LapDogs, PolarEdge, and Volt Typhoon: China-Linked ORB Networks Escalate Espionage Against SOHO and Critical Infrastructure

LapDogs, PolarEdge, and Volt Typhoon represent a new wave of China-linked ORB (Operational Relay Box) networks, each leveraging compromised SOHO routers, IoT devices, and enterprise infrastructure to conduct targeted, persistent espionage. LapDogs, first identified in 2025, uses the "ShortLeash"..

AI-Driven EDR Showdown: Comparative Analysis and Strategic Forecast for US Enterprises in 2026

This analysis delivers a comprehensive, data-driven comparison of the top five Endpoint Detection and Response (EDR) platforms in the US market for 2026: CrowdStrike Falcon, Microsoft Defender for Endpoint, SentinelOne Singularity, Palo Alto Cortex XDR, and Bitdefender GravityZone.

Predatory Sparrow: Pro-Israel Hacktivist Group’s Destructive Cyber Operations Against Iranian Critical Infrastructure

Predatory Sparrow (Gonjeshke Darande) is a pro-Israel hacktivist group, likely state-affiliated, that has escalated destructive cyber operations against Iranian critical infrastructure since the early 2020s. Their attacks—most recently the June 2025 disruption of Bank Sepah—employ ransomware...

Iranian Cyber Operations 2025: Escalation, Ransomware Collaboration, and Critical Infrastructure Targeting

Iranian cyber threat actors have evolved into highly capable, multi-motivated operators, leveraging both state sponsorship and ransomware affiliate partnerships to conduct espionage, sabotage, and financially motivated attacks. In 2025, the Iran-Israel conflict has catalyzed a surge in..

Stealth Falcon’s Zero-Day Offensive, OilRig’s Supply Chain Escalation, and the Evolving Middle Eastern APT Landscape

Stealth Falcon, OilRig, Molerats, and Dark Caracal represent the most active and sophisticated Middle Eastern APT groups, each aligned with state or political interests and employing advanced tactics for espionage, surveillance, and disruption. Stealth Falcon’s exploitation of CVE-2025-33053..

BADBOX 2.0: Global Supply Chain Botnet Targeting Off-Brand Android Devices and Home Networks

BADBOX 2.0 represents a significant escalation in global supply chain cyber threats, infecting over 1 million off-brand AOSP devices—including TVs, smartphones, tablets, and car infotainment systems—via pre-installed firmware backdoors and malicious apps.

Sandworm’s Evolving Playbook: Destructive Malware, BadPilot Subgroup, and the Escalating Threat to Global Critical Infrastructure

Sandworm, a Russian GRU-affiliated cyber threat group (Unit 74455), continues to escalate its offensive cyber operations, with a primary focus on Ukraine and Western allies. The group is notorious for high-impact attacks such as the 2015-2016 Ukrainian power grid blackouts...

VenomRAT: Multi-Stage Phishing, Cloud C2, and Modular Malware in Financial and IT Sector Attacks

VenomRAT, first observed in 2020 as a fork of Quasar RAT, has evolved into a modular, service-based remote access trojan with advanced keylogging, stealth, and evasion capabilities. It is distributed primarily through phishing campaigns and fake antivirus websites (notably Bitdefender clones)...

Void Blizzard: Russian State-Backed Cloud Espionage, AitM Phishing, and LOTL Tactics Targeting NATO and Allies

Void Blizzard, a Russian state-sponsored APT attributed to the GRU and tracked as Laundry Bear by Dutch intelligence, has rapidly emerged as a major cyber espionage threat since April 2024. The group targets government, defense, telecommunications, NGOs, and critical infrastructure across NATO...

Venom Spider’s Polymorphic More_eggs: Advanced HR-Targeted Intrusions and Evasion Tactics

Venom Spider (TA4557) is a financially motivated cybercriminal group specializing in spear-phishing campaigns against HR professionals, primarily in the U.S., U.K., Canada, Australia, and Germany. Their attacks exploit the HR function’s need to process external attachments..

Bumblebee Malware Supply Chain Attack: RVTools Compromise, Evolving Tactics, and Strategic Defenses

Bumblebee malware has escalated its tactics by compromising the supply chain of RVTools, a widely used VMware utility, to deliver trojanized installers containing a malicious version.dll loader. This attack, detected in May 2025, distributed malware via both official and typosquatted domains..

DragonForce Ransomware: BYOVD Weaponization, Affiliate Expansion, and EDR Evasion in 2025

DragonForce has rapidly evolved into a major RaaS operation, distinguished by its sophisticated use of BYOVD techniques to bypass EDR and escalate privileges. The group’s modular ransomware builder allows affiliates to select vulnerable drivers (notably TrueSight.sys, RentDrv.sys) for process ter...

russia

LOSTKEYS: COLDRIVER’s Next-Gen Social Engineering Malware and the Evolution of Russian State Espionage Tactics

LOSTKEYS, first observed in early 2025, marks a significant evolution in Russian cyber-espionage, attributed to the FSB-backed COLDRIVER group. Unlike traditional spear-phishing, LOSTKEYS employs a sophisticated multi-stage infection chain initiated by fake CAPTCHA lure websites (ClickFix)...

gunra

Gunra Ransomware: Conti-Derived Double-Extortion Threat Targeting Global Critical Sectors

Gunra ransomware is a newly emerged, highly sophisticated double-extortion threat, first detected in April 2025 and attributed to a financially motivated group leveraging the Conti ransomware codebase. It targets Windows environments...

golden-chickn

Golden Chickens’ Modular MaaS: TerraStealerV2, TerraLogger, and the Evolving Threat to Financial and Recruitment Sectors

Golden Chickens (aka Venom Spider) is a financially motivated Eastern European threat actor operating a modular malware-as-a-service (MaaS) platform since at least 2017..

wizards

TheWizards APT: IPv6 SLAAC Spoofing, Spellbinder Malware, and Advanced Lateral Movement in Asia and the Middle East

TheWizards is a China-aligned APT group, active since at least 2022, specializing in espionage and influence operations across Asia and the Middle East. Their hallmark is the use of IPv6 SLAAC spoofing to hijack legitimate software update mechanisms—most notably Tencent QQ..

purplehaze

PurpleHaze’s Dynamic ORB Networks: Advanced Tactics, Detection Challenges, and Mitigation Strategies

PurpleHaze, an emerging Chinese state-sponsored threat group, operates highly dynamic multi-hop ORB networks that blend compromised IoT devices (notably SOHO routers with vulnerable firmware) and provisioned VPS to obscure command-and-control (C2) infrastructure.

dprk

DPRK's Evolving Cyber Arsenal: Overlapping Malware, Supply Chain Attacks, and Social Engineering in Cryptocurrency and Developer Sectors

North Korean threat actors Slow Pisces, Alluring Pisces, and Contagious Interview—operating under the Reconnaissance General Bureau—have escalated global cyber operations since 2023, focusing on cryptocurrency theft and espionage. Their campaigns employ advanced social engineering..

lotus-panda

Lotus Panda's Multi-Cloud C2 Evolution: Advanced Espionage Tactics Targeting Southeast Asia

Lotus Panda (aka Lotus Blossom, Spring Dragon, Billbug, Bronze Elgin, Bitterbug) is a Chinese state-sponsored APT group active since at least 2009, specializing in cyber espionage against Southeast Asian governments and critical sectors.

phishing

CryptoChameleon: Multi-Channel Phishing Kit Driving Advanced Credential Theft in Financial and Crypto Sectors

CryptoChameleon is an advanced phishing kit distributed via phishing-as-a-service platforms, enabling rapid, scalable attacks against cryptocurrency users, financial institutions, and related sectors...

spynote

Mobile Malware Threats: SpyNote, BadBazaar, and MOONSHINE

SpyNote, BadBazaar, and MOONSHINE are prominent mobile malware families primarily targeting Android devices.

phishing

Smishing Triad's Global Impact: New Phishing Kits and Expanding Targets

The Smishing Triad, a cybercriminal group, is leveraging advanced smishing techniques to deceive victims by impersonating legitimate organizations. They exploit platforms like iMessage using compromised Apple iCloud accounts to send spam messages that bypass traditional filters..

storm-2460

Storm-2460's Exploitation of Windows Zero-Day: Threat Actor similarity in focus.

Storm-2460, a cyber threat group, is actively exploiting a zero-day vulnerability (CVE-2025-29824) in the Windows Common Log File System (CLFS), primarily targeting the finance sector and other high-value industries.

crypto

Cryptocurrency Evasion Tactics: The Houthi Network's Strategic Exploitation

The Houthi network, known for its involvement in the Yemeni conflict, has developed intricate operational methods to evade international sanctions and facilitate arms procurement through cryptocurrency...