APT33, Elfin, Peach Sandstorm, HOLMIUM, Refined Kitten, Iran, aerospace, energy, petrochemical, spearphishing, password spraying, Outlook Home Page, Ruler, TurnedUp, DropShot, ShapeShift, StoneDrill 1. Executive Summary APT33 is a suspected Iranian…
1. Executive Summary APT28 is a long-running Russian state-aligned cyber espionage actor widely attributed to the GRU’s 85th Main Special Service Center (GTsSS), military unit 26165, active since at least…
1. Executive Summary LAPSUS$ is an extortion-focused cybercriminal collective best known for high-tempo intrusions against large enterprises and service providers, frequently leveraging social engineering and identity compromise rather than exploiting…
1. Executive Summary Cl0p (often written “CL0P”) is a financially motivated extortion operation best known for high-scale data theft campaigns that disproportionately impact organisations running internet-facing Managed File Transfer (MFT)…
1. Executive Summary In late June to early July 2025, multiple airlines disclosed cybersecurity incidents affecting internal systems and/or customer data, with reporting and government/industry warnings pointing to activity consistent…
1. Executive Summary A cluster of ransomware intrusions attributed to Akira affiliates surged in late July 2025, with defenders reporting initial access via SonicWall Gen 7 (and newer) firewalls where…
Note on timing: Public reporting and official disclosures indicate the intrusion began in February 2024, while October 2024 is significant because Change Healthcare informed HHS OCR that ~100 million individual…
1. Executive Summary In a financially motivated campaign attributed to the Lazarus Group’s BlueNoroff ecosystem, attackers weaponised a Google Chrome zero-day in the V8 JavaScript engine to compromise victims who…
Cisco is investigating a recent data breach after a threat actor known as “IntelBroker” claimed to have stolen sensitive data from the company’s internal repositories and has listed it for…
Overview Ivanti’s Cloud Services Appliance (CSA) has become a prime target for nation-state actors exploiting zero-day vulnerabilities to gain unauthorised access to critical infrastructure. Fortinet’s recent report unveils that these…