Recent Defense Sector Cyber Attacks

Russia-aligned Gorbag has targeted Ukrainian government, justice, defense, and logistics organizations with convincing spearphishing emails. The group used a compromised local-government email account to send a fake administrative-fines notice with a malicious Excel attachment, then shifted to…

Russia-aligned group Gorbag targeted Ukrainian public-sector and defense organizations with spearphishing emails disguised as administrative fines and tax matters. The messages delivered malicious files that stole browser passwords, VPN settings, documents, and electronic-signature keys,…

Russia-aligned group Gorbag targeted Ukrainian government, justice, defense, and transport organizations with spearphishing emails disguised as routine administrative fines and tax notices. The group used compromised government email accounts and weaponized attachments to steal browser passwords,…

Russia-aligned group Gorbag targeted Ukrainian government, justice, defense, and military-aid transport organizations with phishing emails carrying malicious attachments. The emails were disguised as official administrative fine or tax documents, and opening them enabled theft of passwords, VPN…

Russia-aligned Gorbag targeted Ukrainian government, law-enforcement, and defense organizations with spear-phishing emails disguised as official administrative fines or tax notices. The emails carried malicious attachments, including macro-enabled Excel files, that installed data-stealing malware…

Hackers reportedly compromised emergency-alert apps in Ukraine and Russia and used them to send false warnings of nuclear, radiation, chemical, and military threats. The incident exploited fear during an active conflict, and Ukrainian officials warned that at least one message included a link that…

A U.S. defense contractor admitted that co-conspirators used his identity and security clearance to apply for remote jobs at U.S. companies, including work tied to a military AI project. The case shows how fraudulent remote-job applicants can use a trusted U.S. identity, receive company equipment…

A U.S. defense contractor employee admitted helping a North Korean remote-worker operation by allowing foreign workers to use his identity to apply for remote jobs. The operation secured nine job offers from U.S. companies and relied on identity impersonation and employer-provided laptops hosted at…

Microsoft reports that North Korean threat actors are using AI to make job scams, fake recruiter outreach, fraudulent worker identities, and targeted phishing campaigns faster and more convincing. One group posed as recruiters for a spoofed AI blockchain company and scheduled software-engineer…

Employers are encountering fraudulent job candidates who use real-time face swaps and cloned audio to pass remote interviews, then send a different person to onboarding. The article describes this as a real and growing hiring-fraud problem, especially for high-access technology and defense roles,…

Russia-linked APT28 hackers successfully entered a NATO-member shipbuilder’s network after an employee opened an infected Microsoft Word document. The attackers used the foothold to communicate with the compromised machine, collect information, and map the company network as part of a wider…

US authorities arrested two Americans accused of helping North Korean “fake IT workers” get hired remotely at US companies and route company laptops into US-based “laptop farms.” The scheme used stolen or fake identities and location-masking tools so overseas workers could appear to be working from…

Russia-aligned actor UAC-0099 targeted Ukrainian government personnel using malware (ASHVEIN) that steals credentials and enables remote control. A key lure described is a malicious .NET file that shows a decoy Microsoft Word document pretending to be an official response from Ukraine’s National…

Leaked chat logs linked to the Silent Ransom Group describe efforts to pressure U.S. law firms through extortion and, unusually, by sending in-person “agents” to physically enter offices and copy data. The FBI previously warned that people tied to the group were posing as IT staff to gain access,…

Researchers say the Russia-aligned group UAC-0099 has been phishing Ukrainian organizations with malicious links that install a data-harvesting malware called MatchBoil. The emails have included lures like fake Ukrainian court summonses, and clicking the link leads to downloading an archive that…

China-aligned threat actor TA419 ran real credential-phishing campaigns targeting U.S. AI policy experts at think tanks, universities, and law firms. The operation used trust-building outreach followed by a shortened link that redirected victims through checks to a fake Microsoft/OneDrive sign-in…

Proofpoint linked China-nexus actor TA419 to credential-phishing campaigns aimed at U.S. AI policy experts, including people at think tanks. The attacker impersonated well-known AI policymakers and an Anthropic executive, using believable “advisory committee” and “research questions” emails to draw…

A China-aligned group (TA419) targeted US AI policy experts by impersonating well-known AI and policy figures and sending friendly “collaboration” emails. If the target engaged, the attackers redirected them through multiple URLs to a fake Microsoft login pop-up designed to steal Microsoft 365…

Proofpoint reports a China-aligned espionage group (TA419) targeted U.S. AI policy experts at think tanks, universities, and law firms using phishing emails that impersonated well-known officials and AI industry figures. The attackers tried to start a conversation first, then sent a shortened link…

A China-aligned group (tracked as TA419) impersonated real AI policy figures and sent benign-sounding outreach to people working on AI policy at US and Japanese organizations. Once targets replied, the attackers sent a shortened link that ultimately led to a fake OneDrive/Microsoft 365 login page…