gathering objectives.
2 days ago
Kill Chain
StrikeShark Campaign Unleashes SharkLoader to Deploy Cobalt Strike Beacons
In June 2026, a cyber attack campaign named StrikeShark was identified, deploying a new malware loader called SharkLoader to deliver Cobalt Strike Beacons on compromised systems. The campaign targeted a diverse range of entities, including diplomatic organizations in Indonesia, government bodies in Taiwan, and software development companies across multiple countries. Attackers exploited known vulnerabilities in Microsoft Exchange Server (CVE-2021-26855), Openfire (CVE-2023-32315), and GeoServer (CVE-2024-36401) to gain initial access, subsequently establishing persistence through web shells and DLL side-loading techniques. The use of open-source post-compromise tools like FScan and Pillager suggests potential involvement of Chinese-speaking threat actors. This incident underscores the persistent threat posed by sophisticated malware loaders and the exploitation of known vulnerabilities. Organizations must prioritize timely patching and employ robust detection mechanisms to mitigate such risks. The broad geographic reach and diverse target set of this campaign highlight the evolving tactics of threat actors in the current cyber threat landscape.
3 weeks ago
Kill Chain
Turla's STOCKSTAY Backdoor: A New Cyber Espionage Threat
In June 2026, Google's Threat Intelligence Group identified a new .NET backdoor named STOCKSTAY, attributed to the Russian state-sponsored group Turla. This malware has been deployed against government and military organizations in Ukraine and entities interested in Italian foreign policy. STOCKSTAY, developed since at least December 2022, shares significant code and functional overlaps with Turla's previous implant, Kazuar. The backdoor comprises multiple components that communicate via inter-process communication channels and utilize secure WebSocket connections for command-and-control communication. It supports various commands, including file manipulation, system information gathering, and screen capture. ([cloud.google.com](https://cloud.google.com/blog/topics/threat-intelligence/stockstay-turla-intelligence-gathering/?utm_source=openai)) The discovery of STOCKSTAY underscores the evolving sophistication of state-sponsored cyber espionage tools. Its deployment highlights the persistent threat posed by advanced persistent threats (APTs) like Turla, emphasizing the need for robust cybersecurity measures and continuous monitoring to protect sensitive governmental and military information.
3 weeks ago
Kill Chain
Council of Europe Probes ShinyHunters Data Breach Allegations
In June 2026, the Council of Europe, representing 46 member states and over 700 million people, began investigating claims by the cyber extortion group ShinyHunters of a significant data breach. ShinyHunters alleged they had stolen over 429,000 documents containing sensitive HR and payroll data from multiple departments, including payslips, personnel files, and CVs, encompassing personal and financial information such as names, dates of birth, addresses, salaries, and bank account details. The group threatened to leak the data if their demands were not met by June 16, 2026. This incident underscores the escalating threat posed by cyber extortion groups like ShinyHunters, who have been linked to numerous high-profile data breaches targeting organizations worldwide. Their tactics often involve exfiltrating large volumes of sensitive data and leveraging it for ransom, highlighting the critical need for robust cybersecurity measures and proactive threat detection to safeguard organizational data.
1 month ago
Kill Chain
UN World Food Programme Data Breach: A Wake-Up Call for Humanitarian Cybersecurity
In May 2026, the United Nations' World Food Programme (WFP) experienced a significant data breach when unauthorized actors accessed its self-registration application for Palestine. This breach exposed sensitive personal information—including names, ID numbers, mobile numbers, and location data—of approximately 600,000 Palestinian households in Gaza. The WFP promptly suspended the affected platform to implement security enhancements and initiated a comprehensive investigation into the incident. This incident underscores the critical importance of robust cybersecurity measures for humanitarian organizations handling sensitive beneficiary data. The exposure of such information not only compromises individual privacy but also heightens the risk of identity theft and targeted attacks, emphasizing the need for continuous vigilance and proactive security protocols in the humanitarian sector.
1 month ago
Kill Chain
Chinese APT Mustang Panda's Cyber-Espionage Campaign Against Indian Banks and Korean Policy Circles
In April 2026, the Chinese state-sponsored advanced persistent threat (APT) group known as Mustang Panda initiated a cyber-espionage campaign targeting India's banking sector and U.S.-Korea policy circles. The attackers employed spear-phishing emails, often disguised as IT help desk communications, to deliver malicious files. Upon opening, these files executed DLL sideloading attacks, establishing persistence via the Windows Registry. The campaign deployed a variant of the LotusLite backdoor, enabling remote access for espionage activities. Notably, the malware was camouflaged to resemble legitimate banking software, such as that of HDFC Bank, India's largest private bank. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/chinese-apt-indian-banks-korean-policy/?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber actors utilizing well-known tactics to infiltrate critical sectors. Organizations must remain vigilant, as even unsophisticated methods can be effective if basic security controls are inconsistently applied. The targeting of financial institutions for intelligence gathering highlights the strategic value placed on economic data in geopolitical contexts.
2 months ago
Kill Chain
Grinex Exchange Halts Operations After $13.74M Cyberattack
In April 2026, Grinex, a Kyrgyzstan-registered cryptocurrency exchange with strong ties to Russia, suspended operations following a cyberattack that resulted in the theft of over $13.74 million (approximately 1 billion rubles) from user funds. The exchange attributed the attack to foreign intelligence agencies, citing the sophisticated nature of the breach. The stolen funds were primarily in USDT, which were swiftly converted to TRX and ETH to evade potential asset freezing by Tether. This incident underscores the vulnerabilities of cryptocurrency exchanges operating in regulatory grey areas and highlights the ongoing geopolitical tensions affecting financial infrastructures. The attack on Grinex is part of a broader trend of state-sponsored cyber operations targeting financial entities, emphasizing the need for enhanced security measures and regulatory oversight in the cryptocurrency sector.
3 months ago
Kill Chain
TA416's Renewed Cyber Espionage Campaigns Target European Governments
In mid-2025, the China-aligned threat actor TA416 resumed cyber espionage operations targeting European government and diplomatic entities after a two-year hiatus. The group employed sophisticated techniques, including web bug reconnaissance and evolving malware delivery methods, to deploy the PlugX backdoor via DLL sideloading. These campaigns primarily focused on individuals associated with NATO and EU delegations, leveraging compromised accounts and freemail services to distribute malicious payloads. ([proofpoint.com](https://www.proofpoint.com/us/blog/threat-insight/id-come-running-back-eu-again-ta416-resumes-european-government-espionage?utm_source=openai)) This resurgence underscores the persistent threat posed by state-sponsored actors to governmental institutions, highlighting the need for enhanced cybersecurity measures and vigilance against evolving attack vectors. ([proofpoint.com](https://www.proofpoint.com/us/blog/threat-insight/id-come-running-back-eu-again-ta416-resumes-european-government-espionage?utm_source=openai))
3 months ago
Kill Chain
TA416's Renewed Cyberespionage Campaigns in Europe and Middle East
Between mid-2025 and early 2026, the China-aligned cyberespionage group TA416, also known as Mustang Panda, resumed targeting European government and diplomatic entities after a period of reduced activity in the region. The group employed web bug campaigns and malware delivery methods, including phishing emails with lures about Europe sending troops to Greenland, to deliver their customized PlugX backdoor via DLL sideloading techniques. In March 2026, following the outbreak of conflict in Iran, TA416 expanded its operations to target Middle Eastern government and diplomatic entities, marking a strategic shift in their focus. ([proofpoint.com](https://www.proofpoint.com/us/blog/threat-insight/id-come-running-back-eu-again-ta416-resumes-european-government-espionage?utm_source=openai)) This resurgence in TA416's activities underscores the evolving nature of state-sponsored cyber threats, particularly in the context of geopolitical tensions. Organizations within the targeted regions should remain vigilant and enhance their cybersecurity measures to mitigate the risks associated with such sophisticated cyberespionage campaigns.
3 months ago
Kill Chain
Transparent Tribe's AI-Driven Malware Campaign: A 2026 Cybersecurity Wake-Up Call
In early 2026, the Pakistan-aligned threat actor Transparent Tribe (APT36) launched a cyber espionage campaign targeting Indian government entities. Utilizing AI-assisted development, they produced a high volume of malware implants in lesser-known programming languages such as Nim, Zig, and Crystal. These implants exploited trusted services like Slack, Discord, Supabase, and Google Sheets for command-and-control communications, complicating detection efforts. The attack vectors included spear-phishing emails with weaponized Windows shortcut (LNK) files and PDF lures leading to malicious downloads. Once executed, these payloads provided the attackers with remote access, enabling data exfiltration and further network compromise. This campaign underscores the evolving threat landscape where AI tools are leveraged to rapidly develop and deploy diverse malware strains, overwhelming traditional defense mechanisms. Organizations must enhance their cybersecurity posture by adopting advanced threat detection systems capable of identifying and mitigating such sophisticated attacks.
4 months ago
Kill Chain
Chinese Police Exploit ChatGPT in Smear Campaign Against Japan's PM Takaichi
In October 2025, OpenAI identified and banned a ChatGPT account linked to Chinese law enforcement that was used to orchestrate a smear campaign against Japan's Prime Minister, Sanae Takaichi. The individual behind the account attempted to leverage ChatGPT to generate and amplify negative content about Takaichi, including drafting complaints impersonating Japanese citizens and creating social media posts to incite public dissent. These activities were part of a broader, covert influence operation aimed at discrediting foreign officials critical of China's policies. ([theregister.com](https://www.theregister.com/2026/02/25/chinese_law_enforcement_chatgpt_abuse/?utm_source=openai)) This incident underscores the evolving use of artificial intelligence in state-sponsored disinformation campaigns. The exposure of such tactics highlights the need for vigilance against AI-driven influence operations, especially as they become more sophisticated and harder to detect. ([axios.com](https://www.axios.com/2026/02/25/openai-chatgpt-china-japan-prime-minister?utm_source=openai))
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports