ZCyberNews
中文

#apt

15 articles

Between April and September 2026, ZCyberNews covered 16 high-severity incidents tied to the apt tag, with GopherWhisper, CyberAv3ngers, and HelloNet appearing as the most frequently named threat actors. Reporting focused on attacks against government, energy, cryptocurrency, technology, and aviation sectors, with affected regions including Japan, Mongolia, Afghanistan, Africa, and Asia. All 16 articles were rated high severity, reflecting the consistent operational impact across these campaigns. Coverage tracked actor-specific tactics and sector targeting throughout the five-month period, with no confirmed links drawn between the three groups.

Diagram of Mirage Kitten's attack chain using trojanized coding challenges to deliver NodeRabbit and PollCat RATsHIGH
Threat Intel

Mirage Kitten Deploys Node.js, JavaScript RATs in Aviation, FinTech

Mirage Kitten targets aviation and FinTech sectors across the Middle East and Africa with NodeRabbit and PollCat RATs, delivered via trojanized coding challenges on LinkedIn.

6 min readMirage Kitten
Diagram of HelloNet attack chain showing ViPNet update system DLL sideloading leading to HelloInjector, HelloProxy, and HelloBackdoor modulesHIGH
Threat Intel

HelloNet Campaign Hijacks ViPNet Update System to Deploy Malicious

Kaspersky details HelloNet APT campaign targeting Russian government, energy, and transport sectors via ViPNet update system DLL sideloading since May 2026.

4 min readHelloNet
Silver Fox APT Spoofs Japanese Tax Emails in Targeted CampaignHIGH
Threat Intel

Silver Fox APT Spoofs Japanese Tax Emails in Targeted Campaign

ESET details Silver Fox APT targeting Japanese firms with tax-themed phishing emails delivering malware via weaponized Excel attachments during tax season.

2 min readSilver Fox
GopherWhisper APT Targets Mongolian Government in Espionage CampaignHIGH
Threat Intel

GopherWhisper APT Targets Mongolian Government in Espionage Campaign

ESET discovered China-aligned APT GopherWhisper targeting Mongolian government institutions with custom Go-based malware, leveraging legitimate services for C2.

2 min readGopherWhisper
Tropic Trooper APT Hijacks Home Routers to Target Japanese NetworksHIGH
Threat Intel

Tropic Trooper APT Hijacks Home Routers to Target Japanese Networks

Chinese state-sponsored Tropic Trooper is compromising home routers as proxy footholds to infiltrate Japanese organizations, shifting to novel TTPs and victim sectors.

2 min readTropic Trooper
Unit 42 Tracks TGR-STA-1030 Activity in Central and South AmericaHIGH
Threat Intel

Unit 42 Tracks TGR-STA-1030 Activity in Central and South America

Palo Alto Unit 42 reports TGR-STA-1030 remains active in Central and South America, targeting government and energy sectors with custom malware and living-off-the-land techniques.

2 min readTGR-STA-1030
China-Linked GopherWhisper Hits 12 Mongolian Gov SystemsHIGH
Threat Intel

China-Linked GopherWhisper Hits 12 Mongolian Gov Systems

ESET identified GopherWhisper, a China-aligned APT, breaching 12 Mongolian government systems with Go-based backdoors, injectors, and loaders since early 2026.

1 min readGopherWhisper
GopherWhisper APT Uses Go Tools, Legit Services in Gov AttacksHIGH
Threat Intel

GopherWhisper APT Uses Go Tools, Legit Services in Gov Attacks

GopherWhisper, a new state-backed APT, targets government entities with a Go-based toolkit abusing Outlook, Slack, and Discord for C2.

2 min readGopherWhisper
Lotus Wiper Targets Venezuelan Energy Sector Before US InterventionHIGH
Malware

Lotus Wiper Targets Venezuelan Energy Sector Before US Intervention

Lotus Wiper malware targeted Venezuela's state-owned energy firm PDVSA, destroying data by overwriting drives and deleting files before a US-led intervention in March 2026.

2 min read
SideWinder APT Deploys Fake Chrome PDF Viewer and Zimbra Clone to StealHIGH
Threat Intel

SideWinder APT Deploys Fake Chrome PDF Viewer and Zimbra Clone to Steal

SideWinder APT targets South Asian government bodies with a phishing campaign using a fake Chrome PDF viewer and a cloned Zimbra login portal to steal webmail credentials, active since February 2026.

3 min readSideWinder
North Korean Operatives Use AI and Fake Identities to Infiltrate Companies viaHIGH
Threat Intel

North Korean Operatives Use AI and Fake Identities to Infiltrate Companies via

North Korean operatives are using AI tools and forged documents to pass remote job interviews, according to Flare research. The tactic aims to place threat actors inside target companies for long-term espionage and network access.

3 min readNorth Korean operatives
UNC1069 Targets Crypto Professionals with Fake Zoom and Teams MeetingsHIGH
Threat Intel

UNC1069 Targets Crypto Professionals with Fake Zoom and Teams Meetings

North Korean threat actor UNC1069 lures Web3 professionals with fake Zoom and Microsoft Teams meetings to deploy malware that steals cryptocurrency, according to new research.

3 min readUNC1069
UAC-0247 Threat Actor Deploys Data-Stealing Malware Against Ukrainian TargetsHIGH
Threat Intel

UAC-0247 Threat Actor Deploys Data-Stealing Malware Against Ukrainian Targets

The Ukrainian CERT-UA attributes a new campaign to threat actor UAC-0247, which uses phishing lures to deploy malware that steals data from Chromium browsers and WhatsApp on government and healthcare systems.

4 min readUAC-0247
Sapphire Sleet Targets macOS Users with Fake Zoom SDK UpdateHIGH
Threat Intel

Sapphire Sleet Targets macOS Users with Fake Zoom SDK Update

North Korean threat actor Sapphire Sleet is distributing a new macOS malware via a fake Zoom SDK installer, stealing passwords, crypto wallets, and personal data through a multi-stage social engineering campaign.

4 min readSapphire Sleet
Iranian CyberAv3ngers Escalate Attacks on US Water, Industrial InfrastructureHIGH
Threat Intel

Iranian CyberAv3ngers Escalate Attacks on US Water, Industrial Infrastructure

The Iran-backed threat actor CyberAv3ngers, linked to the IRGC, has evolved from hacktivism to conducting disruptive cyber operations against US water utilities and programmable logic controllers (PLCs).

3 min readCyberAv3ngers

Stay Updated

Get the latest cybersecurity news delivered to your inbox.