SOC status:Duty analyst on shift
Topic
19 articles tagged Nation-state threats.
The NCSC, FBI and AIVD have exposed Iranian spyware — CHOSEN BRICK — used to surveil dissidents, activists and journalists. What the campaign does, who is really at risk, and the practical steps that protect the people targeted and the organisations around them.
An insights article assessing pro-Russian cyber activity with a situational briefing on hybrid threats to UK-aligned institutions. Includes a side-by-side comparison of key threat groups including KillNet, NoName057(16), and XakNet.
An insights post exploring the stealthy methods of state-aligned threat actors, including Silent Ransom (Silk Typhoon), and how defenders can detect slow exfiltration and cloud-based command and control in enterprise environments.
A threat profile of XakNet Team, a pro-Russian hacktivist group engaged in disinformation and cyber attacks against Ukrainian and NATO-aligned entities, with strong propaganda links and a focus on psychological impact.
A threat profile of UserSec Collective, a pro-Russian hacktivist group known for DDoS attacks, Telegram-based propaganda, and politically motivated disruptions targeting NATO-aligned countries and public services.
A threat profile of TA406 (Phosphorus), an Iranian state-aligned threat group specialising in spear-phishing, credential harvesting, and long-term espionage against government, defence, and academic institutions.
A threat profile of Sandworm, a destructive Russian GRU-linked cyber group responsible for attacks on Ukraine’s power grid, the NotPetya worm, and persistent campaigns targeting critical infrastructure across Europe.
A threat profile of NoName057(16), a pro-Russian hacktivist group known for politically motivated DDoS campaigns targeting European governments, media, and infrastructure during the Ukraine conflict.
A threat profile of Mustang Panda, a China-based cyber espionage group known for targeting government entities, NGOs, and think tanks across Europe and Asia using custom malware and socially engineered lures.
A threat profile of KillSec, a politically motivated hacktivist group known for DDoS attacks, website defacement, and data leaks targeting Western governments and critical services.
A threat profile of KelvinSec, a financially motivated threat group known for data leaks, opportunistic breaches, and underground marketplace activity targeting organisations across Europe and the Middle East.
A threat profile of Ghostwriter (UNC1151), a Belarus-aligned cyber influence operation and espionage actor targeting NATO states through credential theft, disinformation, and psychological operations.