This roundup describes a real BITTER APT espionage campaign aimed at government, energy, and engineering organizations in South Asia. Attackers used files made to look like diplomatic or military documents to persuade recipients to open them, then installed spyware that could collect information and move files.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
“Please review the attached diplomatic briefing document.” Would you open it? BITTER APT sent files dressed as diplomatic and military documents to government, energy, and engineering teams in South Asia. Opening one could install PapRAT spyware. Here’s the tell: sensitive-looking doesn’t mean authentic. If you weren’t expecting the briefing, and can’t confirm the sender or why you got it, don’t trust the attachment. Before opening an unexpected briefing, confirm it with the sender using a contact method you already know.
Russia-aligned group Gorbag targeted Ukrainian public-sector and defense organizations with spearphishing emails disguised as administrative fines and tax matters. The messages delivered malicious files that stole browser passwords, VPN settings, documents, and electronic-signature keys,…
A real phishing campaign targeted Indian businesses and individual taxpayers by impersonating government departments and sending emails that look like official GST tax notices. The goal was to trick recipients into opening convincing “refund/compliance” documents that install Remcos RAT to steal…
Russia-aligned Gorbag targeted Ukrainian government, law-enforcement, and defense organizations with spear-phishing emails disguised as official administrative fines or tax notices. The emails carried malicious attachments, including macro-enabled Excel files, that installed data-stealing malware…
Researchers report that the threat actor Silent Lynx ran multiple real-world spear‑phishing campaigns against government organizations across Central Asia and the wider CIS region. Victims were lured with official-looking documents (e.g., diplomatic letters, airspace applications, and oil refinery…
The recap describes a real phishing operation by the Russia-linked group Star Blizzard, which used email “invitations” to trick targets into engaging and then opening a password-protected archive. The approach is designed to reduce friction, only one click/open action is needed, making it easier…
Bitdefender reports a China-linked espionage campaign (“SilkParasite”) targeting government bodies in Central Asia using spearphishing emails carrying malicious Microsoft Office documents. The malware is designed to stay quiet and blend in, including using Google Drive as a communications channel…
