Operation ALL

Operation ALL 2026() 2025() 2024() 2023() 2022() OTHER() ALL | OPERATION (211)

DATE	NAME	INFO	CATEGORY	SUBCATE
5.7.26	Operation Navy Ghost	Operation Navy Ghost: How Attackers Planted a Telegram-Powered Backdoor Across Fake pyrogram Packages on PyPI	OPERATION	OPERATION
5.7.26	Operation Contagious Interview	The most effective social engineering campaigns don’t rely on obvious red flags or technical exploits. They move through familiar business interactions, like hiring conversations, project discussions, and routine follow-ups that are designed to feel legitimate from the start.	OPERATION	OPERATION
4.7.26	Operation DragonReturn	Authors: Dixit Panchal & Soumen Burma Table of Contents: Introduction: Key Targets: Infection Chain: Initial Findings about Campaign: Initial Mail: Email Attachment: Lure: Official GoI, Income Tax Document: Technical Analysis: Infrastructural Artefacts & Threat actor Attributions. Campaign Timeline.	OPERATION	OPERATION
27.6.26	Operation DragonReturn	Authors: Dixit Panchal & Soumen Burma Table of Contents: Introduction: Key Targets: Infection Chain: Initial Findings about Campaign: Initial Mail: Email Attachment: Lure: Official GoI, Income Tax Document: Technical Analysis: Infrastructural Artefacts & Threat actor Attributions. Campaign Timeline. Conclusion:...	OPERATION	OPERATION
24.6.26	Dismantling FortiBleed	Inside a Russian Fortinet compromise operation.	OPERATION	OPERATION
20.6.26	Operation FanTrap	Operation FanTrap reveals FIFA 2026 fraud ecosystem with 4,000+ fake domains, phishing, streaming scams, and dark web-driven cybercrime activity.	OPERATION	OPERATION
18.6.26	Operation Poisson	Cato CTRL™ Threat Research: Operation Poisson – Analyzing a Cybercriminal’s Entire Operation	OPERATION	OPERATION
13.6.26	Operation Highland	Velvet Ant’s Operation Highland: How a China-Nexus Actor Infiltrated an Internal Network Undetected	OPERATION	OPERATION
12.6.26	Phantom Mantis Operation	Phantom Mantis, initially known as ArmCorp, is a financially motivated threat group active since March 2025. The group conducts intrusions for extortion and is led by a Russian-speaking criminal tracked as LARVA-368.	OPERATION	OPERATION
4.6.26	Operation FlutterBridge	Operation FlutterBridge: macOS Malvertising Campaign Spreads New FlutterShell Backdoor	OPERATION	OPERATION
30.5.26	Operation Dragon Weave	Contents Introduction Key Targets Industries Affected Geographical focus Infection Chain Initial Findings Looking into the Decoy Document Technical Analysis Stage 1 – Initial Delivery Path A: LNK-Based Execution Path B: Executable-Based Delivery Stage 2 – Script-Based Dropper Chain Stage...	OPERATION	OPERATION
30.5.26	Operation XENOFISCAL	Authors: Dixit Panchal & Vaibhav Krushna Billade Table of Contents: Introduction: Key Targets: Infection Chain: Initial Findings about Campaign: Analysis of Decoy: Technical Analysis: Stage 1: Analysis of LNK File. Stage 2: Analysis of HTA/JavaScript Payload Stage 3: Analysis...	OPERATION	OPERATION
26.5.26	Nimbus Manticore Operations	The Iranian, IRGC affiliated, threat actor Nimbus Manticore resurfaced during Operation Epic Fury, the US military campaign against Iran launched on February 28, 2026, demonstrating newly adopted techniques and enhanced capabilities.	OPERATION	OPERATIONS
23.5.26	Operation Dragon Whistle	Table of Contents: Introduction: Key Targets: Infection Chain: Initial Findings about Campaign: Analysis of Decoys & Spear phishing Email: Technical Analysis: Stage1: Analysis of LNK File. Stage2: Analysis of VBS. Stage3: DLL Side Loading. Infrastructural Artefacts & Threat actor...	OPERATION	OPERATION
13.5.26	Operation NoVoice	Operation NoVoice: Android Malware Found in 50+ Apps Can Hijack Devices	OPERATION	OPERATION
9.5.26	Operation GriefLure	Table of Contents: Introduction: Key Targets: Infection Chain: Initial Findings about Campaign: Analysis of Decoys: Technical Analysis: Campaign-1: Stage-1: Ho so.rar Campaign: 2 Stage-1: download.zip Stage-2: The LNK & Batch file (Common in 1 & 2 both) Stage-3: Analysis	OPERATION	OPERATION
9.5.26	Operation Silent Rotor	Operation Silent Rotor: Targeted Campaign Compromises Unmanned Aviation Sector Ahead of Moscow Summit Table of Content Introduction Key Targets Industries Affected Geographical focus Infection Chain Initial Findings Looking into the Decoy Documents Technical Analysis Stage 1 – Analysis of...	OPERATION	OPERATION
9.5.26	Operation HumanitarianBait	Cyble analyzes Operation HumanitarianBait, a stealthy espionage campaign using aid-themed lures to deploy a fileless Python infostealer.	OPERATION	OPERATION
6.5.26	Iranian-Nexus Operation	Iranian-Nexus Operation Against Oman's Government: 12 Ministries Hit and 26,000 Citizen Records Exposed	OPERATION	OPERATION
25.4.26	Operation TrustTrap	CRIL uncovered 16,800+ spoofed domains by analyzing URL trust abuse, cloud infra clustering, and human‑centric deception instead of technical exploits.	OPERATION	OPERATION
5.4.26	Operation NoVoice	Operation NoVoice: Rootkit Tells No Tales	OPERATION	OPERATION
4.4.26	Operation TrueChaos: 0-Day Exploitation Against Southeast Asian Government Targets	Check Point Research identified a zero-day vulnerability in the TrueConf client application, tracked as CVE-2026-3502, with a CVSS score of 7.8. The flaw stems from the abuse of TrueConf’s updater validation mechanism, allowing an attacker who controls the on-premises TrueConf server to distribute and execute arbitrary files across all connected endpoints.	OPERATION	OPERATION
4.4.26	Operation DualScript – A Multi-Stage PowerShell Malware Campaign Targeting Cryptocurrency and Financial Activity	Operation DualScript – A Multi-Stage PowerShell Malware Campaign Targeting Cryptocurrency and Financial Activity Introduction During our investigation, we identified a multi-stage malware infection leveraging Scheduled Task persistence, VBScript launchers, and PowerShell-based execution. The attack operates through two parallel chains:...	OPERATION	OPERATION
3.4.26	Multi-Tool Mining Operation	Fake Installers to Monero: A Multi-Tool Mining Operation	OPERATION	OPERATION
21.3.26	Operation GhostMail	Contents Introduction Key Targets Industries Affected Geographical focus Geopolitical Context Infection Chain Timeline of Activity Initial Findings Looking into the Decoy Documents Technical Analysis Stage 1 – Malicious Archive Delivery Stage 2 – Malicious Shortcut Execution Stage 3	OPERATION	OPERATION
18.3.26	LeakNet’s	Casting a Wider Net: ClickFix, Deno, and LeakNet’s Scaling Threat	OPERATION	OPERATION
14.3.26	Operation CamelClone: Multi-Region Espionage Campaign Targets Government and Defense Entities Amidst Regional Tensions	Contents Introduction Key Targets Industries Affected Geographical focus Geopolitical Context Infection Chain Timeline of Activity Initial Findings Looking into the Decoy Documents Technical Analysis Stage 1 – Malicious Archive Delivery Stage 2 – Malicious Shortcut Execution Stage 3	OPERATION	OPERATION
5.3.26	Operation Epic Fury/Roaring Lion	Retaliatory Hacktivist DDoS Activity Following Operation Epic Fury/Roaring Lion	OPERATION	OPERATION
24.2.26	Operation MacroMaze	Operation MacroMaze: new APT28 campaign using basic tooling and legit infrastructure	OPERATION	OPERATION
23.2.26	Operation Olalampo	MuddyWater APT has launched a new cyber offensive operation, dubbed Operation Olalampo, deploying new malware variants and leveraging Telegram bots for command-and-control.	OPERATION	OPERATION
3.2.26	Operation Neusploit	APT28 Leverages CVE-2026-21509 in Operation Neusploit	OPERATION	OPERATION
24.1.26	Operation DupeHike	Contents Introduction Key Targets. Industries Affected. Geographical Focus. Infection Chain. Initial Findings. Looking into the decoy-document Technical Analysis Stage 1 – Malicious LNK Script Stage 2 – DUPERUNNER Implant Stage 3 – AdaptixC2 Beacon. Infrastructural Artefacts. Conclusion SEQRITE Protection....	OPERATION	OPERATION
24.1.26	Operation Covert Access	Table of Contents: Introduction: Infection Chain: Targeted sectors: Initial Findings about Campaign: Analysis of Decoy: Technical Analysis: Stage-1: Analysis of Windows Shortcut file (.LNK). Stage-2: Analysis of Batch file. Stage-3: Details analysis of Covert RAT. Conclusion: Seqrite Coverage: IOCs...	OPERATION	OPERATION
24.1.26	Operation Nomad Leopard	Contents Introduction Key Targets Industries Affected Geographical focus Infection Chain. Initial Findings Looking into the decoy-document Technical Analysis Stage 1 – Malicious ISO File Stage 2 – Malicious LNK File Stage 3 – Final Payload: FALSECUB Infrastructure & Attribution...	OPERATION	OPERATION
17.12.25	Operation ForumTroll	Operation ForumTroll continues: Russian political scientists targeted using plagiarism reports	OPERATION	OPERATION
13.12.25	Operation MoneyMount-ISO	Table of Contents: Introduction: Targeted sectors: Initial Findings about Campaign: Analysis of Phishing Mail: Infection Chain: Technical Analysis: Stage-1: Analysis of Malicious ISO file. Stage-2:	OPERATION	OPERATION
13.12.25	Operation FrostBeacon	Operation FrostBeacon: Multi-Cluster Cobalt Strike Campaign Targets Russia Contents Introduction Key Targets Geographical Focus Industries Affected LNK Cluster Initial Access:	OPERATION	OPERATION
6.12.25	Operation DupeHike	Contents Introduction Key Targets. Industries Affected. Geographical Focus. Infection Chain. Initial Findings. Looking into the decoy-document Technical Analysis Stage 1 – Malicious LNK Script Stage 2 –	OPERATION	OPERATION
26.11.25	RomCom payload	Russian RomCom Utilizing SocGholish to Deliver Mythic Agent to U.S. Companies Supporting Ukraine	OPERATION	OPERATION
19.11.25	Operation WrtHug	Operation WrtHug, The Global Espionage Campaign Hiding in Your Home Router	OPERATION	OPERATION
8.11.25	Operation Peek-a-Baku	Initial Findings. Technical Analysis. Campaign – I The LNK Way. Malicious SILENT LOADER Malicious LAPLAS Implant – TCP & TLS. Malicious .NET Implant – SilentSweeper Campaign –...	OPERATION	OPERATION
1.11.25	Operation SkyCloak	Authors: Sathwik Ram Prakki and Kartikkumar Jivani Contents Introduction Key Targets Industries Geographical Focus Infection and Decoys Technical Analysis PowerShell Stage Persistence C..	OPERATION	OPERATION
1.11.25	Tangerine Turkey Operations	From Scripts to Systems: A Comprehensive Look at Tangerine Turkey Operations	OPERATION	OPERATION
18.10.25	Operation MotorBeacon	Malicious .NET Implant Hunting and Infrastructure. Conclusion Seqrite Protection. IOCs MITRE ATT&CK....	OPERATION	OPERATION
18.10.25	Operation Silk Lure	Introduction: Seqrite Lab has been actively monitoring global cyber threat...	OPERATION	OPERATION
27.9.25	Rewrite	Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign	OPERATION	OPERATION
23.9.25	Operation Rewrite	Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign	OPERATION	OPERATION
21.9.25	RaccoonO365	Cloudflare participates in global operation to disrupt RaccoonO365	OPERATION	OPERATION
16.9.25	SlopAds	Satori Threat Intelligence Alert: SlopAds Covers Fraud with Layers of Obfuscation	OPERATION	OPERATION
7.9.25	Operation BarrelFire	NoisyBear targets entities linked to Kazakhstan’s Oil & Gas Sector.	OPERATION	OPERATION
4.9.25	Blockbuster	Private Industry Takes Action Against Global Cyber Threats	OPERATION	OPERATION
30.8.25	Operation HanKook Phantom	Table of Contents: Introduction Threat Profile Infection Chain Campaign-1 Analysis of Decoy: Technical Analysis Fingerprint of ROKRAT’s Malware Campaign-2	OPERATION	OPERATION
17.8.25	Operation CargoTalon	UNG0901 Targets Russian Aerospace & Defense Sector using EAGLET implant.	OPERATION	OPERATION
25.7.25	Operation GhostChat	In June 2025, threat actors carried out a strategic web compromise by replacing the legitimate link, tibetfund.org/90thbirthday, on a compromised webpage with a malicious link.	OPERATION	OPERATION
25.7.25	Operation PhantomPrayers	In June 2025, a new subdomain, hhthedalailama90.niccenter[.]net was used by the threat actor to distribute a malicious application masquerading as a "special prayer check-in" software.	OPERATION	OPERATION
8.6.25	Operation Phantom Enigma	A malicious campaign discovered by Positive Technologies specialists is primarily targeting residents of Brazil. Attacks have been detected since the beginning of 2025.	OPERATION	OPERATION
23.5.25	Operation Sindoor – Anatomy of a Digital Siege	Overview Seqrite Labs, India’s largest Malware Analysis lab, has identified multiple cyber events linked to Operation Sindoor, involving state- sponsored APT activity and coordinated hacktivist operations.	OPERATION	OPERATION
25.4.25	ELUSIVE COMET	Mitigating ELUSIVE COMET Zoom remote control attacks	OPERATION	OPERATION
25.4.25	Scallywag	Scallywag Extensions Monetize Piracy	OPERATION	OPERATION
24.4.25	Operation SyncHole	Operation SyncHole: Lazarus APT goes back to the well	OPERATION	OPERATION
22.4.25	SuperCard X	SuperCard X: exposing a Chinese-speaker MaaS for NFC Relay fraud operation	OPERATION	OPERATION
21.4.25	Operation BlackEcho	Voice Phishing using Fake Financial and Vaccine Apps	OPERATION	OPERATION
25.3.25	Operational Relay Box (ORB)	An Introduction to Operational Relay Box (ORB) Networks - Unpatched, Forgotten, and Obscured	OPERATION	OPERATION
21.3.25	Operation FishMedley	ESET researchers detail a global espionage operation by FishMonger, the APT group run by I‑SOON	OPERATION	OPERATION
19.3.25	Operation AkaiRyū	Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor	OPERATION	OPERATION
22.2.25	Harvest	Operation ‘Harvest’: A Deep Dive into a Long-term Campaign	OPERATION	OPERATION
15.2.25	Operation Marstech Mayhen	Lazarus Group’s Open-Source Trap: North Korea’s New Malware Tactic Targeting Developers and Crypto Wallets	OPERATION	OPERATION
28.1.25	Operation Phantom Circuit	North Korea’s Global Data Exfiltration Campaign	OPERATION	OPERATION
16.1.25	Operation 99	Operation 99: North Korea’s Cyber Assault on Software Developers	OPERATION	OPERATION
10.12.24	Operation Digital Eye	Operation Digital Eye \| Chinese APT Compromises Critical Digital Infrastructure via Visual Studio Code Tunnels	OPERATION	OPERATION
10.12.24	Operation Soft Cell	Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers	OPERATION	OPERATION
10.12.24	Operation Tainted Love	Operation Tainted Love \| Chinese APTs Target Telcos in New Attacks	OPERATION	OPERATION
29.11.24	Operation Undercut	"Operation Undercut"Shows Multifaceted Nature of SDA’s Influence Operations	OPERATION	OPERATION
29.10.24	Operation Magnus	On the 28th of October 2024 the Dutch National Police, working in close cooperation with the FBI and other partners of the international law enforcement task force Operation Magnus, ..	OPERATION	OPERATION
27.10.24	OperationCodeonToast	AhnLab and NCSC Release Joint Report on Microsoft Zero-Day Browser Vulnerability (CVE-2024-38178)	OPERATION	OPERATION
17.6.24	Velvet Ant	China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence	OPERATION	OPERATION
17.6.24	Unfading Sea Haze	Unfading Sea Haze: New Espionage Campaign in the South China Sea	OPERATION	OPERATION
14.6.24	Celestial Force	Operation Celestial Force employs mobile and desktop malware to target Indian entities	OPERATION	OPERATION
12.6.24	DNS PROBING OPERATION	WHAT A SHOW! AN AMPLIFIED INTERNET SCALE DNS PROBING OPERATION	OPERATION	OPERATION
5.6.24	Operation Crimson Palace	Operation Crimson Palace: Sophos threat hunting unveils multiple clusters of Chinese state-sponsored activity targeting Southeast Asian government	OPERATION	OPERATION
5.6.24	Decoy Dog 2	Hellhounds: operation Lahat	OPERATION	OPERATION
5.6.24	Decoy Dog 1	Hellhounds: operation Lahat	OPERATION	OPERATION
31.5.24	BlueDelta	GRU's BlueDelta Targets Key Networks in Europe with Multi-Phase Espionage Campaigns	OPERATION	OPERATION
31.5.24	Doppelganger	This page is designed to gather a timeline of the Doppelganger operation with a few elements collected from different reports.	OPERATION	OPERATION
23.5.24	Diplomatic Specter	Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia	OPERATION	OPERATION
23.5.24	GHOSTENGINE	Elastic Security Labs has identified REF4578, an intrusion set incorporating several malicious modules and leveraging vulnerable drivers to disable known security solutions (EDRs) for crypto mining.	OPERATION	OPERATION
16.5.24	Operation Windigo	The vivisection of a large Linux server-side credential stealing malware campaign	OPERATION	OPERATION
15.5.24	RoundPress	ESET researchers uncover a Russia-aligned espionage operation targeting webmail servers via XSS vulnerabilities	OPERATION	OPERATION
30.4.24	MUDDLING MEERKAT	A CUNNING OPERATOR: MUDDLING MEERKAT AND CHINA’S GREAT FIREWALL	OPERATION	OPERATION
15.4.24	Operation MidnightEclipse	A critical command injection vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to execute arbitrary code with root privileges on the firewall.	OPERATION	OPERATION
2.4.24	Cuckoobees	Operation CuckooBees: Cybereason Uncovers Massive Chinese Intellectual Property Theft Operation	OPERATION	OPERATION
20.3.24	Operation PhantomBlu	A malware campaign employs new TTPs and behaviors to evade detection and deploy NetSupport RAT.	OPERATION	OPERATION
20.3.24	DEEP#GOSU	Securonix Threat Research Security Advisory: Analysis of New DEEP#GOSU Attack Campaign Likely Associated with North Korean Kimsuky Targeting Victims with Stealthy Malware	OPERATION	OPERATION
21.2.24	Operation Texonto	Operation Texonto: Information operation targeting Ukrainian speakers in the context of the war	OPERATION	OPERATION
1.2.24	Scammers Paradise	“Scammers Paradise” —Exploring Telegram’s Dark Markets, Breeding Ground for Modern Phishing Operations	OPERATION	OPERATION
10.1.24	RE#TURGENCE	Securonix Threat Research Security Advisory: New RE#TURGENCE Attack Campaign: Turkish Hackers Target MSSQL Servers to Deliver Domain-Wide MIMIC Ransomware	OPERATION	OPERATION
27.12.23	Triangulation	Operation Triangulation: The last (hardware) mystery	OPERATION	OPERATION
24.12.23	RusticWeb	Operation RusticWeb targets Indian Govt: From Rust-based malware to Web-service exfiltration	OPERATION	OPERATION
19.12.23	Operation Blacksmith	Operation Blacksmith: Lazarus targets organizations worldwide using novel Telegram-based malware written in DLang	OPERATION	OPERATION
14.12.23	Bearded Barbie	Operation Bearded Barbie: APT-C-23 Campaign Targeting Israeli Officials	OPERATION	OPERATION
14.12.23	Big Bang	The Big Bang attack campaign: Gaza hackers suspected of targeting Middle Eastern victims	OPERATION	OPERATION
14.12.23	Operation Parliament	The objective of the attacks is clearly espionage – they involve gaining access to top legislative, executive and judicial bodies around the world.	OPERATION	OPERATION
25.11.23	Telekopye	Telekopye: Chamber of Neanderthals’ secrets	OPERATION	OPERATION
22.10.23	Operation King TUT	ESET researchers reveal a growing sophistication in threats affecting the LATAM region by employing evasion techniques and high-value targeting	OPERATION	OPERATION
19.10.23	TetrisPhantom	Government entities in the Asia-Pacific (APAC) region are the target of a long-running cyber espionage campaign dubbed TetrisPhantom.	OPERATION	OPERATION
16.10.23	EtherHiding	“EtherHiding” — Hiding Web2 Malicious Code in Web3 Smart Contracts	OPERATION	OPERATION
5.10.23	Operation Jacana	ESET researchers discovered a cyberespionage campaign against a governmental entity in Guyana	OPERATION	OPERATION
19.9.23	Operation Rusty Flag	Operation Rusty Flag – A Malicious Campaign Against Azerbaijanian Targets	OPERATION	OPERATION
19.9.23	AMBERSQUID	The Sysdig Threat Research Team (TRT) has uncovered a novel cloud-native cryptojacking operation which they’ve named AMBERSQUID.	OPERATION	OPERATION
6.9.23	Smishing Triad	"Smishing Triad" Targeted USPS And US Citizens For Data Theft	OPERATION	OPERATION
19.8.23	LABRAT	LABRAT: Stealthy Cryptojacking and Proxyjacking Campaign Targeting GitLab	OPERATION	OPERATION
22.6.23	Operation Triangulation's	Over the years, there have been multiple cases when iOS devices were infected with targeted spyware such as Pegasus.	OPERATION	OPERATION
12.6.23	Mexals campaign	One of the changes between the two campaigns is their name: The group previously known as Mexals (see their web page in Figure 1) now call themselves Diicot, and one of their tools bears the same name.	OPERATION	OPERATION
8.6.23	Operation Red Deer	Outing Aggah’s Sophisticated Tactics, Techniques and Procedures (TTPs) Targeting Israel	OPERATION	OPERATION
7.6.23	Operation CMDStealer	Financially Motivated Campaign Leverages CMD-Based Scripts and LOLBaS for Online Banking Theft in Portugal, Peru, and Mexico	OPERATION	OPERATION
3.6.23	Operation Triangulation	While monitoring the network traffic of our own corporate Wi-Fi network dedicated for mobile devices using the Kaspersky Unified Monitoring and Analysis Platform (KUMA).	OPERATION	OPERATION
25.5.23	Operation Groundbait	In addition to the armed conflict in eastern Ukraine, in recent years the country has been facing a significantly higher number of targeted cyberattacks, or so-called advanced persistent threats (APTs).	OPERATION	OPERATION
14.5.23	Hunting Russian Intelligence “Snake” Malware	The Snake implant is considered the most sophisticated cyber espionage tool designed and used by Center 16 of Russia’s Federal Security Service (FSB) for long-term intelligence collection on sensitive targets.	OPERATION	OPERATION
14.5.23	DownEx	Deep Dive Into DownEx Espionage Operation in Central Asia	OPERATION	OPERATION
17.3.23	SCARLETEEL	A sophisticated attack campaign dubbed SCARLETEEL is targeting containerized environments to perpetrate theft of proprietary data and software.	OPERATION	OPERATION
17.3.23	PROXYSHELLMINER CAMPAIGN	Morphisec has recently identified a highly evasive malware campaign delivering ProxyShellMiner to Windows endpoints.	OPERATION	OPERATION
15.3.23	ENDTRADE	We found cyberespionage group TICK targeting critical systems and enterprises to steal information. In this research brief, we show the group's activities and technical analyses of the ..	OPERATION	OPERATION
15.3.23	Dero Cryptojacking Campaign	CrowdStrike has discovered the first-ever Dero cryptojacking operation targeting Kubernetes infrastructure.	OPERATION	OPERATION
11.3.23	Operation Dream Job	Hackers associated with the North Korean government have been distributing a trojanized version of the DeFi Wallet for storing cryptocurrency assets to gain access to the systems of cryptocurrency users and investors.	OPERATION	OPERATION
2.3.23	SCARLETEEL	Operation leveraging Terraform, Kubernetes, and AWS for data theft	OPERATION	OPERATION
18.2.23	OPERATION SILENT WATCH	Amid rising tensions between Azerbaijan and Armenia over the Lachin corridor in late 2022, Check Point Research identified a malicious campaign against entities in Armenia.	OPERATION	OPERATION
5.2.23	'No Pineapple' Campaign	During Q4 2022, WithSecure™ detected and responded to a cyber attack conducted by a threat actor that WithSecure™ have attributed with high confidence to an intrusion set referred to as Lazarus Group.	OPERATION	OPERATION
4.2.23	Operation Ice Breaker	In September of last year, our Incident Response team was called to an incident that was identified as an attempt of social engineering an online customer service platform.	OPERATION	OPERATION
3.2.23	GOOTLOADER Operations	Beginning in 2022, UNC2565 began incorporating notable changes to the tactics, techniques, and procedures (TTPs) used in its operations.	OPERATION	OPERATION
23.6.22	Operation Bearded Barbie	Molerats and APT-C-23. Both groups are Arabic-speaking and politically-motivated that operate on behalf of Hamas, the Palestinian Islamic-fundamentalist movement and a terrorist organization ...	OPERATION	OPERATION
23.6.22	BRONZE STARLIGHT	The activity cluster, attributed to a hacking group dubbed Bronze Starlight by Secureworks, involves the deployment of post-intrusion ransomware such as LockFile, Atom Silo, Rook, Night Sky, Pandora, and LockBit 2.0.	OPERATION	OPERATION
8.5.22	Mustang Panda	MustangPanda, also known as "RedDelta" or "Bronze President," is a China-based threat actor that has targeted entities all over the world since at least 2012.	OPERATION	OPERATION
5.5.22	Operation CuckooBees	Researchers at Cybereason recently discovered such an attack, which was assessed to be the work of Chinese APT Winnti.	OPERATION	OPERATION
4.22	SnatchCrypto		OPERATION	OPERATION
4.22	Operation Dream Job		OPERATION	OPERATION
4.22	Azerbaijanian operation		OPERATION	OPERATION
4.22	Operation Armor Piercer		OPERATION	OPERATION
4.22	Operation Dream Job		OPERATION	OPERATION
4.22	Operation AppleJeus		OPERATION	OPERATION
4.22	Operation Dragon Castling		OPERATION	OPERATION
4.22	Operation Tropic Trooper		OPERATION	OPERATION
2021	Operation GhostShell	In July 2021, the Cybereason Nocturnus and Incident Response Teams responded to Operation GhostShell, a highly-targeted cyber espionage campaign targeting the Aerospace and Telecommunications industries mainly in the Middle East	OPERATION	OPERATION
19.3.21	O p e r a t i o n Diànxùn	In this attack, we discovered malware using similar tactics, techniques, and procedures (TTPs) to those observed in earlier campaigns publicly attributed to the threat actors RedDelta and Mustang Panda.	OPERATION	OPERATION
26.2.21	Operation ‘Dream Job’	During June-August of 2020, ClearSky’s team had investigated an offensive campaign attributed with high probability to North Korea, which we call “Dream Job”.	OPERATION	OPERATION
15.1.21	Operation Spalax	ESET researchers uncover attacks targeting Colombian government institutions and private companies, especially from the energy and metallurgical industries	OPERATION	OPERATION
18.12.20	Operation SignSight	Just a few weeks after the supply-chain attack on the Able Desktop software, another similar attack occurred on the website of the Vietnam Government Certification Authority (VGCA): ca.gov.vn.	OPERATION	OPERATION
12.12.20	Operation StealthyTrident	LuckyMouse, TA428, HyperBro, Tmanger and ShadowPad linked in Mongolian supply-chain attack	OPERATION	OPERATION
30.11.20	Dark Caracal	As the modern threat landscape has evolved, so have the actors. The barrier to entry for cyber-warfare has continued to decrease, which means new nation states	OPERATION	OPERATION
30.11.20	Operation Manul	This report covers a campaign of phishing and malware which we have named “Operation Manul” and which, based on the available evidence, we believe is likely to 1 have been carried out on behalf of the government of Kazakhstan against journalists.	OPERATION	OPERATION
20.11.20	Operation PowerFall	In May 2020, Kaspersky technologies prevented an attack on a South Korean company by a malicious script for Internet Explorer.	OPERATION	OPERATION
17.11.20	Operation-Blockbuster	The Lazarus group was first identified in Novetta’s report Operation Blockbuster in February 2016	OPERATION	OPERATION
7.11.20	Operation (노스 스타) North Star	We are in the midst of an economic slump, with more candidates than there are jobs, something that has been leveraged by malicious actors to lure unwitting victims into opening documents laden with malware.	OPERATION	OPERATION
7.11.20	Operation North Star	It is rare to be provided an inside view on how major cyber espionage campaigns are conducted within the digital realm.	OPERATION	OPERATION
7.11.20	Operation North Star:	McAfee’s initial research into Operation North Star revealed a campaign that used social media sites, spearphishing and weaponized documents to target employees working for organizations in the defense sector.	OPERATION	OPERATION
7.11.20	INJ3CTOR3 Operation	Recently, Check Point Research encountered a series of worldwide attacks relevant to VoIP, specifically to Session initiation Protocol (SIP) servers.	OPERATION	OPERATION
31.10.20	Uncovering DRBControl	The DRBControl campaign attacks its targets using a variety of malware and techniques that coincide with those used in other known cyberespionage campaigns.	OPERATION	OPERATION
31.10.20	Operation Earth Kitsune	A watering hole campaign we dubbed as Operation Earth Kitsune is spying on users’ systems through compromised websites.	OPERATION	OPERATION
23.9.20	Operation DisrupTor	Today, a coalition of law enforcement agencies across the world announced the results of a coordinated operation known as DisrupTor which targeted vendors and buyers of illicit goods on the dark web.	OPERATION	OPERATION
24.8.20	Mispadu	In this installment of our blog series, we will focus on Mispadu, an ambitious Latin American banking trojan that utilizes McDonald’s malvertising and extends its attack surface to web browsers.	OPERATION	OPERATION
24.8.20	Mekotio	In this installment of our series, we introduce Mekotio, a Latin American banking trojan targeting mainly Brazil, Chile, Mexico, Spain, Peru and Portugal.	OPERATION	OPERATION
24.8.20	Casbaneiro	Most reverse engineers would agree that quite often one can learn something new on the job. However, it is not every day you learn how to cook a delicious meal while analyzing malware.	OPERATION	OPERATION
24.8.20	Grandoreiro	Although it’s been some weeks since the height of the income tax season in many countries around the globe, the year 2020 has been looking less than normal even for cybercriminal activity.	OPERATION	OPERATION
21.8.20	Operation Transparent tribe	The APT group Transparent Tribe is mounting an ongoing cyberespionage campaign, researchers said, which is aimed at military and diplomatic targets around the world.	OPERATION	OPERATION
30.7.20	‘Ghostwriter’ Influence Campaign:	Unknown Actors Leverage Website Compromises and Fabricated Content to Push Narratives Aligned with Russian Security Interests	OPERATION	OPERATION
30.7.20	Operation North Star	North Korea-linked hackers continue to be very active in this period, researchers reported a campaign aimed at the US defense and aerospace sectors.	OPERATION	OPERATION
17.7.20	Operation In(ter)ception	At the end of last year, we discovered targeted attacks against aerospace and military companies in Europe and the Middle East, active from September to December 2019.	OPERATION	OPERATION
27.3.20	Operation Poisoned News	Experts observed a campaign aimed at infecting the iPhones of users in Hong Kong with an iOS backdoor that allows attackers to spy on them.	OPERATION	OPERATION
23.3.20	Operation Pangea	Operation Pangea is the name of a joint international operation lead by the Interpol that seized €13 million in counterfeit drugs for care.	OPERATION	OPERATION
17.2.20	Fox Kitten Campaign	Iranian hackers have been hacking VPN servers to plant backdoors in companies around the world Iran-linked attackers targeted Pulse Secure, Fortinet, Palo Alto Networks, and Citrix VPNs to hack into large companies as part of the Fox Kitten Campaign.	OPERATION	OPERATION
28.1.20	Operation Night Fury	Group-IB helps take down a cybergang behind the infection of hundreds of websites all over the world	OPERATION	OPERATION
22.1.20	OP Glowing Symphony	US military claims to have disrupted the online propaganda activity of the Islamic State (ISIS) in a hacking operation dating back at least to 2016.	OPERATION	OPERATION
2019	Glupteba Expands Operation	Glupteba was first spotted in 2011 as a malicious proxy generating spam and click-fraud traffic from a compromised machine.	OPERATION	OPERATION
19.10.19	OPERATION GHOST	ESET researchers describe recent activity of the infamous espionage group, the Dukes, including three new malware families	OPERATION	OPERATION
7.6.19	Operation WebStorage	The campaign uses compromised routers and man-in-the-middle attacks to target legitimate ASUS WebStorage software to distribute the Plead malware.	OPERATION	OPERATION
11.6.19	Operation MuddyWater POWERSTATS V3	The campaign targets a range of sectors with spear-phishing emails delivered from legitimate compromised accounts to drop a PowerShell-based backdoor labeled POWERSTATS v3.	OPERATION	OPERATION
11.6.19	Operation ShellTea	The campaign targets the hotel and entertainment sectors with spear-phishing emails to infiltrate systems with the ShellTea backdoor.	OPERATION	OPERATION
11.6.19	Operation HAWKBALL	The campaign targets the government sector in Central Asia with malicious documents that take advantage of vulnerabilities in Microsoft Office to drop the HAWKBALL backdoor.	OPERATION	OPERATION
10.6.19	Operation Frankenstein	The campaign used a range of open-source tools to carry out their attacks including Microsoft's MSbuild, the post-exploitation framework FruityC2, and PowerShell Empire.	OPERATION	OPERATION
27.6.19	Operation TA505 Shifting Tactics	The group behind the operation target users in South Korea, China, and Taiwan with new tactics, techniques, and procedures including Amadey to distribute EmailStealer, using V BA macro and Excel 4.0 macro.	OPERATION	OPERATION
27.6.19	Operation Waterbug New Toolset	The threat actor behind the operation launched a series of attacks in the last 18 months against multiple sectors including government, IT, communications, and education.	OPERATION	OPERATION
27.6.19	Operation Soft Cell	The campaign has been active since at least 2012 and targets telecommunications providers in multiple countries. T	OPERATION	OPERATION
28.5.19	Operation SharePoint Middle East	The campaign targeted Microsoft SharePoint servers located at Middle Eastern government organizations to steal sensitive information.	OPERATION	OPERATION
28.5.19	Operation BlackWater	The campaign used trojanized documents attached to phishing emails to steal sensitive information from victims located in the Middle East.	OPERATION	OPERATION
26.6.19	ViceLeaker Operation	In May 2018, we discovered a campaign targeting dozens of mobile Android devices belonging to Israeli citizens.	OPERATION	OPERATION
14.5.19	Operation Daybreak	Earlier this year, we deployed new technologies in Kaspersky Lab products to identify and block zero-day attacks.	OPERATION	OPERATION
23.4.19	Operation ShadowHammer	In late March 2019, we briefly highlighted our research on ShadowHammer attacks, a sophisticated supply chain attack involving ASUS Live Update Utility, which was featured in a Kim Zetter article on Motherboard.	OPERATION	OPERATION
26.3.19	Operation SaboTor	Today, members of the Joint Criminal Opioid and Darknet Enforcement (J-CODE) team announce the results of Operation SaboTor, a coordinated international effort targeting drug trafficking organizations operating on the Darknet.	OPERATION	OPERATION
26.3.19	Operation ShadowHammer	Earlier today, Motherboard published a story by Kim Zetter on Operation ShadowHammer, a newly discovered supply chain attack that leveraged ASUS Live Update software.	OPERATION	OPERATION
5.3.19	#OpJerusalem	Over the weekend, hundreds of popular Israeli sites were targeted by an attack called #OpJerusalem whose goal was to infect Windows users with the JCry ransomware.	OPERATION	OPERATION
2018	Operation Soft Cell	In 2018, the Cybereason Nocturnus team identified an advanced, persistent attack targeting global telecommunications providers carried out by a threat actor using t ools and techniques commonly associated with Chinese-affiliated ..	OPERATION	OPERATION
12.12.18	Operation Sharpshooter	The McAfee Advanced Threat Research team and McAfee Labs Malware Operations Group have discovered a new global campaign targeting nuclear, defense, energy, and financial companies.	OPERATION	OPERATION
17.11.18	Operation Oceansalt	A wall eight feet high with three strands of barbed wire is considered sufficient to deter a determined intruder, at least according to the advice offered by the CISSP professional certification.	OPERATION	OPERATION
14.11.18	OperationShaheen	We have dubbed the first campaignOperation Shaheen. It examines complex espionage effort directed military Pakistani the at	OPERATION	OPERATION
4.5.18	ZOO. CYBERESPIONAGE OPERATION	ZooPark is a cyberespionage operation that has been focusing on Middle Eastern targetssince at least June 2015.	OPERATION	OPERATION
4/5/18	OpIsrael 2018	OpIsrael is a yearly campaign created by Anonymous in 2012 with the stated goal of “erasing Israel from the internet” in protest against the Israeli government’s conduct in the Israli-Palestinian conflict.	OPERATION	OPERATION
12/21/18	OpCatalunya: Phase 4	In October 2017, citizens of Catalonia – an autonomous community in Spain - held an independence referendum.	OPERATION	OPERATION
17.12.18	Operation Dragonfly	On September 6, Symantec published details of the Dragonfly campaign, which targeted dozens of energy companies throughout 2017.	OPERATION	OPERATION
12/14/17	OpKillingBay/OpWhales	With a new whale hunting season comes a new wave of attacks by environmental and animal rights hacktivist communities within the Anonymous collective.	OPERATION	OPERATION
12/12/17	OpUSA / OpIsrael	In 1995, the United States Congress passed the Jerusalem Embassy Act, which was created for the purposes of initiating and funding the relocation of the Embassy of the United States in Israel from Tel Aviv to Jerusalem.	OPERATION	OPERATION
10/31/17	OpCatalonia	At the beginning of October 2017, citizens of Catalonia – an autonomous community in Spain - held an independence referendum.	OPERATION	OPERATION
6/8/17	OpIcarus2017	OpIcarus is a multiphase operation originally launched by Anonymous on February 8, 2016 and is now entering its fifth phase on June 11, 2017. Its	OPERATION	OPERATION
6/7/17	OpSingleGateway	In the first week of June there has been a dramatic increase in activity from #OpSingleGateway, an Anonymous operation designed to combat the government of Thailand’s strategy to implement central control of the nation’s Internet,.	OPERATION	OPERATION
6/5/17	OpKillingBay 2017	OpKillingBay is a yearly hacktivism operation by Anonymous, activists, and others organizations in response to the hunting of whales and dolphins in Japan.	OPERATION	OPERATION
3/28/17	OpIsrael 2017	With the stated goal of "erasing Israel from the Internet,” Anonymous will launch OpIsrael 2017, its yearly cyber operation against Israel on April 7, 2017.	OPERATION	OPERATION
1/17/17	OpSingleGateway:	In a move to combat the government of Thailand’s strategy to implement central control of the nation’s Internet, Anonymous has launched OpSingleGateway.	OPERATION	OPERATION
11/10/16	OpKillingBay 2016 Update	Online protests in the form of network and application attacks against countries and organizations involved in whale and dolphin hunting has become an integral part of hunting season.	OPERATION	OPERATION
9/19/16	OpNoDAPL	The Dakota Access Pipeline Project (DAPL) is the construction of a 1,172-mile-long pipeline that will span across three states.	OPERATION	OPERATION
6/8/16	OpIcarus Project Mayhem	Anonymous has initiated the third and final phase of OpIcarus: “Project Mayhem” – a systematic cyber assault against worldwide stock exchanges.	OPERATION	OPERATION
5/18/16	OperationLGBT	Anonymous has launched OpLGBT, a DDoS campaign targeting the state of North Carolina and its governmental institutes in response to controversial legislation passed by the state’s General Assembly.	OPERATION	OPERATION
5/6/16	OpIcarus Re-Engaged	The Hacktivist Group Anonymous announced its plans to relaunch its cyber assaults on leading financial services companies worldwide.	OPERATION	OPERATION
4/25/16	OpOperadoras	In an effort to fight for the rights of digital consumers throughout South America, the hacktivist group Anonymous has launched OpOperadoras,i coordinated cyber assault against Brazilian telecommunication companies.	OPERATION	OPERATION
4/5/16	OpIsrael Update - April 2016	With the stated goal of “erasing Israel from the internet” in protest against claimed crimes against the Palestinian people, Anonymous will launch its yearly operation against Israel.	OPERATION	OPERATION
4/4/16	OpTrump Attacks & Other DDoS	Since our previous OpWhiteRose vs Donald Trump ERT alert outlining the potential cyber-attack against Donald Trump on April fool's day, the presidential candidate was eventually hit and online entities of key Trump.	OPERATION	OPERATION
3/24/16	OpWhiteRose vs Donald Trump	Donald Trump and his presidential campaign has gained a new round of attention from the Anonymous collective.	OPERATION	OPERATION
3/16/16	OpRight2Rest	The hacktivist group Anonymous launched an operation against the city of Denver, CO and its officials. Entitled OpRight2Rest, the operation is a response to the passing of the Denver Homeless Camping Ban.	OPERATION	OPERATION
3/14/16	OpAbdiMohamed	The hacktivist group New World Hackers is currently targeting the capital and most populous city of Utah, Salt Lake City, as part of a new operation, OpAbdiMohamed.	OPERATION	OPERATION
3/10/16	OpAfrica Update - March 2016	The hacktivist group Anonymous has upped the ante in its cyber-assault against corporations and government that "enable and perpetuate corruption on the African continent."	OPERATION	OPERATION
2/26/16	OpIsrael Update - February 2016	With the stated goal of "erasing Israel from the internet" in protest against claimed crimes against the Palestinian people, Anonymous will launch its yearly operation against Israel.	OPERATION	OPERATION
2/24/16	OpGaston	Hacktivists have targeted the Cincinnati Police Department after last week’s police shooting of Paul Gaston.	OPERATION	OPERATION
2/16/16	OpAfrica	The hacktivist group Anonymous is back, this time fighting corruption across the continent of Africa.	OPERATION	OPERATION
2/11/16	OpKillingBay Update - February 2016	OpKillingBay is an annual campaign that was started in 2013 by Anonymous. It was created by Anonymous to bring attention to the hunting of whales and dolphins in Japan and Denmark.	OPERATION	OPERATION
2/8/16	OpIcarus	The hacktivist group Anonymous announced its plan to attack leading financial services companies on Monday, February 8, 2016, starting at 6AM UTC with the goal of taking down their websites and services.	OPERATION	OPERATION
12/18/15	OpTrump	On December 11, 2015 Anonymous announced Operation Trump (#OpTrump), a three phase hacking campaign to "expose the real Donald Trump" and take down the presidential candidate's online footprint	OPERATION	OPERATION
12/1/15	OpParis Update	OpParis has faced a number of challenges since the launch of its operation.	OPERATION	OPERATION
11/16/15	OpKillingBay Update	OpKillingBay, the annual campaign created by Anonymous, has continued into November and predicted to remain until the end of dolphin hunting season.	OPERATION	OPERATION
11/10/15	OpParis	Radware's ERT has been investigating OpParis, an Anonymous revenge campaign against ISIS for the Paris attacks on November 13, 2015.	OPERATION	OPERATION
10/26/15	OpKillingBay	OpKillingBay is an annual campaign created by Anonymous, activists and other organizations in response to whale and dolphin hunting in Japan and Denmark.	OPERATION	OPERATION
4/17/15	OpISIS	Islamic State in Iraq and Syria (ISIS), an Al-Qaeda splinter group, is infamously known for its malicious, physical attacks. Recently, however, ISIS has been credited with cyber-attacks.	OPERATION	OPERATION
3/30/15	OpIsrael 2015	OpIsrael 2015 is an organized set of attacks aimed at the Israeli government, public institutions and other high profile Web sites.	OPERATION	OPERATION
7/11/14	OpSaveGaza	Due to the growing tension between Palestine and Israel that includes military actions in the sector of Gaza, several hacktivists groups have united in a cyber-attack campaign against Israel, named #OpSaveGaza.	OPERATION	OPERATION
15.7.14	OPERATION WINDIGO	This document details a large and sophisticated operation, code named “Windigo”, in which a malicious group has compromised thousands of Linux and Unix servers.	OPERATION	OPERATION
4/7/14	OpIsrael 2014	#OpIsrael is an organized set of attacks aimed at Israeli Web sites, which was officially first launched on 14 November, 2012 against the Israeli government, public institutions and other high profile Web sites.	OPERATION	OPERATION
7/26/13	#OpAbabil Phase 4	In early September 2012, videos of about 14 minutes in length that claimed to be trailers of a longer film named “Innocence of Muslims” were uploaded to YouTube.	OPERATION	OPERATION
4/30/13	OPUSA	AnonGhost – A hacking group affiliated with Anonymous announced a new cyber-attack campaign against US websites named #OPUSA, scheduled for May 7th, 2013.	OPERATION	OPERATION
4/7/13	OpIsrael	Various anti-Israeli hacking groups join hands to launch a massive cyber attack on Israeli cyber space with the aim to disconnect the country from the Internet.	OPERATION	OPERATION
2011	OPERATION POTAO EXPRESS	The Operation Potao Express whitepaper presents ESET’s latest findings based on research into the Win32/Potao malware family.	OPERATION	OPERATION

Operation Sharpshooter