FireEye characterizes APT31 as an actor specialized on intellectual property theft, focusing on data and projects that make a particular organization competetive in its field. Based on available data (April 2016), FireEye assesses that APT31 conducts network operations at the behest of the Chinese Government. Also see Hafnium.
A previously undocumented Brazilian banking malware operation, dubbed KREMLIN, has been identified by Elastic Security Labs. The threat actor, active since May 2025, utilizes a multi-stage approach involving JavaScript l…
Chinese threat actors, including UTA0560 (linked to JungleBamboo/APT31), are exploiting a Chrome-Windows zero-day chain to deploy GRIMWEDGE, a JavaScript backdoor. The attackers leveraged a reflected XSS vulnerability to…
A new exploit kit, BlueMoon, rapidly gained traction among multiple threat actors, including Chinese espionage groups and those linked to North Korea. The kit leverages unpatched zero-days in Chrome and Windows to facili…
A previously undocumented exploit kit called BlueMoon, utilized by multiple espionage-motivated threat actors, including a China-aligned group (APT31), has emerged. The kit leverages a chain of vulnerabilities in Google…
A junior hacker, identified as ‘Poisson,’ infiltrated a French automotive business by exploiting vulnerabilities and establishing persistent access after his command-and-control server was taken down. He utilized OpenSSH…
