APT  2026  2025  2024  2023  2022  2021  2020  2018 2017 2016 2015

H  AI  APT  Attack  BigBrothers  BotNet  Congress  Cryptocurrency  Cyber  CyberCrime  Exploit  Hack  ICS  Incindent  IoT  IT  Mobil  OS  Phishing  Ransom  Safety  Security  Social  Spam  Virus  Vulnerebility

DATE		NAME	INFO	CATEGORIE	WEB
2.10.26		Gotta breach 'em all! The journey of ShinyHunters	ShinyHunters has outlasted forum takedowns, multiple arrests, and its own founders' convictions. This report traces six years of activity and tactical evolution. From stolen S3 buckets to zero-day exploits, we attempted to explain why the brand keeps surviving what should have ended it.	APT	SEKOIA
29.9.26		Russian and Allied Government Systems Compromised in Targeted Campaigns	Russian and Allied Government Systems Compromised in Targeted Campaigns Three exposed operator workspaces reveal confirmed access to Russian and Kyrgyz government systems, a Syrian Customs C2 inventory, stolen data and wider targeting of Russian state and industrial organisations.	APT	Ctrl-Alt-Intel
19.9.26		Handala Threat Group Tactics, Targets, and Attack Timeline	Handala is an Iranian-linked hacktivist group active since late 2023, operating under a pro-Palestinian agenda and targeting Israeli, U.S., and regional infrastructure.	APT	PICUS
16.9.26		NightEagle targets Russian companies	Over the past year, our Global Emergency Response Team (GERT) has investigated several incidents involving the NightEagle group (APT-Q-95). This group has been active since at least 2023 and originally focused on organizations in Asia, as we reported previously. We have now identified attacks by the group targeting businesses in Russia. This post examines both known and new tools NightEagle used in its latest campaign.	APT	SECURELIST
4.9.26		Angry Birds: Toy Ghouls’ new toys	We continue tracking the activity of Toy Ghouls (also known as Bearlyfy, Laboo.boo, and Feral Wolf), a financially motivated group that has been targeting Russian organizations since 2025. The attackers initially relied exclusively on tools pulled from public GitHub repositories along with leaked Babuk and LockBit ransomware builders, later shifting to their own custom ransomware, GenieLocker. In early July 2026, we observed the group using a custom backdoor for the first time.	APT	SECURELIST
2.9.26		Fire Ant Evolves: From Hypervisors to Trusted Infrastructure	First reported in 2025, Fire Ant remained active into 2026. Explore how the threat actor expanded beyond hypervisors into trusted infrastructure, compromising routers, authentication systems, and Linux management hosts to maintain covert access, collect credentials and traffic, and reach connected high-value environments.	APT	SYGNIA
13.8.26		Armored Likho expands its cyber-espionage toolkit	In May 2026, we discovered a new cyber-espionage campaign by the Armored Likho group, also known as Eagle Werewolf, that targets private individuals and organizations across various industries in Russia, including major corporations, the public sector, IT, and education. The attackers used a fake app as bait that mimics a service for donations. However, the most interesting part of this campaign isn’t the initial infection method – it’s the malicious implants the attackers use for cyber-espionage.	APT	SECURELIST