1. Executive Summary APT28 is a long-running Russian state-aligned cyber espionage actor widely attributed to the GRU’s 85th Main Special Service Center (GTsSS), military unit 26165, active since at least…
At-a-glance Attribute Assessment Primary tracking name APT31 (widely used in government and industry reporting) (Department of Justice) Notable aliases Violet Typhoon / ZIRCONIUM (Microsoft), JUDGMENT PANDA (CrowdStrike) (Microsoft Learn) Suspected…
1. Executive Summary LAPSUS$ is an extortion-focused cybercriminal collective best known for high-tempo intrusions against large enterprises and service providers, frequently leveraging social engineering and identity compromise rather than exploiting…
1. Executive Summary Cl0p (often written “CL0P”) is a financially motivated extortion operation best known for high-scale data theft campaigns that disproportionately impact organisations running internet-facing Managed File Transfer (MFT)…
Mandiant and Google Threat Intelligence Group (GTIG) have released critical findings regarding UNC6201, a suspected PRC-nexus threat cluster. This group has been actively exploiting a Dell RecoverPoint for Virtual Machines…
1. Executive Summary A widespread data-theft and extortion campaign has targeted organisations’ Salesforce environments by abusing trusted third-party integrations and malicious OAuth “Connected Apps”—rather than exploiting a core Salesforce software…
1. Executive Summary Notepad++’s update mechanism (WinGUp) was abused in a targeted supply-chain compromise in 2025, where certain users’ update traffic was selectively redirected to attacker-controlled infrastructure and served trojanised…
1. Executive Summary The SolarWinds breach (often tracked as SUNBURST by Mandiant/FireEye and Solorigate by Microsoft) was a landmark software supply-chain compromise in which adversaries trojanised signed SolarWinds Orion software…
Executive Summary Microsoft and CERT/CC have disclosed five vulnerabilities in Paragon Software’s BioNTdrv.sys kernel-mode driver used across the Hard Disk Manager / Partition Manager product line, enabling local attackers to…
1. Executive Summary In late August 2025, Jaguar Land Rover (JLR) suffered a major cyber incident that triggered a precautionary shutdown of internal IT systems and a prolonged disruption to…