NSA Revives Elite TAO Hacking Unit Behind Stuxnet and WannaCry to Accelerate Cyber Operations Against China and Adversaries
The U.S. National Security Agency has restored the original name Tailored Access Operations (TAO) to its premier cyber intrusion division as part of a major internal restructuring aimed at accelerating offensive operations against hostile nations, including China.
Until recently, the unit operated under the name Office of Computer Network Operations (CNO). The decision to revive the well-known TAO designation reverses part of the NSA21 reform launched in 2016, which had distributed offensive operations and intelligence collection across larger directorates and eliminated TAO as a standalone structure.
Former NSA employees noted that the previous reorganization failed to improve collaboration between developers and operators and instead created greater separation. The revival was overseen by Deputy NSA Director Tim Kosiba, who previously served in TAO. The updated organizational structure was presented to U.S. Defense Secretary Pete Hegseth during his visit to Fort Meade, home to both NSA and U.S. Cyber Command headquarters.
Starting next month, TAO will receive its own dedicated building within the Fort Meade complex. Former personnel believe that reuniting developers and operational teams will accelerate the preparation of cyber attacks and help discover new methods of penetrating highly protected networks, especially amid rapid advances in artificial intelligence.
TAO specializes in creating custom tools for covert access to foreign computer systems. These include malware, persistence mechanisms, and other specialized implants used in intelligence-gathering operations.
The unit has been linked to several high-profile cyber operations and tools. It played a role in developing Stuxnet, the sophisticated worm used to disrupt Iran’s nuclear enrichment program. TAO also became the focus of attention after the Shadow Brokers group leaked stolen NSA tools, including the EternalBlue exploit.
EternalBlue was later weaponized in the WannaCry ransomware attack of 2017, which spread to approximately 150 countries and affected around 200,000 organizations worldwide.
Around the same period, former NSA contractor Harold Martin, who worked in TAO between 2012 and 2015, was accused of storing a massive collection of classified materials at his home. In 2019 he was sentenced to nine years in prison, although investigators never proved he had shared the stolen information with others.
Related articles
Three Hacker Castes: How Script-Kiddies, Codemasters and Grandmasters Operate and Why Advanced Attacks Evade Detection
JET CSIRT analyst Maxim Kishmereshkin breaks down real-world incidents showing that attackers fall into three distinct castes based on their tooling and sophistication. Script-kiddies rely on off-the-shelf utilities and are often stopped by basic antivirus, while codemasters modify existing tools to bypass signatures and leverage living-off-the-land binaries. Grandmasters develop custom fileless loaders and signed malware, as demonstrated in a recent Cavalry Werewolf campaign that used a trojanized 7-Zip binary and Adaptix C2 framework. The investigation revealed how attackers revived a decommissioned domain controller, used stolen credentials of former employees, and exfiltrated sensitive data entirely from memory. The report emphasizes that modern attacks mimic legitimate processes such as PowerShell commands or accounting software, making signature-based detection ineffective. Defense requires layered controls including EDR, behavioral rules, vulnerability management, and regular hardening to counter each caste level.
Russian-Aligned Gorbag Group Exploits WinRAR CVE-2025-8088 to Steal Credentials from Ukrainian Government Bodies
ESET has published a detailed report on the Gorbag threat group, a Russia-aligned actor active since at least February 2025, that has adopted the WinRAR path traversal vulnerability CVE-2025-8088 to deliver the BeautyStealer password stealer against Ukrainian public sector targets. The flaw, fixed in WinRAR 7.13, allows attackers to escape the chosen extraction folder and write files to arbitrary locations using Windows alternate data streams. Upon opening the malicious RAR archive, victims see a decoy PDF while a Windows startup shortcut and PowerShell loader are silently installed to maintain persistence. BeautyStealer, written in C++, harvests saved passwords, cookies, and browsing data from Chrome, Edge, Opera, and Firefox, along with OpenVPN configurations, KeePass databases, Java key files, and Ukrainian electronic signature keys. The group previously relied on malicious Excel macros in 2025 before switching to RAR-based delivery that requires no user interaction beyond opening the archive. Stolen data is exfiltrated via the Telegram API or, from version 1.2 onward, to attacker-controlled servers. ESET links the operation to earlier activity tracked as GIFTEDCROOK and UAC-0226 by CERT-UA.
Positive Technologies Analyzes 140 Incidents: Web Applications Drive Half of Breaches, APT Groups Found in 49% of Cases
Positive Technologies' Incident Response team examined more than 140 full-cycle investigations and retrospective analyses conducted between Q4 2025 and Q3 2026. Web applications on the perimeter remained the leading initial access vector, accounting for 50.8% of incidents, with newly targeted services including Zimbra mail servers and TrueConf video-conferencing platforms. APT activity was detected in 49.3% of victim organizations, while supply-chain attacks through contractors and ViPNet networks still represented 14.9% of entries despite a decline from the previous year. Industry became the most affected sector at 22.5%, and median time to bring incidents under control after engagement stood at two days. Root causes continued to center on outdated software, missing multi-factor authentication, and poor network segmentation. Three previously unknown APT groups—APT10051, Stingy Basilisk, and Chewbacca—were identified during the investigations.
Peskov Rejects Claims of Russian Involvement in European Refrigeration System Attacks
Kremlin spokesman Dmitry Peskov has dismissed accusations that Russian-linked cyber groups were behind recent attacks on industrial refrigeration equipment across nine European countries. The incidents, which occurred in early November, involved unauthorized changes to temperature settings on internet-connected cooling systems, with some units pushed to +50 °C. Similar attacks had already been reported in France during October, affecting meat producers and other facilities that rely on precise climate control. Peskov described the allegations as lacking any evidence and part of a recurring pattern of unsubstantiated claims directed at Russia by European nations. The targeted systems are typically connected online for remote maintenance and fault alerts, a feature that becomes a liability when external actors gain access. No group has claimed responsibility for the October or November operations, leaving attribution unconfirmed. The events highlight risks associated with exposing industrial control equipment directly to the internet without adequate segmentation or authentication controls.