✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
International Affairs
Breach intelligence, attack campaigns, and threat reports targeting the International Affairs sector.
Explore Other Sectors
International Affairs Threat Reports
Iranian APTs Target US Policy Influencers in Sophisticated 2024 Phishing Campaign
In mid-2024, Iranian state-aligned advanced persistent threat (APT) actors launched a sophisticated spear-phishing campaign targeting prominent US foreign policy influencers, think tank members, and government advisors. The attackers employed socially engineered emails and credential harvesting tactics, using well-crafted phishing lures to compromise email accounts and exfiltrate sensitive conversations. While attribution remains uncertain among Iranian groups, the campaign utilized advanced operational security measures, making detection difficult and demonstrating high levels of persistence. As a result, sensitive policy information and strategic communications were potentially exposed, raising concerns about foreign influence and espionage risks. This campaign is especially relevant as it highlights a broader surge in highly personalized phishing attacks by nation-state actors against geopolitical targets. It underscores the need for advanced identity protection, more robust security around internal communications, and ongoing vigilance among organizations operating in the policy and government sectors.
6 months ago
Kill Chain
UNC6384 Strikes: Diplomatic Espionage Campaign Hits Europe via Windows Exploits
In early 2024, advanced persistent threat group UNC6384 targeted multiple European diplomatic entities in a sophisticated cyber-espionage campaign. By leveraging highly convincing spear-phishing emails themed around the European Commission and NATO, attackers tricked foreign affairs officials into clicking malicious links crafted to exploit Windows vulnerabilities. Once compromised, victims' systems allowed for persistent access, resulting in unauthorized data exfiltration and significant risks to sensitive diplomatic communications. The attack underscores the vulnerability of trusted organizations to nation-state tactics and the dangers posed by zero-day Windows exploits in high-value targets. The incident highlights a growing trend of targeted attacks against governmental organizations, coinciding with increased geopolitical tension in Europe. As cyber threat actors continue to exploit social engineering and sophisticated malware, organizations must prioritize endpoint security, staff awareness, and aggressive detection measures to thwart emerging espionage campaigns.
6 months ago
Kill Chain
Windows Zero-Day Attack Exposes European Diplomats in 2024 Espionage Campaign
In early 2024, a threat group with links to China launched a targeted espionage campaign exploiting a previously unknown Windows zero-day vulnerability. The attackers aimed at European diplomats and associated governmental entities in countries including Hungary and Belgium. Armed with this zero-day, threat actors gained initial access, moved laterally within the network, and exfiltrated sensitive data from diplomatic communications and systems. The sophistication of the operation allowed them to evade traditional signature-based defenses, resulting in significant potential exposure of confidential state-level information and disruption of diplomatic activities. This incident underscores the ongoing shift towards advanced, nation-state–backed cyber-espionage using zero-day exploits. The rise of targeted attacks against governmental and diplomatic institutions highlights the necessity for modern threat detection, east-west traffic security, and proactive zero trust strategies to stay ahead of rapidly evolving adversary techniques.
6 months ago
Kill Chain
China-Linked APT Exploits Windows Shortcut Flaw in 2025 to Breach EU Diplomats
In late 2025, the China-linked threat group UNC6384 orchestrated a targeted cyber espionage campaign against European diplomatic and government institutions. Utilizing a previously unpatched Windows shortcut (LNK) vulnerability, attackers delivered malicious payloads to compromise systems in Hungary, Belgium, Italy, the Netherlands, and Serbia. The group specialized in stealthy lateral movement, data collection, and command-and-control operations while evading standard defenses. As a result, sensitive government data and communications were potentially exposed, undermining national security and international collaboration efforts. This incident underscores the growing sophistication of state-sponsored cyberattacks, intensified by the exploitation of zero-day vulnerabilities and advanced lateral movement techniques. The frequent targeting of government and diplomatic organizations shows a continued evolution in APT tactics and a rising threat to global critical infrastructure.
6 months ago
Kill Chain
SideWinder’s 2025 ClickOnce Attack Chain Exposes South Asian Diplomats
In September 2025, the advanced persistent threat group SideWinder targeted a prominent European embassy in New Delhi alongside organizations in Sri Lanka, Pakistan, and Bangladesh. The attackers employed a sophisticated attack chain leveraging weaponized PDF files and Microsoft's ClickOnce technology to deliver malicious payloads. This marks a significant evolution in SideWinder's tactics, exploiting trusted digital distribution methods to bypass legacy security controls. The campaign highlights the risk to diplomatic and government entities in South Asia, raising alarms over the exposure of confidential communications and potential national security impacts. Organizations suffered from disrupted operations and faced reputational damage as investigations unfolded. This incident exemplifies a wider shift toward blending email-based phishing with novel delivery vectors like ClickOnce and cloud distribution platforms. The campaign signals increasing professionalization among APT groups and serves as a warning for public sector and diplomatic organizations to reevaluate defenses against targeted, sophisticated malware attacks.
6 months ago
Kill Chain
PhantomCaptcha Spearphishing Attack Targets Ukraine War Relief Orgs
On June 22, 2024, a coordinated spearphishing campaign dubbed 'PhantomCaptcha ClickFix' targeted Ukrainian regional government entities and major international humanitarian organizations, such as the International Committee of the Red Cross and UNICEF. The attackers used convincing phishing emails distributing malicious links intended to compromise users through browser exploits and credential harvesting, aiming to disrupt relief efforts amid ongoing conflict. Although the operation was short-lived, lasting just one day, it exposed staff to significant risk of account takeover and disruption of war relief operations. This incident spotlights the expanding use of highly targeted, short-duration spearphishing campaigns against NGOs and governmental organizations, reflecting the broader trend of cyber-enabled disruption in geopolitical conflict zones. Attacks exploiting human trust and exploiting organizational urgency are on the rise, demanding renewed vigilance.
6 months ago
Kill Chain
PhantomCaptcha: How Ukraine Aid Groups Were Targeted with Spear-Phishing PDFs in 2025
On October 8, 2025, a sophisticated spear-phishing campaign, dubbed PhantomCaptcha, targeted Ukraine war relief organizations, including members of the International Red Cross and Norwegian Refugee Council. Attackers sent counterfeit Zoom invitations and weaponized PDF attachments designed to lure aid workers into executing a remote access trojan (RAT). Leveraging WebSockets for covert command-and-control, the threat actors gained unauthorized access, potentially jeopardizing sensitive wartime humanitarian data and operations. The campaign showcased precise targeting, the use of specially crafted lures reflecting victims’ work environments, and advanced C2 techniques to evade detection. This incident underscores the increasing cyber threats facing humanitarian sectors amid ongoing geopolitical conflicts. As military and civilian support organizations become more digitalized and visible, spear-phishing and RAT-based compromises are on the rise, necessitating urgent security enhancements and compliance vigilance.
6 months ago
Kill Chain
Inside the 2025 Mysterious Elephant Cyber-Espionage Attacks Across South Asia
In early 2025, the cyber-espionage group known as "Mysterious Elephant" conducted a sophisticated campaign targeting government and diplomatic agencies across South Asia. Exploiting previously unseen custom tools, the threat actors gained initial access through spear-phishing and deployed a combination of new malware and legacy techniques to maintain persistence and facilitate covert lateral movement. The attackers exfiltrated sensitive communications and state documents while evading traditional detection mechanisms, resulting in significant exposure of confidential information and escalating regional tensions. This incident highlights the evolution of state-sponsored threat actors beyond recycled malware toward bespoke toolkits and advanced TTPs. Security leaders should note the rapid escalation of intelligence-driven attacks against public sector targets, an indicator of rising geopolitical cyber conflict and regulatory scrutiny.
6 months ago
Kill Chain
2025 Mysterious Elephant Attack: Asia-Pacific Government Cyber-Espionage Exposed
In early 2025, the Mysterious Elephant advanced persistent threat group launched a sophisticated campaign targeting government and foreign affairs entities across Pakistan, Bangladesh, Afghanistan, Nepal, and Sri Lanka. Utilizing spear phishing emails, exploit kits, and malicious documents as entry vectors, the group deployed custom and open-source malware—such as BabShell, MemLoader HidenDesk, and ChromeStealer—to gain persistent network access, move laterally, and exfiltrate sensitive data. Their tooling leveraged advanced evasion tactics and targeted WhatsApp data for exfiltration, compromising documents, images, and browser credentials. The operation demonstrates considerable code reuse and customized tooling, posing a significant disruption to national and diplomatic processes in the region. Mysterious Elephant’s shift to tailored malware, WhatsApp-specific exfiltration, and cloud-based infrastructure highlights a broader threat landscape trend: state-sponsored actors refining tactics for targeted governmental espionage. This underscores the importance of proactive monitoring and cross-border information sharing to address escalating nation-state risks.
6 months ago
Kill Chain
AI-Powered PRISONBREAK Influence Operation Targets Iran Amid Heightened Tensions
In early 2025, a coordinated AI-enabled information operation named 'PRISONBREAK' targeted Iranian audiences via over 50 inauthentic X (formerly Twitter) profiles. Likely conducted by an Israeli government agency or contracted group, the operation deliberately synchronized its messaging with Israeli military action against Iran in June 2025. These automated profiles aimed to incite unrest and dissent within Iran, leveraging artificial intelligence to amplify and seed anti-government narratives to large public communities, at times with paid promotion. While organic engagement was limited, several posts garnered tens of thousands of views, representing a sophisticated example of nation-state influence using AI and social media. The operation highlights the new scale and efficiency with which AI can power information warfare, especially when paired with state-level coordination. As similar AI-driven campaigns grow globally, organizations and governments must re-examine detection strategies, policy enforcement, and regulatory frameworks for safeguarding against synthetic and manipulative online content.
6 months ago
Kill Chain
Dutch Teens Arrested for Wi-Fi Sniffer Recon in 2024 Russian Espionage Case
In June 2024, Dutch law enforcement arrested two 17-year-olds suspected of conducting cyber-espionage for Russian-backed threat actors. The teens reportedly canvassed high-profile locations in The Hague, including several embassies and European law enforcement headquarters, using a Wi-Fi sniffer to gather network intelligence. Authorities allege they were recruited via Telegram and that state-sponsored Russian actors utilized the pair for reconnaissance, leveraging youth engagement to mask attribution. The operation came to light after a tip-off from Dutch intelligence, resulting in swift arrests and raising significant policy concerns. This incident underscores a rising trend of nation-states outsourcing early reconnaissance to foreign youth via social media, reducing their risk of direct detection. The use of simple yet effective tools for physical/digital hybrid espionage highlights growing operational sophistication—and creates new urgency for organizations to shore up network perimeter and monitoring controls.
6 months ago
Kill Chain
Phantom Taurus: China-Linked Espionage Group Infiltrates Diplomatic Targets with Undetected Malware
In early 2024, Palo Alto Networks' Unit 42 uncovered a newly confirmed China-linked espionage group, dubbed Phantom Taurus, employing advanced stealth techniques and novel malware to infiltrate nearly a dozen high-value targets in the Middle East, Africa, and Asia. The group relied on exploiting unpatched, internet-facing devices to gain initial access before deploying a custom malware suite designed for in-memory execution and deep evasion, allowing them to establish persistent access and exfiltrate sensitive diplomatic and governmental data over periods stretching up to two years. While Phantom Taurus shares some infrastructure traits with other Chinese threat actors, its custom tooling, extended operational security, and unique tactics distinguish it from other known groups, and it remains active with recent campaigns expanding to new regions. This incident highlights an escalation in the sophistication and reach of nation-state cyber espionage. The emergence of Phantom Taurus signals a growing trend of attackers prioritizing stealth and long-term intelligence gathering, making it more difficult for organizations to detect and respond to breaches within high-value sectors.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports