LATEST

Sednit reloaded: Back in the trenches

The resurgence of one of Russia’s most notorious APT groups

Unmasking an Attack Chain of MuddyWater

Huntress has identified and detailed a full timeline of an intrusion in a customer environment that aligns with what others have identified as MuddyWater (Iranian-linked APT).

The Evolving Linux Threat Landscape

Learn about the narrowing threat gap, the rise of cross-platform attacks (like WSL abuse), and the specific ransomware and nation-state actors targeting Linux endpoints in 2026.

Operation Olalampo: Inside MuddyWater’s Latest Campaign

MuddyWater APT has launched a new cyber offensive operation, dubbed Operation Olalampo, deploying new malware variants and leveraging Telegram bots for command-and-control. Analysis of the campaign provides a glimpse into the group’s post-exploitation tactics, which largely align with their historical operations.

LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan

ESET researchers discovered a China-aligned APT group, LongNosedGoblin, which uses Group Policy to deploy cyberespionage tools across networks of governmental institutions

Unmasking MuddyWater’s New Malware Toolkit Driving International Espionage

Group-IB Threat Intelligence has uncovered a sophisticated phishing campaign, attributed with high confidence to the Advanced Persistent Threat (APT) MuddyWater. The attack used a compromised mailbox to distribute Phoenix backdoor malware to international organizations and across the whole Middle East and North Africa region, targeting more than 100 government entities.

Agneyastra to the Rescue: Protecting your Firebase Projects before the Tea spills out!

In July 2025, the Tea app 🔗, a mental health and social community platform, experienced a devastating breach that spilled 72,000 images (including 13,000 driver’s license and verification selfies) and over 1.1 million private direct messages onto the internet. The leaks first surfaced on 4chan and quickly spread across forums, torrents, and underground channels. This was not “just another API key leak.” Instead, it was a story about Firebase misconfigurations, poor data retention practices, an…

Hunt for RedCurl | Huntress

Huntress discovered RedCurl activity across several organizations in Canada going back to 2023. Learn more about how this APT operates and how they aim to remain undetected while exfiltrating sensitive data.

Stealthy Attributes of Lazarus APT Group: Evading Detection with Extended Attributes

APT Lazarus: Eager Crypto Beavers, Video calls and Games

Explore the growing threats posed by the Lazarus Group's financially-driven campaign against developers. We will examine their recent Python scripts, including the CivetQ and BeaverTail malware variants, along with their updated versions in Windows and Python releases. Additionally, we will analyze their tactics, techniques, and indicators of compromise.

APT Targeting Vietnamese Human Rights Defenders | Huntress

Huntress identified an intrusion against a non-profit supporting Vietnamese human rights that’s likely spanned years. Jump in as we provide a thorough analysis of this malicious threat actor.

Operation Triangulation: Mapping the threat

What we know about APT campaign to date and how to detect it

Dark Pink. Episode 2

APT Dark Pink is back with 5 victims in new countries.

The distinctive rattle of APT SideWinder

Bridewell and Group-IB expose the APT’s unknown infrastructure

Nice Try Tonto Team

How a nation-state APT attempted to attack Group-IB

Dark Pink

New APT hitting Asia-Pacific, Europe that goes deeper and darker

Financially motivated, dangerously activated: OPERA1ER APT in Africa

The French-speaking gang managed to carry out over 30 successful attacks on banks, financial services and telecommunications companies, mainly located in Africa.

APT41 World Tour 2021 on a tight schedule

4 malicious campaigns, 13 confirmed victims, and a new wave of Cobalt Strike infections

SideWinder.AntiBot.Script

APT SideWinder’s new tool that narrows their reach to Pakistan

Targeted APT Activity: BABYSHARK Is Out for Blood | Huntress

We discovered malicious, targeted advanced persistent threat (APT) activity on a partner's system. Here, we dive into the BABYSHARK malware strain.

The Art of Cyberwarfare

Chinese APTs attack Russia

Big airline heist

APT41 likely behind a third-party attack on Air India

LAZARUS ARISEN

Group-IB reveals the unknown details of attacks from one of the most notorious APT groups: sophisticated espionage and APT techniques of the North Korean state-sponsored hackers