Tag: apt28

APT28 Targets Ukrainian Forces While Nation-State Threats Persist Globally

Russian APT28 has been conducting extensive surveillance of Ukrainian military personnel since April 2024 using custom malware. Meanwhile, Finnish intelligence reports persistent cyber espionage from Russia and China targeting government and technology sectors.

Mar 11, 2026Security Affairs, The Record

apt28ukrainerussia

🇷🇺APT28

🇺🇸Google

criticalVulnerabilities & Exploits

CISA KEV Updates, APT28 Campaign, and Agentic AI Security Challenges

CISA flagged three actively exploited vulnerabilities for immediate patching while APT28 continues surveillance operations against Ukrainian forces. Meanwhile, the cybersecurity community grapples with new attack vectors in AI agents and supply chain compromises.

Mar 10, 2026The Hacker News, Microsoft Security, SANS ISC, MSRC Security Updates

cisa-kevapt28agentic-ai

🇷🇺APT28

criticalMalware & Threats

Malware Threats Weekly: CISA Flags Ivanti EPM Zero-Day, APT28 Leverages Covenant Framework, Meta Ad Network Powers Global Scam Operations

CISA ordered federal agencies to patch an actively exploited Ivanti Endpoint Manager vulnerability within three weeks. Russian APT28 operators are using customized Covenant framework tools for espionage, while a massive investment fraud network leveraging Meta advertising platforms has been discovered operating across 25 countries.

Mar 10, 2026BleepingComputer, Checkpoint Research, Malwarebytes Labs, SecureList (Kaspersky), Bitdefender Labs

apt28ivanticisa-kev

🏴ShinyHunters🇷🇺APT28🏴Play

🇺🇸Meta Platforms🇺🇸Google

highVulnerabilities & Exploits

State Actors Unleash New Malware Arsenal as Phishing-as-a-Service Operations Scale Globally

Iran-linked Dust Specter and Russian APT28 campaigns unveiled new malware families targeting government officials in Iraq and Ukraine respectively. Meanwhile, Tycoon2FA phishing-as-a-service operations reached over 500,000 organizations monthly before disruption by Microsoft and Europol.

Mar 5, 2026The Hacker News, Microsoft Security, SANS ISC, MSRC Security Updates

apt28malwarephishing-as-a-service

🇷🇺APT28

🇺🇸Google

highNation-State & APT

APT Roundup: Zero-Day Exploitation, Iranian Cyber Escalation, and AI-Targeted Attacks

APT28 exploited an MSHTML zero-day while APT37 developed new air-gapped infiltration techniques using cloud storage and USB implants. Meanwhile, Iranian cyber threats are escalating amid Middle East tensions, prompting warnings from UK and US authorities.

Mar 3, 2026Security Affairs, The Record, Palo Alto Unit 42

apt28apt37iran-cyber-threats

🇷🇺APT28🇰🇵APT37

🇺🇸Google

criticalVulnerabilities & Exploits

APT28 Exploits MSHTML Zero-Day; North Korean npm Campaign Evolves

Russian APT28 exploited CVE-2026-21513, an MSHTML zero-day vulnerability, before Microsoft's February patch. North Korean threat actors published 26 malicious npm packages using Pastebin for C2 infrastructure in their ongoing Contagious Interview campaign.

Mar 2, 2026The Hacker News, SANS ISC

apt28zero-daymshtml

🇷🇺APT28

highNation-State & APT

Nation-State Activity Roundup: APT28 MacroMaze Campaign, MuddyWater Operations, and Mass Infrastructure Compromises

Multiple nation-state groups remain active with APT28 deploying basic tooling in Operation MacroMaze and MuddyWater conducting Operation Olalampo. Separately, threat actors compromised 900 Sangoma FreePBX instances through CVE-2025-64328 exploitation, maintaining persistent web shell access.

Mar 1, 2026Security Affairs

apt28muddywaterfreepbx

🇷🇺APT28🇮🇷MuddyWater

highVulnerabilities & Exploits

APT28 Macro Campaign, AI Model Theft, and Central Asian Telecom Attacks

APT28 launched Operation MacroMaze against European targets using webhook-based macro malware, while UnsolicitedBooker deployed dual backdoors against Central Asian telecoms. Meanwhile, Anthropic exposed Chinese AI companies conducting industrial-scale model theft through 16 million fraudulent queries.

Feb 24, 2026The Hacker News, SANS ISC

apt28russiabackdoor

🇷🇺APT28