Germany’s security services warned that fake videos circulating online, which purported to reveal ballot manipulation in the country’s upcoming federal elections, were part of a Russian information operation. therecord.media/german-elect...

Employees at major U.S. defense contractors including Lockheed Martin, Boeing, L3Harris, Leidos and Honeywell have been infected with infostealer malware. U.S. military and government agencies were also affected. www.infostealers.com/article/info...

Several Russian state-aligned threat actors target Signal Messenger accounts. Their operational interest has likely been sparked by wartime demands to gain access to sensitive government and military communications in the context of Russia's invasion of Ukraine. cloud.google.com/blog/topics/...

Russia is suspected of compromising the personal email account of British Prime Minister Keir Starmer before he took office. therecord.media/keir-starmer...

Russian influence operation Doppelganger accounts have become active on Bluesky, focusing on narratives discrediting Ukraine and the German coalition government. The campaign also spreads polarizing narratives and sexualized hate against Ukrainian women. alliance4europe.eu/doppelganger...

Russian intelligence agencies, including the GRU and FSB, have reportedly posted job offers with payments between $3,130 and $4,170 to Polish citizens willing to spread disinformation online, according to Poland’s digital affairs minister. therecord.media/poland-accus...

Threat actors from China, Russia, Iran, and North Korea are interacting with Google's LLM model, Gemini, to support their cyberattacks and coordinated information operations. cloud.google.com/blog/topics/...

Chinese state-linked Spamouflage influence operation has repeatedly targeted the Spain-based non-profit Safeguard Defenders and impersonated the organization to spread calls for the Spanish government to be overthrown following deadly floods in Valencia. graphika.com/reports/chin...

Ukrainian military officials, lawmakers, and experts are discussing the creation of a separate branch of Ukraine's Armed Forces dedicated to cyberspace operations, according to the General Staff of Ukraine. kyivindependent.com/ukraine-cons...

The EU sanctioned three hackers from Unit 29155 of Russia's military intelligence service (GRU) for their involvement in cyberattacks targeting Estonian government agencies in 2020. www.bleepingcomputer.com/news/securit...

The Iranian cyber threat actor Handala claimed responsibility for breaching the emergency systems of Maager-Tec at 20 kindergartens across Israel, playing rocket sirens, Arabic messages, and songs that support terror on Sunday morning. www.jpost.com/israel-news/...

A Russian disinformation campaign, Storm-1516, established around 100 fake news sites ahead of Germany's federal election. The traces lead to a former U.S. police officer, the Russian troll factory Internet Research Agency (IRA), and the GRU. correctiv.org/faktencheck/...

Chinese state-sponsored threat actors, including Mustang Panda and Tonto Team, have been targeting Russian aerospace and defense firms. The attacks aimed to steal sensitive information on Russia's advanced weapons programs, particularly nuclear submarines. www.politico.eu/article/chin...

A deal signed last week between Iran and Russia outlines commitments to strengthen their military, security, and technological ties. The agreement includes provisions for cooperation in cybersecurity and internet regulation. therecord.media/russia-iran-...

Social Design Agency (SDA), a Russian organization tied to the Kremlin’s covert influence campaigns, posted over 8,000 political ads on Facebook despite European and American bans on doing business with it. www.nytimes.com/2025/01/17/b...

The Russian state-sponsored threat actor Star Blizzard attempted to compromise WhatsApp accounts of nonprofits supporting Ukraine. It used phishing messages impersonating U.S. government officials, inviting recipients to join a WhatsApp group. therecord.media/russia-star-...

Crew of France's atomic-armed submarines publicly share workouts via the Strava app, inadvertently disclosing sensitive patrol schedule information. www.lemonde.fr/en/videos/ar...

Over the past few years, Barcelona has become a hub for offensive cybersecurity companies, offering attractive tax benefits, fewer restrictions, beautiful beaches, and a vibrant expat community. techcrunch.com/2025/01/13/h...

A Russian state-linked threat actor, sharing overlaps with APT28, conducted a cyber espionage campaign targeting Central Asia, including Kazakhstan and its diplomatic and economic relations with Asian and Western countries. blog.sekoia.io/double-tap-c...

Ukraine’s CERT-UA handled 4,315 cyber incidents in 2024, a 69.8% rise from 2023. The most targeted sectors include local governments, federal government agencies, security and defense, energy, business, and telecommunications. euromaidanpress.com/2025/01/12/r...

Chinese state-sponsored threat actor breached the Philippine government's executive branch and stole sensitive data, including military documents related to the ongoing China-Philippines territorial dispute in the South China Sea. www.bloomberg.com/news/article...

Russia has a special intelligence unit focused on carrying out cyberattacks against Poland, Deputy Prime Minister Krzysztof Gawkowski said. According to him, Poland is the EU member state most frequently targeted by Russia. tvpworld.com/84412549/mos...

Japan has linked more than 200 cyberattacks over the past five years, targeting national security and advanced technology data, to the Chinese cyber threat actor MirrorFace. The targets included Japan's Foreign and Defense Ministries and its space agency. abcnews.go.com/Internationa...

The Lithuanian Ministry of National Defense has officially launched the Lithuanian Cyber Command (LTCYBERCOM), a new unit within the Lithuanian Armed Forces. defence-industry.eu/lithuania-la...

Countries in Central Asia and Latin America base their digital surveillance capabilities on Russia’s System for Operative Investigative Activities (SORM). This will not only increase political repression but also likely grant Russia access to information. www.recordedfuture.com/research/tra...

Taiwan's National Security Bureau stated that the number of cyberattacks on Taiwan in 2024 has doubled compared to 2023. Most of these attacks are attributed to the PRC cyber force. www.nsb.gov.tw/en/#/%E5%85%...

Integrity Tech, a Beijing-based cybersecurity company linked to the Ministry of State Security, was sanctioned by the U.S. Among other things, it aided the Chinese state-sponsored threat actor Flax Typhoon in targeting U.S. critical infrastructure. www.state.gov/sanctioning-...

Atos, a French technology company that secures communications for France’s military and intelligence services, dismissed as “unfounded” claims by the Space Bears ransomware group that it had compromised an internal company database. therecord.media/atos-dismiss...

A Chinese state-sponsored cyber threat actor breached the U.S. Treasury Department's systems this month, stealing documents from its workstations. www.reuters.com/technology/c...

Movement data from VW, Seat, Audi, and Skoda electric cars, along with owners' contact information, were left unprotected in Amazon cloud storage. The 800,000 affected vehicle owners include politicians, police, and intelligence service employees. www.spiegel.de/netzwelt/web...

South Korea has sanctioned 14 North Koreans for their involvement in an overseas IT worker scheme. They are connected to the 313th General Bureau, a subsidiary of the DPRK's Munitions Industry Department (MID). down.mofa.go.kr/www/brd/m_40...

AdNow, a Russian advertising firm, was previously involved in a campaign spreading disinformation about Western coronavirus vaccines. After relocating to Bulgaria, the company has been conducting political influence campaigns in Romania and Bulgaria. www.ft.com/content/a0a0...

The North Korean threat actor UNC4899, associated with the Reconnaissance General Bureau (RGB), stole $308 million in cryptocurrency during an attack on the Japanese crypto exchange DMM Bitcoin. www.bleepingcomputer.com/news/securit...

As North Korea became a key perpetrator of cryptocurrency heists, South Korea and the United States will collaborate on research to develop technologies aimed at preventing cryptocurrency-targeted attacks and tracking stolen assets. koreajoongangdaily.joins.com/news/2024-12...

North Korea's state-sponsored Lazarus Group has been observed targeting employees of an unnamed nuclear-related organization. thehackernews.com/2024/12/laza...

Russia has carried out a cyberattack on Ukraine's state registries, which contain vital information about Ukrainian citizens, such as births, deaths, marriages, and property ownership. www.reuters.com/technology/c...

Russian state-sponsored threat actor Sandworm, in its latest espionage campaign, has targeted Ukrainian soldiers using the newly developed military app Army+, designed to digitize bureaucratic tasks like submitting reports to commanders. therecord.media/ukraine-mili...

In 2024, crypto funds worth $2.2 billion were stolen worldwide. Of this amount, 61%, or $1.34 billion, was stolen by North Korean hackers—more than ever before. www.chainalysis.com/blog/crypto-...

According to French intelligence, over 2,000 European content creators were approached by individuals linked to the Kremlin to spread pro-Russian propaganda. About 20 of them, including nine French nationals, reportedly accepted the offer. www.lemonde.fr/pixels/artic...

During Q4 2024, Google terminated 4,947 YouTube channels associated with Russian coordinated influence operations and 6,318 YouTube channels linked to Chinese ones. blog.google/threat-analy...

Based in the United Arab Emirates (UAE), Chinese nationals were involved in laundering millions of dollars in illicit funds generated by North Korea's IT worker schemes and cybercrime to support the DPRK government. home.treasury.gov/news/press-r...

U.S. authorities are considering a ban on TP-Link, a China-based router manufacturer, whose equipment has been repeatedly targeted in Chinese cyberattacks. TP-Link currently holds approximately 65% of the U.S. market for SOHO routers. www.wsj.com/politics/nat...

German security authorities have arrested a 24-year-old on suspicion of aiding DDoS attacks carried out by the Russian threat actor Killnet. The arrest is part of Europol's "Power OFF" operation. www.bild.de/regional/sch...

Serbian police and intelligence agencies reportedly used phone spyware and mobile forensic tools developed by the Israeli company Cellebrite to extract data from the mobile devices of journalists and activists. securitylab.amnesty.org/latest/2024/...

Fourteen North Korean nationals have been indicted for conspiring to secure remote IT work in the U.S. using stolen identities. Operating through front companies in China and Russia, they generated $88 million over six years for the North Korean regime. www.justice.gov/opa/media/13...

The Iranian threat group CyberAv3ngers, linked to the Islamic Revolutionary Guard Corps (IRGC), has used custom-built malware to target IoT and operational technology devices in the U.S. and Israel. The group’s primary focus is on civilian critical infrastructure. claroty.com/team82/resea...

Earlier this year, the Russian state-sponsored cyber threat actor Secret Blizzard, linked to Russia’s Federal Security Service (FSB), utilized cybercrime infrastructure to compromise devices associated with the Ukrainian military. www.microsoft.com/en-us/securi...

The U.S. has sanctioned the Chinese government cybersecurity contractor Sichuan Silence and one of its employees for compromising 81,000 firewalls, including some belonging to U.S. critical infrastructure, and carrying out Ragnarok ransomware attacks. www.bleepingcomputer.com/news/securit...

A suspected Russian cyber threat actor has been targeting Ukrainian military and defense enterprises by sending phishing emails inviting recipients to a conference in Kyiv on transitioning Ukrainian defense industry products to NATO standards. therecord.media/suspected-ru...

A programmer reported that the Russian Federal Security Service (FSB) installed spyware on his Android phone after detaining him in Moscow earlier this year. Security researchers confirmed the presence of spyware on his device. techcrunch.com/2024/12/05/r...