Operation 2025 2026()  2025()  2024()  2023()  2022()  OTHER()

DATE

NAME

INFO

CATEGORY

SUBCATE

17.12.25

Operation ForumTroll

Operation ForumTroll continues: Russian political scientists targeted using plagiarism reports

OPERATION

OPERATION

13.12.25

Operation MoneyMount-ISO

Table of Contents: Introduction: Targeted sectors: Initial Findings about Campaign: Analysis of Phishing Mail: Infection Chain: Technical Analysis: Stage-1: Analysis of Malicious ISO file. Stage-2:

OPERATION

OPERATION

13.12.25

Operation FrostBeacon

Operation FrostBeacon: Multi-Cluster Cobalt Strike Campaign Targets Russia Contents Introduction Key Targets Geographical Focus Industries Affected LNK Cluster Initial Access:

OPERATION

OPERATION

6.12.25

Operation DupeHike

Contents Introduction Key Targets. Industries Affected. Geographical Focus. Infection Chain. Initial Findings. Looking into the decoy-document Technical Analysis Stage 1 – Malicious LNK Script Stage 2 –

OPERATION

OPERATION

26.11.25

RomCom payload

Russian RomCom Utilizing SocGholish to Deliver Mythic Agent to U.S. Companies Supporting Ukraine

OPERATION

OPERATION

19.11.25

Operation WrtHug

Operation WrtHug, The Global Espionage Campaign Hiding in Your Home Router

OPERATION

OPERATION

8.11.25

Operation Peek-a-Baku

Initial Findings. Technical Analysis. Campaign – I The LNK Way. Malicious SILENT LOADER Malicious LAPLAS Implant – TCP & TLS. Malicious .NET Implant – SilentSweeper Campaign –...

OPERATION

OPERATION

1.11.25

Operation SkyCloak

Authors: Sathwik Ram Prakki and Kartikkumar Jivani Contents Introduction Key Targets Industries Geographical Focus Infection and Decoys Technical Analysis PowerShell Stage Persistence C..

OPERATION

OPERATION

1.11.25

Tangerine Turkey Operations

From Scripts to Systems: A Comprehensive Look at Tangerine Turkey Operations

OPERATION

OPERATION

18.10.25

Operation MotorBeacon

Malicious .NET Implant Hunting and Infrastructure. Conclusion Seqrite Protection. IOCs MITRE ATT&CK....

OPERATION

OPERATION

18.10.25

Operation Silk Lure

Introduction: Seqrite Lab has been actively monitoring global cyber threat...

OPERATION

OPERATION

27.9.25

Rewrite

Operation Rewrite: Chinese-Speaking  Threat Actors  Deploy BadIIS  in a Wide Scale  SEO Poisoning  Campaign

OPERATION

OPERATION

23.9.25

Operation Rewrite

Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign

OPERATION

OPERATION

21.9.25

RaccoonO365

Cloudflare participates in global operation to disrupt RaccoonO365

OPERATION

OPERATION

16.9.25

SlopAds

Satori Threat Intelligence Alert: SlopAds Covers Fraud with Layers of Obfuscation

OPERATION

OPERATION

7.9.25

Operation BarrelFire

NoisyBear targets entities linked to Kazakhstan’s Oil & Gas Sector.

OPERATION

OPERATION

4.9.25

Blockbuster

Private Industry Takes Action Against Global Cyber Threats

OPERATION

OPERATION

30.8.25

Operation HanKook Phantom

Table of Contents: Introduction Threat Profile Infection Chain Campaign-1 Analysis of Decoy: Technical Analysis Fingerprint of ROKRAT’s Malware Campaign-2

OPERATION

OPERATION

17.8.25

Operation CargoTalon

UNG0901 Targets Russian Aerospace & Defense Sector using EAGLET implant.

OPERATION

OPERATION

25.7.25

Operation GhostChat

In June 2025, threat actors carried out a strategic web compromise by replacing the legitimate link, tibetfund.org/90thbirthday, on a compromised webpage with a malicious link.

OPERATION

OPERATION

25.7.25

Operation PhantomPrayers

In June 2025, a new subdomain, hhthedalailama90.niccenter[.]net was used by the threat actor to distribute a malicious application masquerading as a "special prayer check-in" software.

OPERATION

OPERATION

8.6.25

Operation Phantom Enigma

A malicious campaign discovered by Positive Technologies specialists is primarily targeting residents of Brazil. Attacks have been detected since the beginning of 2025.

OPERATION

OPERATION

23.5.25

Operation Sindoor – Anatomy of a Digital Siege

Overview Seqrite Labs, India’s largest  Malware Analysis lab, has identified  multiple cyber events linked to  Operation Sindoor, involving state-  sponsored APT activity and coordinated hacktivist operations.

OPERATION

OPERATION

25.4.25 ELUSIVE COMET Mitigating ELUSIVE COMET Zoom remote control attacks

OPERATION

OPERATION
25.4.25 Scallywag Scallywag Extensions Monetize Piracy

OPERATION

OPERATION
24.4.25 Operation SyncHole Operation SyncHole: Lazarus APT goes back to the well

OPERATION

OPERATION
22.4.25 SuperCard X SuperCard X: exposing a Chinese-speaker MaaS for NFC Relay fraud operation

OPERATION

OPERATION
21.4.25 Operation BlackEcho Voice Phishing using Fake Financial and Vaccine Apps

OPERATION

OPERATION

25.3.25

Operational Relay Box (ORB) An Introduction to Operational Relay Box (ORB) Networks - Unpatched, Forgotten, and Obscured

OPERATION

OPERATION

21.3.25

Operation FishMedley ESET researchers detail a global espionage operation by FishMonger, the APT group run by I‑SOON

OPERATION

OPERATION

19.3.25

Operation AkaiRyū Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor

OPERATION

OPERATION
22.2.25 Harvest Operation ‘Harvest’: A Deep Dive into a Long-term Campaign

OPERATION

OPERATION
15.2.25 Operation Marstech Mayhen Lazarus Group’s Open-Source Trap: North Korea’s New Malware Tactic Targeting Developers and Crypto Wallets

OPERATION

OPERATION
28.1.25 Operation Phantom Circuit North Korea’s Global Data Exfiltration Campaign

OPERATION

OPERATION

16.1.25

Operation 99 Operation 99: North Korea’s Cyber Assault on Software Developers

OPERATION

OPERATION