State-Sponsored & APT
Cybersecurity news in this category
Iranian Hackers Disable Safety Alarms in US Industrial Control Systems
Russian State-Supported Group LAUNDRY BEAR Exploits Zero-Day CVE-2025-66376 in Zimbra Collaboration Suite
Russian Intelligence Hijacks Exposed Security Cameras in Europe and Ukraine for Military Surveillance
US Accuses Russian Cybersecurity Specialist D.O. of Void Blizzard Attacks on European Governments and US Companies, Kaspersky Ties Emerge
American authorities have charged Russian information security specialist D.O. with participating in cyberattacks by the Void Blizzard group, also known as Laundry Bear, targeting NATO-aligned European government agencies and at least 11 US companies since 2023. D.O., who previously held a senior position at one of Russia’s largest cybersecurity firms widely identified as Kaspersky, did not plead guilty during a court hearing in Boston. The US Department of Commerce banned the company’s software in 2024 over national security concerns, while European agencies had issued similar warnings earlier. Prosecutors also linked D.O. to a Nizhny Novgorod IT company where he served as deputy director from 2024, although his earlier Kaspersky employment was confirmed through salary records and a former colleague rather than the indictment itself. D.O. graduated from Bauman Moscow State Technical University with a degree in information security, an institution previously flagged by European journalists as a potential training ground for state-linked operatives. Experts note that movement between commercial cybersecurity roles and intelligence structures occurs across countries, but D.O.’s guilt remains to be proven in court.
Iranian State-Sponsored Hackers Unveil Cavern C2 Framework: Multi-Format .NET Compilation Bypasses All Security Detection Tools
In July 2026, Check Point Research exposed Cavern Manticore, an Iranian MOIS-linked APT group, actively targeting Israeli IT providers and government entities with a sophisticated modular C2 framework called Cavern (also known as Cav3rn). Unlike previous Iranian groups that rely on public tools, this actor built an entirely custom .NET-based framework deliberately compiled into three incompatible binary formats—pure IL, mixed-mode C++/CLI, and .NET 8 Native AOT—to force analysts to maintain multiple reverse-engineering toolchains and dramatically increase operational costs. The framework achieves near-zero detection rates on VirusTotal by avoiding traditional obfuscation and instead weaponizing compilation formats themselves, with modules running in isolated AppDomains that leave no persistent artifacts. Attackers gain initial access through compromised RMM solutions such as SysAid, abusing legitimate update mechanisms to sideload the Cavern Agent disguised as uxtheme.dll via a WinDirStat DLL side-loading chain. Communication uses XOR encryption with Base64 encoding, fixed Edge User-Agent strings, custom headers, and a unique protocol syntax, while supporting hot updates and aggressive cleanup. The campaign coincides with parallel operations by MuddyWater against regional targets, highlighting Iran’s coordinated escalation in cyberspace and the growing threat of supply-chain trust abuse against MSPs and RMM platforms worldwide.
NSA Revives Elite TAO Hacking Unit Behind Stuxnet and WannaCry to Accelerate Cyber Operations Against China and Adversaries
The U.S. National Security Agency has restored the original name Tailored Access Operations (TAO) to its premier cyber intrusion division as part of a major internal restructuring aimed at speeding up offensive operations against hostile nations, including China. The unit, which operated under the name Office of Computer Network Operations (CNO) following the 2016 NSA21 reforms, will once again function as a distinct entity with its own dedicated building at Fort Meade. The change reverses aspects of the earlier reorganization that had merged offensive operations and intelligence collection into larger directorates, a move former employees say hindered collaboration between developers and operators. Deputy NSA Director Tim Kosiba, a former TAO member, oversaw the revival, which was presented to Defense Secretary Pete Hegseth during his visit to the agency’s headquarters. TAO has long been linked to some of the most sophisticated U.S. cyber tools, including those used in the Stuxnet operation against Iran’s nuclear program and the EternalBlue exploit later deployed in the global WannaCry ransomware attack. The unit develops custom malware, persistence mechanisms, and covert access tools for intelligence collection against foreign targets. Former personnel believe the restored structure will improve attack preparation and innovation, particularly in the era of artificial intelligence.