Verticals Targeted: Policy Organizations, Academia, International Cooperation Organizations, Diplomatic Missions, Military, Security, Security Research, Virtual Assets
Regions Targeted: South Korea
Related Threat Actors: Kimsuky
Executive Summary
Researchers identified a continuation of the North Korean Kimsuky cyber espionage campaign, designated Operation GitPower, which combines established spear-phishing techniques with emerging artificial intelligence capabilities. While the campaign continues to rely on malicious LNK files, PowerShell loaders, and GitHub-hosted C2 infrastructure, investigators also uncovered evidence that the threat actor has deployed local large language model (LLM) environments, retrieval-augmented generation (RAG), AI development frameworks, and speech-to-text tools. The findings suggest Kimsuky is systematically building AI-enabled operational capabilities to support future espionage activities rather than merely experimenting with generative AI.
Verticals Targeted: Information Technology, Mining, Transportation and Logistics, Manufacturing, Hospitality, Consumer Goods
Regions Targeted: Europe, Asia, North America, South America, Africa
Related Families: Mini Shai-Hulud, ChainDrop
Executive Summary
Industry researchers identified a large-scale software supply chain attack involving more than 400 compromised npm packages distributed across multiple unrelated publishers. The campaign delivers a new variant of the Mini Shai-Hulud malware, dubbed ChainDrop, through malicious preinstall lifecycle scripts, enabling credential theft, cloud and infrastructure enumeration, repository compromise, and automated propagation using stolen npm publishing credentials. By targeting both developer workstations and CI/CD environments, the campaign demonstrates how modern software supply chain attacks increasingly leverage trusted developer identities to compromise downstream software ecosystems.
Verticals Targeted: Government, Ministries of Foreign Affairs, Healthcare, Research, Logistics, Law Enforcement, Urban Planning and Facilities Management, Education
Regions Targeted: Afghanistan, Kazakhstan, Kyrgyzstan, Syria, Tajikistan, Uzbekistan
Related Families: OctLurk, SilkLurk, LurkProxy, PlugX
Executive Summary
Industry researchers have identified a sophisticated cyber espionage campaign leveraging two previously undocumented malware families, OctLurk and SilkLurk, against government organizations and public-sector entities across Central Asia and the Middle East. Both modular backdoors employ victim-specific decryption, extensive obfuscation, and in-memory execution to evade detection while enabling credential theft, remote access, network reconnaissance, and plugin-based expansion. Researchers also identified a companion utility, LurkProxy, used to proxy attacker traffic.
Verticals Targeted: Cryptocurrency
Regions Targeted: United States, Germany, Romania, Venezuela
Related Families: Starland RAT, WLDR Framework, Remcos RAT, CastleStealer
Executive Summary
Industry researchers identified a financially motivated, Russian-speaking threat actor tracked as UAT-11795 conducting a sophisticated malware campaign targeting users primarily in the United States since at least June 2025. The operation employs suspected ClickFix-style social engineering, trojanized software installers, and a custom Python-based remote access tool, Starland RAT, to establish persistent access and deploy additional malware, including the previously undocumented WLDR PowerShell framework, CastleStealer, and Remcos RAT. The campaign demonstrates a modular architecture, resilient C2 infrastructure, and a strong emphasis on credential theft, cryptocurrency wallet harvesting, and long-term post-compromise access.
Verticals Targeted: Aerospace, Aviation, Defense, Telecommunications, Government, Financial Services, SMBs
Regions Targeted: Egypt, Jordan, Tanzania, Pakistan, Ethiopia, Burkina Faso
Related Threat Actors: Mirage Kitten
Related Families: NightLedger, BridgeHead, ArcBridge
Executive Summary
New research details the continued evolution of Mirage Kitten, an advanced persistent threat (APT) group conducting cyber-espionage operations across the Middle East and Africa. The campaign introduces three previously undocumented malware families, NightLedger, BridgeHead, and ArcBridge, that provide reconnaissance, command execution, covert tunneling, and persistent post-compromise access capabilities. The findings demonstrate Mirage Kitten's continued investment in bespoke malware development and operational security to support long-term intelligence collection.
Verticals Targeted: Government, Water, Energy, Critical Infrastructure
Regions Targeted: US