The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
International Affairs
Breach intelligence, attack campaigns, and threat reports targeting the International Affairs sector.
Explore Other Sectors
International Affairs Threat Reports
Tomiris Unleashes 'Havoc': 2024 CIS Government Cyber-Espionage Explained
In early 2024, the Russian-speaking APT group Tomiris launched a sophisticated cyber-espionage campaign targeting government and diplomatic organizations in several CIS nations and Central Asia. Attackers leveraged new malware tools and refined tactics, initially gaining access via spear-phishing and malicious email attachments designed to exploit trust within diplomatic correspondence chains. Once inside, the group deployed covert tools for lateral movement, maintained persistence, and exfiltrated sensitive diplomatic communications and internal documents. The breach had significant operational security implications, exposing strategic discussions and potentially undermining ongoing government initiatives. This incident exemplifies the ongoing risk posed by advanced persistent threats in geopolitical hotspots, with Tomiris demonstrating evolving tradecraft and adaptability. Organizations are urged to review east-west security, segmentation, and monitoring practices as similar espionage campaigns are increasingly targeting public sector networks.
8 months ago
Kill Chain
Tomiris Leverages Public-Service Implants for Stealthy Government Attacks
In late 2025, the state-sponsored threat actor Tomiris escalated its attacks against government entities and intergovernmental organizations, primarily in Russia and neighboring regions. The group notably shifted its tactics by deploying custom remote access implants that leveraged public cloud services, such as Telegram and Discord, as command-and-control (C2) channels. This allowed Tomiris to disguise their network traffic among legitimate service use, evading conventional perimeter defenses and security controls. The compromise enabled attackers to maintain persistent access, deploy additional payloads, and potentially exfiltrate sensitive diplomatic and policy data. This incident is significant due to its demonstration of the evolving sophistication in APT tactics: the use of ubiquitous public platforms for C2, making detection and attribution harder. It also highlights the urgency for zero trust architectures, enhanced traffic monitoring, and cloud-centric security controls as industries face an increase in nation-state and intelligence-motivated threats.
8 months ago
Kill Chain
Tomiris APT 2025: Abuse of Telegram, Discord & Multi-Language Toolkit in Advanced Government Attacks
In early 2025, the Tomiris APT group launched a sophisticated cyberespionage campaign targeting foreign ministries, intergovernmental organizations, and government entities across Russia and Central Asia. Using spear-phishing emails with password-protected malicious archives, Tomiris delivered a diverse toolkit of implants written in C/C++, Rust, Go, C#, and Python. Their malware leveraged public services like Telegram and Discord for command-and-control (C2), employed open-source frameworks such as Havoc and AdaptixC2, and enabled attackers to perform reconnaissance, maintain persistence, and exfiltrate sensitive data, while evading traditional network defenses by blending illicit traffic with legitimate channels. This incident highlights a clear evolution in APT tradecraft: rapid adoption of multi-language toolchains, creative lateral movement, and the abuse of popular cloud-based services for covert operations. With the continued rise of lawful-shadow C2 channels and open-source post-exploitation kits, organizations face heightened risks from identity-driven, stealthy attacks that challenge conventional segmentation and anomaly detection strategies.
8 months ago
Kill Chain
SmudgedSerpent 2025: Espionage Hits Policy Experts Amid Iran-Israel Tensions
Between June and August 2025, an advanced threat group dubbed UNK_SmudgedSerpent orchestrated a series of targeted cyber espionage campaigns against U.S.-based academics and foreign policy experts. Leveraging spear-phishing and sophisticated social engineering, the attackers exploited topical Iranian political themes to deliver customized malware, enabling data exfiltration and continuous monitoring of sensitive research communications. The campaign coincided with heightened Iran–Israel tensions, harnessing unauthorized east-west network movement and encrypted C2 channels to bypass traditional security controls, resulting in significant exposure of policy research, analysis drafts, and privileged communications. This intrusion highlights the evolving tactics of nation-state-aligned actors who exploit contextual geopolitical unrest to target civilian research and policy infrastructure. The incident underscores the escalating risk to sectors handling sensitive knowledge, while accelerating demands for retroactive compliance audits and robust zero trust segmentation as espionage techniques continue to proliferate.
8 months ago
Kill Chain
Iranian APTs Target US Policy Influencers in Sophisticated 2024 Phishing Campaign
In mid-2024, Iranian state-aligned advanced persistent threat (APT) actors launched a sophisticated spear-phishing campaign targeting prominent US foreign policy influencers, think tank members, and government advisors. The attackers employed socially engineered emails and credential harvesting tactics, using well-crafted phishing lures to compromise email accounts and exfiltrate sensitive conversations. While attribution remains uncertain among Iranian groups, the campaign utilized advanced operational security measures, making detection difficult and demonstrating high levels of persistence. As a result, sensitive policy information and strategic communications were potentially exposed, raising concerns about foreign influence and espionage risks. This campaign is especially relevant as it highlights a broader surge in highly personalized phishing attacks by nation-state actors against geopolitical targets. It underscores the need for advanced identity protection, more robust security around internal communications, and ongoing vigilance among organizations operating in the policy and government sectors.
8 months ago
Kill Chain
UNC6384 Strikes: Diplomatic Espionage Campaign Hits Europe via Windows Exploits
In early 2024, advanced persistent threat group UNC6384 targeted multiple European diplomatic entities in a sophisticated cyber-espionage campaign. By leveraging highly convincing spear-phishing emails themed around the European Commission and NATO, attackers tricked foreign affairs officials into clicking malicious links crafted to exploit Windows vulnerabilities. Once compromised, victims' systems allowed for persistent access, resulting in unauthorized data exfiltration and significant risks to sensitive diplomatic communications. The attack underscores the vulnerability of trusted organizations to nation-state tactics and the dangers posed by zero-day Windows exploits in high-value targets. The incident highlights a growing trend of targeted attacks against governmental organizations, coinciding with increased geopolitical tension in Europe. As cyber threat actors continue to exploit social engineering and sophisticated malware, organizations must prioritize endpoint security, staff awareness, and aggressive detection measures to thwart emerging espionage campaigns.
8 months ago
Kill Chain
Windows Zero-Day Attack Exposes European Diplomats in 2024 Espionage Campaign
In early 2024, a threat group with links to China launched a targeted espionage campaign exploiting a previously unknown Windows zero-day vulnerability. The attackers aimed at European diplomats and associated governmental entities in countries including Hungary and Belgium. Armed with this zero-day, threat actors gained initial access, moved laterally within the network, and exfiltrated sensitive data from diplomatic communications and systems. The sophistication of the operation allowed them to evade traditional signature-based defenses, resulting in significant potential exposure of confidential state-level information and disruption of diplomatic activities. This incident underscores the ongoing shift towards advanced, nation-state–backed cyber-espionage using zero-day exploits. The rise of targeted attacks against governmental and diplomatic institutions highlights the necessity for modern threat detection, east-west traffic security, and proactive zero trust strategies to stay ahead of rapidly evolving adversary techniques.
8 months ago
Kill Chain
China-Linked APT Exploits Windows Shortcut Flaw in 2025 to Breach EU Diplomats
In late 2025, the China-linked threat group UNC6384 orchestrated a targeted cyber espionage campaign against European diplomatic and government institutions. Utilizing a previously unpatched Windows shortcut (LNK) vulnerability, attackers delivered malicious payloads to compromise systems in Hungary, Belgium, Italy, the Netherlands, and Serbia. The group specialized in stealthy lateral movement, data collection, and command-and-control operations while evading standard defenses. As a result, sensitive government data and communications were potentially exposed, undermining national security and international collaboration efforts. This incident underscores the growing sophistication of state-sponsored cyberattacks, intensified by the exploitation of zero-day vulnerabilities and advanced lateral movement techniques. The frequent targeting of government and diplomatic organizations shows a continued evolution in APT tactics and a rising threat to global critical infrastructure.
8 months ago
Kill Chain
SideWinder’s 2025 ClickOnce Attack Chain Exposes South Asian Diplomats
In September 2025, the advanced persistent threat group SideWinder targeted a prominent European embassy in New Delhi alongside organizations in Sri Lanka, Pakistan, and Bangladesh. The attackers employed a sophisticated attack chain leveraging weaponized PDF files and Microsoft's ClickOnce technology to deliver malicious payloads. This marks a significant evolution in SideWinder's tactics, exploiting trusted digital distribution methods to bypass legacy security controls. The campaign highlights the risk to diplomatic and government entities in South Asia, raising alarms over the exposure of confidential communications and potential national security impacts. Organizations suffered from disrupted operations and faced reputational damage as investigations unfolded. This incident exemplifies a wider shift toward blending email-based phishing with novel delivery vectors like ClickOnce and cloud distribution platforms. The campaign signals increasing professionalization among APT groups and serves as a warning for public sector and diplomatic organizations to reevaluate defenses against targeted, sophisticated malware attacks.
8 months ago
Kill Chain
PhantomCaptcha Spearphishing Attack Targets Ukraine War Relief Orgs
On June 22, 2024, a coordinated spearphishing campaign dubbed 'PhantomCaptcha ClickFix' targeted Ukrainian regional government entities and major international humanitarian organizations, such as the International Committee of the Red Cross and UNICEF. The attackers used convincing phishing emails distributing malicious links intended to compromise users through browser exploits and credential harvesting, aiming to disrupt relief efforts amid ongoing conflict. Although the operation was short-lived, lasting just one day, it exposed staff to significant risk of account takeover and disruption of war relief operations. This incident spotlights the expanding use of highly targeted, short-duration spearphishing campaigns against NGOs and governmental organizations, reflecting the broader trend of cyber-enabled disruption in geopolitical conflict zones. Attacks exploiting human trust and exploiting organizational urgency are on the rise, demanding renewed vigilance.
8 months ago
Kill Chain
PhantomCaptcha: How Ukraine Aid Groups Were Targeted with Spear-Phishing PDFs in 2025
On October 8, 2025, a sophisticated spear-phishing campaign, dubbed PhantomCaptcha, targeted Ukraine war relief organizations, including members of the International Red Cross and Norwegian Refugee Council. Attackers sent counterfeit Zoom invitations and weaponized PDF attachments designed to lure aid workers into executing a remote access trojan (RAT). Leveraging WebSockets for covert command-and-control, the threat actors gained unauthorized access, potentially jeopardizing sensitive wartime humanitarian data and operations. The campaign showcased precise targeting, the use of specially crafted lures reflecting victims’ work environments, and advanced C2 techniques to evade detection. This incident underscores the increasing cyber threats facing humanitarian sectors amid ongoing geopolitical conflicts. As military and civilian support organizations become more digitalized and visible, spear-phishing and RAT-based compromises are on the rise, necessitating urgent security enhancements and compliance vigilance.
8 months ago
Kill Chain
Inside the 2025 Mysterious Elephant Cyber-Espionage Attacks Across South Asia
In early 2025, the cyber-espionage group known as "Mysterious Elephant" conducted a sophisticated campaign targeting government and diplomatic agencies across South Asia. Exploiting previously unseen custom tools, the threat actors gained initial access through spear-phishing and deployed a combination of new malware and legacy techniques to maintain persistence and facilitate covert lateral movement. The attackers exfiltrated sensitive communications and state documents while evading traditional detection mechanisms, resulting in significant exposure of confidential information and escalating regional tensions. This incident highlights the evolution of state-sponsored threat actors beyond recycled malware toward bespoke toolkits and advanced TTPs. Security leaders should note the rapid escalation of intelligence-driven attacks against public sector targets, an indicator of rising geopolitical cyber conflict and regulatory scrutiny.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports