Q3 2026 Email Threat Landscape Shows Rise in Phishing Attacks
Microsoft Threat Intelligence reports a notable increase in phishing emails during Q3 2026 with new techniques such as CAPTCHA-gated phishing and business domain spoofing.
Category
Threat Actor
85 published analyses.
APT29 Hacks Web Analytics to Deliver iOS and Android Exploits
APT29 is conducting a large-scale watering hole campaign targeting iOS and Android users via compromised websites and a supply chain attack involving the Ukrainian Plerdy SEO Tracker, injecting JavaScript to collect device data and deliver exploits.
Government Linux Servers Targeted by SysGoRAT and AI-Generated Scripts
A state-linked cyber espionage campaign targeting government Linux servers from October 2025 to April 2026 leverages SysGoRAT malware and likely AI-generated scripts.
Chinese Hackers Use AI-Powered ARTEX to Target 200+ Global Organizations
China-based Vapor Panda leverages AI-powered ARTEX tool in coordinated attacks on over 200 global high-value targets, highlighting advanced state-sponsored cyber threat activity.
Examining ESC1 & ESC8: Help Desk Impersonation to AD CS Abuse
New intrusion paths ESC1 and ESC8 reveal attackers leveraging help desk impersonation for remote access, runtime code execution, and Certificate Services abuse through authentication relay and Kerberos techniques.
UAT-11473 APT Exploits Cisco SD-WAN to Deploy KeyDrift Malware
Talos identified UAT-11473 exploiting an authentication bypass in Cisco SD-WAN Catalyst Controllers to deploy KeyDrift malware, posing a significant threat to enterprise SD-WAN environments.
Volt Typhoon uses 'Silent Train' to mask zero-day attacks
Chinese state-sponsored group Volt Typhoon employs a novel 'Silent Train' framework using rotating chains of compromised devices to conduct zero-day attacks on high-value targets, complicating detection.
Lazarus Group Uses South Korean Security Software to Deploy Malware
The Lazarus Group has conducted Operation FlashHole targeting South Korean firms using post-quantum encryption to deploy malware.
Gheist Campaign Steals GitHub Secrets via Stolen Tokens and Actions Logs
The Gheist group exploits stolen GitHub tokens to extract private repository secrets from GitHub Actions logs, impacting private and Enterprise GitHub environments.
BlackX UEFI Bootkit Targets Central Asian Diplomats via Secure Boot Bypass
The BlackX UEFI bootkit, linked to the China-backed APT41 group, targets diplomatic organizations in Central Asia by bypassing Secure Boot on updated Windows systems.
Russia-Linked Hackers Deploy New Mesh Network Backdoor in Ukraine Attack
Russian state-sponsored group Sandworm and a partner used a novel mesh network backdoor in a destructive wiping attack against a Ukrainian logistics firm in 2025, exploiting spear-phishing for initial access.
INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks
INTERPOL coordinated the arrest of 1,462 suspects and disrupted over 10,900 cybercrime networks in a global operation targeting organized cybercrime.
China-Aligned Bronze Sandcastle Uses Sandboxie DLL Sideloading for Backdoors
Researchers reveal that the China-aligned threat group Bronze Sandcastle has exploited Sandboxie DLL sideloading to deploy stealthy backdoors in organizations across Asia and Africa since mid-2025.
Nation-State Leveraging AI for Large-Scale Supply Chain Attack
Nation-state actor Storm-0940 used ARTEX agentic AI to accelerate a supply chain attack on ConnectWise, compromising Microsoft 365 credentials in an AI-driven campaign.
UAT-11985 Targets Taiwan Research with Google AitM Phishing via Fake Invites
APT group UAT-11985 uses fake event invites in spear phishing attacks against Taiwan research targets to deploy an adversary-in-the-middle phishing framework targeting Google credentials and MFA codes.
Flax Typhoon Exploits Five Flaws Ahead of CISA October 11 Deadline
CISA has listed five vulnerabilities exploited by the China-linked Flax Typhoon group, including a critical ProFTPD flaw, with a compliance deadline of October 11 for federal agencies.
Chinese State-linked Hackers Use Automated Tools and Manual Exploits to Steal Data
Chinese government-linked threat actors exploit Microsoft Exchange vulnerabilities using automated scanning and manual methods to steal data from global targets including US critical infrastructure.
UAC-0099 Deploys ASHVEIN RAT Targeting Ukrainian Government Staff
The Russia-aligned threat actor UAC-0099 is deploying the ASHVEIN RAT, a .NET infostealer, against Ukrainian government personnel using obfuscated commands in HTML, indicating an evolving espionage effort.
China-Aligned TA419 Targets U.S. AI Policy Experts with Microsoft AitM Phishing
China-linked group TA419 uses Microsoft Account-in-the-Middle phishing to target U.S. AI policy experts at think tanks, universities, and legal organizations.
China-linked UAT-11587 targets Asian governments with Antino backdoor
Cisco Talos identified UAT-11587, a China-linked threat actor leveraging a new Antino backdoor to target government and policy organizations in Taiwan, India, the Philippines, and Cambodia.
Star Blizzard advances phishing and malware with RedFlick technique
Since early 2026, Microsoft has tracked Russian state actor Star Blizzard using enhanced phishing and a new malware delivery method called RedFlick, improving their evasion capabilities.
Storm-3168: Agentic Cloud Attacks Using Compromised Service Principals
Microsoft details Storm-3168's use of compromised Azure service principals for reconnaissance, resource deletion, and credential theft, posing significant cloud security risks.
Bitget Loses $351.6M in Suspected North Korean Hack
Bitget suffered a theft of $351.6 million from its hot and warm wallets following a backend compromise linked to suspected North Korean hackers, while its cold wallets remain secure.
Tracking Storm-2570's Consistent Ransomware Tradecraft
Storm-2570 is a ransomware affiliate using consistent tools and techniques across multiple ransomware operations, posing detection and disruption challenges.
Contagious Interview Campaign Hits 30K Devices, Steals $10.7M Crypto
North Korean hackers behind the Contagious Interview campaign compromised over 30,000 devices worldwide, targeting crypto specialists and web designers to steal $10.7 million from more than 7,000 cryptocurrency wallets.
North Korean WaterPlum Hackers Infiltrate 30,000 Devices Worldwide
The North Korean group WaterPlum compromised over 30,000 devices worldwide, stealing more than $10.7 million in cryptocurrency between December 2025 and July 2026.
Transparent Tribe Deploys New Rust Backdoor Targeting South Asia
The Pakistan-aligned threat group Transparent Tribe (APT36) has launched cyber attacks using new Rust-based backdoors and private GitHub command and control, targeting government and defense sectors in India and Afghanistan.
Iranian Hackers Deploy CHOSEN BRICK Malware to Target Activists
Iranian state-linked hackers are using the CHOSEN BRICK Windows malware to conduct surveillance on activists, dissidents, and journalists worldwide, enabling persistent spying and data collection.
Iranian Hackers Deploy Telegram-Controlled Malware Against Dissidents
US, UK, and Dutch agencies report Iran's intelligence uses Windows malware controlled via Telegram to spy on dissidents and journalists globally, targeting sensitive communications and recordings.
Hackers Target Exposed Vite Servers to Steal AWS and Azure Secrets
A mass-scanning campaign targets internet-exposed Vite development servers to steal cloud credentials linked to AWS and Azure environments.
Red Heron Exploits Gitea RCE to Compromise 13 Organizations Globally
The state-sponsored threat actor Red Heron exploited a remote code execution vulnerability in Gitea to compromise 13 organizations across six countries in a rapid, targeted campaign.
Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts
Microsoft disclosed campaigns where attackers exploited third-party email systems for large-scale financial scam phishing and used passkey-themed social engineering techniques to compromise cloud accounts.
Russian Hackers Use AI to Rebuild Malware Faster After Detection
Anthropic has disrupted a Russian state-sponsored threat actor's campaign that used AI to accelerate malware redevelopment and evade detection, marking an evolution in cyber espionage.
China-Linked UNC3569 Exploits Sogou Input Method Flaw for GRAYRABBIT Backdoor
The China-linked threat group UNC3569 exploited a vulnerability in Sogou Input Method on Windows to deploy the GRAYRABBIT backdoor, allowing attackers full control of the affected user's machine.
AI-driven attack exploits PaperCut flaws to breach 395 organizations
A Russian-speaking threat actor used hundreds of AI agents to exploit vulnerabilities in PaperCut NG/MF servers, compromising 395 organizations worldwide and highlighting the operational risks of AI-driven cyberattacks.
Four Spy Groups Deploy BlueMoon Exploit Kit Targeting Chrome and Windows
Four espionage-linked threat groups use the BlueMoon exploit kit to chain Chrome and Windows vulnerabilities, with initial in-the-wild activity linked to APT31.
Passkey-themed Social Engineering Enables Identity and Cloud Compromise
Attackers exploit passkey-themed social engineering to bypass MFA and leverage Microsoft Graph for access to SharePoint, OneDrive, and email data, impacting cloud and identity security.
Attackers Use Invisible Unicode Characters to Bypass Email Filters
Threat actors use invisible Unicode characters in phishing emails to evade detection by security filters, complicating phishing identification.
US Charges Russian for Malware Campaign Targeting 80,000 Freelancers
A Russian national has been indicted in the US for a phishing campaign that infected 80,000 freelancers with TVRAT and DarkVNC malware, representing significant cybercrime against remote workers.
Iranian Hackers Use Coding Tests to Deliver Cross-Platform RATs
The Iranian group Nimbus Manticore uses recruiter-themed coding tests to distribute Node.js and JavaScript remote access Trojans on Linux and macOS platforms, as reported by Kaspersky.
China-Linked Fire Ant Targets Cisco Routers to Steal Credentials
The China-linked Fire Ant group has compromised Cisco IOS XR routers, TACACS servers, and Linux hosts to steal credentials and disable security logs, targeting critical network infrastructure.
Australia Arrests Suspected TeamPCP Hackers Behind Supply Chain Attacks
Australian authorities arrested two men linked to the TeamPCP group known for extensive developer supply chain attacks, disrupting a significant threat actor.
FBI Disrupts China-Linked QTFY Platforms Targeting U.S. Infrastructure
The FBI disrupted two hacking platforms, QScan and QTRouter, linked to the Chinese state-sponsored group QTFY targeting critical U.S. infrastructure.
Nimbus Manticore Expands Toolset With New Backdoor and SSH Tunneler
Researchers identified new malware and infrastructure linked to the Iranian state-sponsored group Nimbus Manticore, increasing cyber espionage risks.
US Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches
The US Department of the Treasury imposed sanctions on Iranian cyber actors involved in attacks targeting critical infrastructure to disrupt their financial networks.
UAT-10147 Uses AI to Scale Server Attacks and Deploys Advanced Linux Rootkit
The Chinese-speaking cybercrime group UAT-10147 leverages AI to launch scaled attacks on Windows and Linux web servers worldwide and deploys advanced tools including the SPECTRE EDR bypass and Linux rootkit.
Suspected Russian Hackers Exploit Google OAuth and WhatsApp for Account Hijacking
Three Russian cyber espionage clusters abuse Google OAuth flows and WhatsApp linking to hijack accounts in high-value sectors across Europe and the U.S.
SilkParasite Espionage Targets Central Asian Governments with Five New RATs
SilkParasite, a newly uncovered cyber espionage campaign, targets Central Asian government bodies using seven remote access tools, five of which are previously undocumented, highlighting evolving advanced threats in the region.
Hackers Arrested for €30M Bank Fraud via Service Provider Flaw
Cybercriminals exploited a service provider vulnerability to steal over €30 million from Commerzbank customers, leading to arrests in Brazil and Europe.
Jewelbug Hackers Breach Govt Webmail While Conducting Crypto Fraud
The Jewelbug hacker group has breached government and military webmail accounts while simultaneously conducting cryptocurrency fraud, illustrating a dual-threat approach involving cyber espionage and financial crime.
Lazarus Group Exploits Windows Zero-Day to Deploy New Backdoor
North Korea's Lazarus Group exploited a recently patched Windows zero-day to deploy a new backdoor targeting defense and aerospace firms as part of Operation Dream Job.
Sandworm-Linked Group Uses Fake Job Interviews to Deploy Malware
CERT-UA reports Sandworm subgroup UAC-0145 targets Ukrainian IT workers with fake job interviews to deploy malware via a malicious VPN tool.
Kimsuky Develops Offline AI Stack to Enhance Phishing and Malware
North Korea’s APT group Kimsuky has implemented an offline AI infrastructure that advances their phishing tactics and automates malware development by integrating AI with internal document search and malware creation tools.
UNC6671 Vishing Attacks Target Employees’ Personal Phones for SaaS Data
Data extortion group UNC6671 is using vishing attacks to impersonate IT help desk staff and steal SaaS credentials from employees' personal phones in financial and professional services sectors.
Microsoft 365 AitM Phishing Campaign Targets Payroll and Finance Emails
A widespread phishing campaign uses adversary-in-the-middle techniques to compromise Microsoft 365 accounts and target payroll and finance emails.
Chinese-Speaking Hackers Target Central Asian Governments Using OctLurk, SilkLurk
A suspected Chinese-speaking threat actor has targeted Central Asian government organizations with OctLurk and SilkLurk malware since January 2025, impacting healthcare, research, and government sectors.
Midnight Blizzard's CaptiveCrunch targets travelers with malware and credential theft
The Russian threat group Midnight Blizzard's Storm-2945 sub-cluster has compromised hospitality sign-in portals worldwide since May 2026, delivering malware and stealing traveler credentials.
Amazon Attributes Debug and Chalk NPM Supply Chain Attacks to North Korean Hackers
Amazon attributes multiple supply chain attacks on the Debug and Chalk npm packages to North Korean state-sponsored hackers, exposing risks to open-source software security.
DPRK-Linked macOS Malvertising Uses Fake Updates to Steal Crypto
North Korean threat actors have launched a sophisticated macOS malvertising campaign using fake update prompts to deliver crypto-stealing malware as part of the ongoing Contagious Interview operation.
Coordinated Cyberattack Disrupts 30+ Minnesota Water Systems
A coordinated cyberattack targeted operational technology at over 30 Minnesota community water systems in late July, causing outages and communication disruptions.
Nimbus Manticore Uses NightLedger Backdoor to Target Middle East, Africa, Asia
Iranian state-backed group Nimbus Manticore deploys NightLedger backdoor and custom WebSocket tunnelers in attacks across the Middle East, Africa, and South Asia, enhancing stealth and covert activity.
Cl0p Affiliates Exploit PTC Windchill and FlexPLM with Unauthenticated RCE
Cl0p ransomware affiliates exploit unauthenticated remote code execution vulnerabilities in internet-facing PTC Windchill and FlexPLM systems to conduct data extortion campaigns.
BlueNoroff Uses Zoom Phishing Kit to Profile Crypto Wallets Before Malware
North Korean group BlueNoroff uses a phishing kit impersonating Zoom and Microsoft Teams to profile cryptocurrency wallets and deliver malware via social engineering.
Hackers Hijack Hotel Wi-Fi DNS to Steal Microsoft 365 Accounts
Attackers manipulate DNS settings on hotel and conference center Wi-Fi to redirect users to fraudulent Microsoft 365 login pages, targeting credential theft from business travelers.
Russian Hackers Exploit Zimbra Zero-Click Flaw for Email Theft
CISA warns that Russian state-sponsored group Laundry Bear is exploiting a patched Zimbra zero-click vulnerability combined with phishing to steal emails from enterprise Zimbra Collaboration servers.
Russian Intelligence Hacks IP Cameras to Monitor NATO & Ukraine Military Movements
Russian intelligence services compromise internet-connected security cameras across Europe and Ukraine to gather military logistics intelligence, as reported by the Netherlands' AIVD and MIVD.
Hackers Abuse ViPNet Updates to Target Russian Government Agencies
An advanced threat actor exploits the update mechanism of ViPNet private networking software to attack Russian government agencies, illustrating ongoing espionage.
North Korean Hackers Use Steganography in Fake Coding Tests to Deliver Malware
North Korean threat actors linked to the Contagious Interview campaign employ steganography within SVG flag images in fake coding challenges to deliver multi-stage OTTERCOOKIE-aligned malware.
US Charges Russian Operators of Bulletproof Hosting for Ransomware Gangs
US prosecutors charged three Russian nationals for operating a bulletproof hosting service that enabled ransomware gangs causing over $62 million in damages globally.
Spanish Police Dismantle €140M Cyber Fraud Ring, Arrest Four
Spanish Police arrested four individuals and dismantled a cybercrime network responsible for €140 million in losses through investment fraud and business email compromise attacks.
EU and UK Sanction Russian GRU Hackers Over Cyberattacks
The EU and UK have imposed joint sanctions on Russian individuals and entities linked to the GRU for orchestrating widespread cyberattacks across Europe, marking the first coordinated cyber sanction package targeting Russian state-sponsored hackers.
Russian FSB Exploits Vulnerable Routers in Critical Infrastructure Sectors
Russian state-sponsored hackers from FSB Center 16 are exploiting poorly configured routers in critical infrastructure worldwide, heightening operational risks.
ShinyHunters abuses OAuth in SaaS apps: Microsoft issues alert
Microsoft Threat Intelligence uncovered ShinyHunters abusing OAuth in SaaS applications through vishing, supply chain attacks, and guest access misconfigurations, exposing new SaaS security risks.
Hackers Exploit Balochistan Police Portal in Multi-Group Espionage
Researchers reveal cyber espionage targeting Pakistani law enforcement by suspected China- and India-aligned groups between 2024 and 2026, compromising police servers with critical data.
Attackers Use Dormant GitHub Accounts to Map Corporate Orgs
Datadog Security Labs warns of campaigns using dormant GitHub accounts and compromised OAuth tokens to scrape corporate GitHub organizations and user data through the GitHub API. Attackers automate scraping with custom or legitimate-sounding user agents to blend in and avoid detection.
Hackers Use Fake Microsoft Entra Passkey Enrollment to Target M365 Users
A threat actor known as O-UNC-066 is using a phishing kit to exploit Microsoft 365 users via fake Entra passkey enrollment requests, aiming at data extortion. This tactic spans multiple industry sectors and involves voice-based social engineering.
China-linked Hackers Exploit Roundcube Flaw to Target Academic Researchers
A China-linked threat actor is exploiting a vulnerability in Roundcube webmail servers at U.S. and Canadian universities to steal credentials and deploy backdoor malware. This campaign specifically targets academic researchers to gather intelligence.
China-Linked UAT-7810 Expands ORB Network with New LONGLEASH Malware
The Chinese APT actor UAT-7810 is enhancing its ORB network via a new LONGLEASH malware targeting internet-facing networking devices, according to Cisco Talos. This campaign builds on the previously identified LapDogs ORB infrastructure active since mid-2025.
China-Linked Hackers Use Fake Indian Tax Tool to Deploy DcRAT
A China-nexus threat group is targeting Indian taxpayers and finance teams with spear-phishing emails impersonating the Income Tax Department to deploy DcRAT, a remote access trojan. This multi-stage campaign aims to steal sensitive data from compromised systems.
Iran-Linked Hackers Deploy New Cavern C2 Framework Against Israeli Targets
An Iran-linked hacker group associated with MOIS has started using a new modular command-and-control framework called Cavern to target Israeli IT providers and government organizations. This activity has been tracked by Check Point Research and highlights evolving state-sponsored cyber threats.
North Korean Hackers Deploy 108 Malicious Packages in PolinRider Campaign
North Korean hackers linked to the Contagious Interview campaign have published 108 malicious packages and browser extensions across multiple platforms as part of their ongoing PolinRider operation. These malicious artifacts are being actively distributed via compromised maintainer accounts on npm, Packagist, Go, and Chrome Web Store.
Mustang Panda Uses Zoho WorkDrive in Attacks on Indian Government
The China-aligned Mustang Panda group has launched campaigns targeting Indian government networks and hydropower infrastructure using new malware and Zoho WorkDrive as a command channel. Acronis researchers detected active compromises including high-level administrative systems.
FBI: Russian Hackers Target Signal Backup Recovery Keys
The FBI and CISA warn of a phishing campaign by Russian intelligence targeting Signal users to steal backup recovery keys, giving attackers access to historical messages. This represents a significant escalation in targeting secure communications.
Russian Intelligence Used Fake Support Texts to Steal Messaging Credentials
Ukraine and the FBI uncovered a Russian intelligence campaign targeting messaging accounts of officials and activists across Ukraine, Europe, and the U.S. The operation involved fake support texts aimed at stealing sensitive credentials.
Microsoft Links Mastra AI Supply Chain Attack to North Korean Hackers
Microsoft has attributed the recent Mastra AI supply chain attack, compromising over 140 npm packages, to the North Korean group Sapphire Sleet, aka BlueNoroff. This highlights ongoing state-sponsored supply chain risks affecting open source ecosystems.