Verticals Targeted: Government, Healthcare, Manufacturing, Information Technology, Law Enforcement, Education, Religious Organizations
Regions Targeted: North America, Southeast Asia, Africa
Related Threat Actors: Flax Typhoon
Verticals Targeted: Critical Infrastructure, Defense
Regions Targeted: United States
Related Threat Actors: Volt Typhoon, QTFY, CyberAv3ngers, FSB Center 16, GRU Unit 29155, Cyber Army of Russia Reborn, NoName057(16), Z-Pentest, Sector16
Executive Summary
US critical infrastructure faces an increasingly consequential operational technology (OT) threat as state-sponsored and other cyber actors conduct activity ranging from long-term pre-positioning in critical infrastructure networks to direct exploitation of programmable logic controllers (PLCs) capable of affecting physical processes. Of particular national-security concern, military installations depend on civilian electricity, water, telecommunications, transportation, fuel, manufacturing, and logistics infrastructure located outside Department of War networks and installation boundaries. Disruption of these systems could therefore create military effects without direct compromise of a military installation.
Verticals Targeted: Banking, Aviation, Defense, Healthcare
Regions Targeted: US, Canada
Related Families: Dindoor, Fakeset, Stagecomp, Darkcomp
Executive Summary
Recent reporting indicates Iranian cyber actors are expanding operations targeting US organizations while also exploiting internet-connected cameras across the Middle East for intelligence collection and battlefield awareness. These developments represent another layer in Iran’s evolving hybrid warfare strategy. Iranian APT group MuddyWater has maintained access to multiple US organizations since early February, while Iran-linked infrastructure has targeted internet-connected surveillance cameras across the Middle East. Hacktivist group Handala has recently claimed responsibility for a destructive cyberattack against medical technology firm Stryker. Taken together, these incidents suggest Iran’s cyber ecosystem is currently surviving but not thriving, maintaining operational capability despite disruption to infrastructure and command structures.
Verticals Targeted: Critical infrastructure
Regions Targeted: Ukraine
Related Families: HermeticWiper (aka FoxBlade, NEARMISS)
Executive Summary
PathWiper is a new wiper malware deployed by a Russia-linked APT, targeting Ukraine’s critical infrastructure with destructive intent. The attack leveraged a legitimate endpoint administration framework, highlighting the persistent cyber threat to Ukraine amid ongoing conflict.
Related Families: HellDown
Verticals Targeted: Energy
Executive Summary
HellCat ransomware recently targeted French energy giant Schneider Electric. PolySwarm analysts consider HellCat to be an emerging threat.
Related Families: Qakbot
Verticals Targeted: Critical Infrastructure, Healthcare
Executive Summary
CISA recently issued an advisory warning critical infrastructure entities to harden their defenses against attacks from Black Basta.
Related Families: GreyEnergy, Prestige
Verticals Targeted: Critical Infrastructure
Executive Summary
Kapeka, also known as KnuckleTouch, is a novel backdoor used by VooDoo Bear to target entities in Eastern Europe.
Related Families: Elking, Eight, Devos, Backmydata, Faust, Perdak, CrySiS, Dharma, SmokeLoader, Cobalt Strike, Bloodhound
Verticals Targeted: Critical Infrastructure, Government, Emergency Services, Education, Healthcare