The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Political Organization
Breach intelligence, attack campaigns, and threat reports targeting the Political Organization sector.
Explore Other Sectors
Political Organization Threat Reports
Handala Hackers Exploit Telegram for Malware Attacks in 2026
In March 2026, the FBI issued a warning about Iranian state-sponsored hackers, specifically the Handala group, utilizing Telegram as command-and-control infrastructure in malware attacks. These attacks targeted journalists critical of the Iranian government, dissidents, and opposition groups worldwide. The attackers employed social engineering tactics to infect Windows devices, enabling the exfiltration of screenshots and files from compromised systems. This activity led to intelligence collection, data leaks, and reputational harm to the victims. The incident underscores the evolving tactics of state-sponsored cyber actors, who are increasingly leveraging popular communication platforms like Telegram for malicious purposes. This trend highlights the need for heightened vigilance and robust cybersecurity measures to protect against sophisticated social engineering and malware deployment strategies.
6 months ago
Kill Chain
Russian Hackers Exploit Social Engineering to Access Signal and WhatsApp Accounts
In March 2026, Dutch intelligence agencies reported a large-scale global cyber campaign orchestrated by Russian state-sponsored hackers targeting Signal and WhatsApp accounts of government officials, military personnel, and journalists. The attackers employed sophisticated phishing and social engineering techniques, such as impersonating support chatbots, to deceive users into revealing security verification codes and passcodes. This enabled unauthorized access to individual and group conversations, potentially exposing sensitive information. ([themoscowtimes.com](https://www.themoscowtimes.com/2026/03/09/russian-hackers-targeting-messaging-apps-dutch-spies-say-a92164?utm_source=openai)) This incident underscores the evolving tactics of nation-state actors in exploiting widely-used encrypted messaging platforms. Despite the robust end-to-end encryption of these applications, the human element remains a critical vulnerability. Organizations must enhance user awareness and implement stringent security protocols to mitigate such social engineering threats.
6 months ago
Kill Chain
Russian Hackers Exploit Social Engineering to Access Signal and WhatsApp Accounts
In March 2026, Dutch intelligence agencies reported a large-scale global cyber campaign by Russian state-sponsored hackers targeting Signal and WhatsApp accounts of dignitaries, military personnel, civil servants, and journalists. The attackers employed social engineering techniques, such as impersonating Signal support chatbots, to deceive users into revealing verification and PIN codes. This allowed them to gain unauthorized access to accounts, read messages, and infiltrate group chats. The campaign exploited legitimate app features like 'linked devices' to maintain persistent access without the users' knowledge. ([english.aivd.nl](https://english.aivd.nl/latest/news/2026/03/09/russia-targets-signal-and-whatsapp-accounts-in-cyber-campaign?utm_source=openai)) This incident underscores the increasing sophistication of state-sponsored cyber operations and highlights the vulnerabilities associated with social engineering tactics. It serves as a critical reminder for organizations and individuals to exercise heightened vigilance, especially when using encrypted messaging platforms for sensitive communications.
6 months ago
Kill Chain
FBI Uncovers Russian-Linked Phishing Attacks on Encrypted Messaging Apps
In March 2026, the FBI issued a public service announcement attributing phishing campaigns targeting users of encrypted messaging apps, notably Signal and WhatsApp, to Russian intelligence services. These campaigns, active since at least early 2026, have compromised thousands of accounts by tricking users into sharing verification codes or scanning malicious QR codes, thereby granting attackers access to private messages and contact lists. The primary targets include individuals with access to sensitive information, such as U.S. government officials, military personnel, political figures, and journalists. This incident underscores the evolving tactics of nation-state actors in circumventing end-to-end encryption by exploiting human vulnerabilities. The widespread nature of these attacks highlights the urgent need for enhanced user awareness and robust security measures to protect against sophisticated phishing schemes.
6 months ago
Kill Chain
Spain Arrests Anonymous Fénix Hacktivists for DDoS Attacks
In February 2026, Spanish authorities arrested four members of the hacktivist group 'Anonymous Fénix' for orchestrating distributed denial-of-service (DDoS) attacks against government ministries, political parties, and public institutions. The group initiated its activities in April 2023, intensifying efforts after the October 2024 DANA storm in Valencia, which resulted in significant casualties and damage. They utilized social media platforms like X and Telegram to disseminate anti-government messages and recruit participants for their cyber campaigns. The arrests, conducted in May 2025 and February 2026 across various Spanish cities, led to the judicial seizure of the group's online accounts and the closure of their communication channels. ([web.guardiacivil.es](https://web.guardiacivil.es/en/destacados/noticias/Detenidos-los-cuatro-principales-integrantes-del-grupo-hacktivista-Anonymous-Fenix-por-ciberataques-contra-organismos-publicos/?utm_source=openai)) This incident underscores the persistent threat posed by hacktivist groups leveraging socio-political events to justify cyberattacks. The use of DDoS tactics to disrupt critical government services highlights the need for robust cybersecurity measures and proactive monitoring of online platforms for recruitment and coordination activities.
7 months ago
Kill Chain
Serbian Authorities' Misuse of Cellebrite Tools in 2024: A Wake-Up Call for Digital Privacy
In December 2024, Amnesty International reported that Serbian police and intelligence agencies misused Cellebrite's digital forensic tools to unlawfully extract data from mobile devices belonging to journalists and activists. The authorities employed these tools to unlock devices without consent, facilitating the installation of spyware like NoviSpy during detentions and interrogations. This surveillance campaign targeted individuals critical of government policies, leading to significant privacy violations and suppression of civil society. ([amnesty.org](https://www.amnesty.org/en/latest/news/2024/12/serbia-authorities-using-spyware-and-cellebrite-forensic-extraction-tools-to-hack-journalists-and-activists/?utm_source=openai)) The incident underscores the potential for abuse of digital forensic technologies when deployed without stringent oversight. It highlights the urgent need for robust legal frameworks and ethical guidelines to prevent the misuse of such tools against civil society and to protect fundamental human rights.
7 months ago
Kill Chain
WhatsApp Unveils "Strict Account Settings" to Combat Spyware in 2024
In June 2024, WhatsApp introduced a lockdown-style "Strict Account Settings" feature to counter the growing threat of spyware targeting its user base—including journalists, activists, and public figures. This proactive measure allows users to limit messaging and attachment options from unknown contacts, mitigating risks of exploitation similar to past incidents like the Pegasus spyware attacks. The rollout follows WhatsApp’s ongoing legal battles with threat actors and reflects the platform’s drive to strengthen user privacy and security in the wake of sophisticated surveillance malware campaigns. This development highlights an industry-wide shift towards advanced, user-accessible security controls as spyware campaigns become more adept at circumventing traditional defenses. Organizations and high-risk users face mounting pressure from both regulatory frameworks and adversary innovation, compelling tech platforms to continually adapt and raise the bar for account protection and threat mitigation.
7 months ago
Kill Chain
WhatsApp Rolls Out Lockdown Security for High-Risk Users After Spyware Attacks
In early 2026, WhatsApp introduced a new 'Strict Account Settings' feature to defend high-risk users such as journalists and public figures against highly targeted spyware attacks. This rollout followed a series of incidents in recent years where advanced zero-click exploits—many attributed to government-linked actors—were used to deploy spyware like NSO Group’s Pegasus and Paragon Graphite onto users’ devices via messaging platforms. Exploits leveraged zero-day vulnerabilities in WhatsApp’s iOS and macOS clients, enabling attackers to compromise devices without user interaction, raising severe risks to privacy and personal safety for individuals facing nation-state targeting. This event is particularly relevant as threat actors increasingly adopt sophisticated, zero-click methods to compromise high-value targets. Security and privacy expectations for messaging apps are under heightened scrutiny, with regulators and civil society urging greater protections and rapid incident response to curtail such threats.
7 months ago
Kill Chain
Intellexa 2024: Spyware Supply Chains Now Targeting Executives Worldwide
In 2024, investigators identified a sprawling global network linked to Intellexa, a major commercial spyware developer behind the Predator malware platform. Entities across multiple countries—including the Czech Republic, Kazakhstan, and the Philippines—were found facilitating the shipment and deployment of Intellexa’s surveillance products to government and private sector customers. Notably, targeting expanded beyond civil society to include executives and high-value private sector individuals, with infection vectors leveraging ad-based mechanisms such as the 'Aladdin' platform. This growing balkanized ecosystem enables strategic intelligence gathering, while obfuscating operator and client identities. This incident reflects intensifying arms-race dynamics in the mercenary spyware market, characterized by increased secrecy, proliferation to jurisdictions with weak oversight, and exposure of private sector leaders. The expanding reach and impact have raised urgent concerns over regulatory gaps, legal liability, and escalating risks to both individual privacy and organizational resilience.
8 months ago
Kill Chain
CopyCop: Unmasking Russia's AI-Driven Disinformation Offensive in 2024
In early-to-mid 2024, cybersecurity researchers uncovered the extensive "CopyCop" campaign, a Russian-connected influence operation leveraging AI technologies to scale disinformation globally. The operation orchestrated over 300 AI-generated fake news sites mimicking legitimate Western media outlets, flooding North America, Europe, and other regions with fabricated stories and deepfakes targeting public perception about the conflict in Ukraine. CopyCop used self-hosted large language models to mass-produce convincing articles, fake fact-checkers, and synthetic visuals, eroding trust in authentic journalism and amplifying Kremlin narratives. The sophisticated use of generative AI and automation enabled unprecedented speed, reach, and content variability, evading traditional detection tactics and spreading misinformation at scale. This incident highlights an accelerating trend: threat actors and nation-state proxies are operationalizing generative AI for influence campaigns, making synthetic media and coordinated digital manipulation a top concern for governments, enterprises, and critical infrastructure organizations worldwide.
8 months ago
Kill Chain
AI Deepfake Fraud Strikes US Government Officials in 2024
In 2024, a surge of highly convincing AI-assisted fraud scams targeted prominent U.S. government officials and public figures, exploiting advanced voice and video synthesis technologies to impersonate them. Unknown threat actors used deepfake audio and video to contact senators, governors, and business leaders—at times successfully deceiving recipients into believing they were communicating with senior officials such as the White House Chief of Staff or the Secretary of State. This wave of sophisticated impersonation included fraudulent calls, texts, and deepfake media, causing reputational and operational risks, and prompting federal investigations as well as public warnings from affected parties. This series of attacks underscores the accelerating trend of criminals leveraging generative AI for social engineering and impersonation. The incident has provoked legislative response, highlighted by the AI Fraud Deterrence Act, driving new regulatory focus to combat emerging AI threats and mitigate associated risks to governments and the public.
8 months ago
Kill Chain
CISA Warns: Surge in Spyware Targeting Messaging Apps (2024)
In June 2024, the Cybersecurity and Infrastructure Security Agency (CISA) issued a critical alert about threat actors leveraging commercial spyware to infiltrate messaging applications. Attackers have used sophisticated social engineering and mimicry of trusted messaging apps to deploy Android spyware—sometimes via malicious image files shared through platforms like WhatsApp—or by exploiting vulnerabilities in applications such as Signal, especially targeting Samsung devices. The primary victims are high-value individuals, including government, military, and political officials, as well as civil society members, with attacks observed across the United States, the Middle East, and Europe. These threats enable threat actors to gain unauthorized device access and deploy further malicious payloads, jeopardizing personal and organizational data. CISA’s latest alert underscores a sharp escalation in opportunistic spyware attacks, using new delivery vectors such as malicious QR codes and zero-click exploits. The advisory highlights the urgent need for preventative security hygiene, particularly as attackers increasingly aim at mobile messaging platforms used by sensitive sectors.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports