APT Security News

Advanced Persistent Threat (APT) groups: nation-state and highly resourced actors, their campaigns and attributed activity.

APT (Advanced Persistent Threat) groups are well-resourced, typically state-linked actors running long, targeted intrusion campaigns rather than opportunistic attacks. Newly attributed activity, campaign reports, and the tools and infrastructure researchers tie back to named groups all land here. Volume is lower than the commodity-crime feeds, but the targets are government bodies, critical infrastructure and high-value corporate networks.

Recent APT items

State-Sponsored Hackers Deploy Up to 8 AI Agents to Target Taiwanese Government Systems https://gbhackers.com/ai-agents-target-taiwan/
@PentestingNews · Nov 12, 2026
Exchange for breakfast: Turla’s Cereal tricks are not for kids ESET Research describes Turla’s Cereal toolset, featuring a novel Exchange email collection module, a unique C&C mechanism, and sophistic...
@malwr · Nov 11, 2026
Russia-Linked APT Turla Turned Exchange Servers Into Their Own Control Room https://ift.tt/CeNUxkF
@ctinow · Nov 10, 2026
Inside Turla’s Cereal Malware: A Sophisticated Cyber-Espionage Operation Targeting Microsoft… https://ift.tt/QNbCLAJ
@ctinow · Nov 10, 2026
Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments https://cyberscoop.com/russian-turla-group-used-new-toolset-to-silently-pilfer-emails-from-kazakhst...
@PentestingNews · Nov 10, 2026
Russian-Linked Turla Hackers Abuse Microsoft Exchange Infrastructure to Target Sensitive Communications https://gbhackers.com/microsoft-exchange-abuse/
@PentestingNews · Nov 10, 2026
Russian Turla Hackers Use New Cereal Malware to Steal Emails From Government Exchange Servers https://ift.tt/rkGQEeb
@ctinow · Nov 10, 2026
Russian-linked Turla hackers are using new Cereal malware to steal government emails. The toolset hides inside Microsoft Exchange processes, intercepts selected messages, and operates without external...
@thehackernews · Nov 10, 2026
Turla hackers use new Cereal malware to spy on govt Exchange servers https://ift.tt/1ZCW4KF
@ctinow · Nov 10, 2026
Russian Turla group used new toolset to silently pilfer emails from Kazakhstan, Romanian governments https://ift.tt/OVRTvLX
@ctinow · Nov 10, 2026
Turla hackers use new Ceral malware to spy on govt Exchange servers The Russian state-backed threat group Turla has been using a new malicious toolset called 'Cereal' to intercept emails on Microsoft...
@bleepingcomputer · Nov 10, 2026
FBI agent stole $2.5 million in crypto from hackers under investigation A former FBI agent has pleaded guilty to stealing nearly $2.5 million from the wallets of fraud victims and nation-state hackers...
@bleepingcomputer · Nov 9, 2026
APT29's Watering Holes Target Thousands of Mobile Users https://ift.tt/nTxSUL2
@ctinow · Nov 5, 2026
Russian APT29 Targets Mobile Users with Watering Hole Attacks https://securityaffairs.com/202473/apt/russian-apt29-targets-mobile-users-with-watering-hole-attacks.html
@PentestingNews · Nov 5, 2026
Russian APT29 Targets Mobile Users with Watering Hole Attacks https://ift.tt/lFJmISv
@ctinow · Nov 5, 2026
Russia-linked APT29 used hacked sites, cloned domains and the Plerdy tracker to serve patched-flaw exploits to out-of-date iPhones and Android phones. https://vulnpocalypse.dev/advisories/apt29-wateri...
@secharvester · Nov 4, 2026
Russia-linked APT29 is tied to a campaign delivering iOS and Android exploits through compromised sites and a hijacked web analytics script. DarkSword and AndroSnitch target browser cookies, Wi-Fi pas...
@thehackernews · Nov 4, 2026
Billions stolen. Official software backdoored. A shared chat link exposing private conversations. This week’s Cybersecurity Recap: → $6.43B Binance theft → Polymarket wallet drain → Claude Code extens...
@thehackernews · Nov 2, 2026
FBI links $6.3 billion Binance crypto heist to North Korean hackers The FBI has confirmed that North Korean state-sponsored hackers known as TraderTraitor were behind the $6.3 billion crypto-theft att...
@bleepingcomputer · Nov 1, 2026
Chinese state-sponsored hackers used AI-powered ARTEX to target over 200 organizations worldwide. CrowdStrike confirms post-exploitation at nine, including deployment of BLOODALCHEMY malware. AI agent...
@thehackernews · Oct 30, 2026
Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon's 'Silent Train' Network https://www.securityweek.com/cisco-sd-wan-zero-day-exploitation-tied-to-volt-typhoons-silent-train-network/
@secharvester · Oct 30, 2026
Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malware A newly identified advanced persistent threat (APT) group tracked as UAT-11473 was observed exploiting CVE-2026-20127, an authentica...
@bleepingcomputer · Oct 29, 2026
Volt Typhoon Used Silent Train to Hide Zero-Day Attacks https://securityaffairs.com/202023/intelligence/volt-typhoon-used-silent-train-to-hide-zero-day-attacks.html
@PentestingNews · Oct 29, 2026
Volt Typhoon Used Silent Train to Hide Zero-Day Attacks https://ift.tt/djABosH
@ctinow · Oct 29, 2026
Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network https://ift.tt/LSNEVJe
@ctinow · Oct 29, 2026
ALERT - Hackers exploited a critical Cisco SD-WAN flaw (CVSS 10.0) to plant "KeyDrift" malware designed to steal encryption keys protecting traffic between sites. The malware also provides backdoor ac...
@thehackernews · Oct 29, 2026
Researchers uncover Volt Typhoon’s covert, ephemeral network https://cyberscoop.com/volt-typhoon-silent-train-covert-ephemeral-network-black-lotus-labs/
@PentestingNews · Oct 29, 2026
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns https://ift.tt/do0gy4O
@ctinow · Oct 28, 2026
Volt Typhoon used a covert network of hijacked devices in 4 confirmed zero-day exploitation campaigns. Dubbed "Silent Train," it concealed attacks on enterprise management systems and supported strate...
@thehackernews · Oct 28, 2026
Researchers uncover Volt Typhoon’s covert, ephemeral network https://cyberscoop.com/volt-typhoon-silent-train-covert-ephemeral-network-black-lotus-labs/
@secharvester · Oct 28, 2026

Other topics

CVE
Recent CVE identifiers and vulnerability disclosures aggregated from security feeds: new IDs, published advisories, and the vendors and products they affect.
Ransomware
Ransomware attacks, extortion group activity, victim disclosures and decryptor releases.
Phishing
Phishing campaigns, credential-harvesting kits, and social-engineering techniques used to compromise users and organizations.
Zero-Day
Zero-day vulnerabilities being actively exploited before a patch exists, and the fixes that follow.
Data Breach
Confirmed and reported data breaches: what was exposed, which organizations were affected, and how the incident came to light.
Exploit
Public exploit code, proof-of-concept releases, and technical exploitation write-ups for known vulnerabilities.