Sandworm Team is a Russian cyberespionage group that has operated since approximately 2009. The group likely consists of Russian pro-hacktivists. Sandworm Team targets mainly Ukrainian entities associated with energy, industrial control systems, SCADA, government, and media. Sandworm Team has been linked to the Ukrainian energy sector attack in late 2015. This group appears to be closely associated with, or evolved into, TeleBots.
Russian cyber-espionage group UAC-0099, likely linked to Russian interests, has been steadily refining its MatchBoil malware downloader since 2024. The group is believed to be an initial access broker for Sandworm.
ESET researchers have been tracking the evolution of MATCHBOIL, a C# downloader used by the Russia-aligned UAC-0099 APT group since at least 2024. Initially using unprintable Unicode characters for obfuscation and custom…
A new ClickFix attack leverages compromised websites to smuggle malicious payloads through a browser cache, bypassing character limits and security controls. This tactic has been increasingly utilized by threat actors, i…
The Russian threat group Sandworm, linked to Russia's Main Intelligence Directorate (GRU), is leveraging two vulnerabilities in Cisco's Firewall Management Center (FMC) technology to deploy an upgraded version of the Cyc…
Cisco has revealed that three distinct threat groups – including state-sponsored actors and ransomware operators – are exploiting vulnerabilities in their Secure Firewall Management Center (FMC) software to steal credent…
Cisco has warned organizations about a critical vulnerability in their Secure Firewall Management Center (FMC) that has been actively exploited by various threat actors, including state-sponsored groups and ransomware ga…
Cisco Talos is actively tracking exploitation of two vulnerabilities in Cisco Secure Firewall Management Center (FMC) Software. CVE-2026-20079 allows unauthenticated remote access and execution of scripts, while CVE-2026…
Threat actors are increasingly leveraging artificial intelligence to automate and scale cyberattacks, with a recent campaign demonstrating an attacker's ability to autonomously harvest thousands of credentials in under s…
A Russian national, extradited from Cyprus, has been charged with using a network of fake accounts on a freelance platform to spread malware and steal data between 2016 and 2017. The campaign involved distributing malwar…
A leak of Russian cyber-operations training materials reveals a formalized system for channeling university graduates into intelligence, cyber, and security roles within the Russian military. This system, linked to the S…
Several cybersecurity events were highlighted this week, including a reassessment of the Log4j vulnerability as ‘non-finding,’ a ransomware attack against Paylogix exposing sensitive data, and US sanctions against Irania…
Russian state-sponsored threat actors, linked to the Sandworm group, are using fake recruitment campaigns to trick IT professionals in Ukraine into installing malware. They impersonate IT companies like Sopra Steria Bulg…
