APT28 (aka Fancy Bear or UAC-0001) has launched a sophisticated espionage campaign targeting European military government, and transportation entities, The attackers weaponized a newly disclosed Microsoft Office 1-day (CVE-2026-21509) within 24 hours of its public revelation, using spear-phishing documents, a multi-stage infection chain and novel payloads.
Read More →A Russian APT has been targeting Spain, Lithuania, Bulgaria, and more, since at least 2023.
Read More →UNC1151 has operated with a higher operational tempo in 2025, and in this blog, Labs shows how to track this actor, by surfacing two clusters of activity, and tying it to previously attributed samples.
Read More →Follow along as StrikeReady Labs highlights four techniques that were useful to surface four different clusters of targeted threat activity in 2025.
Read More →Mustang Panda continues targeting European governments.
Read More →Earlier in 2025, an apparent sender from 193.29.58.37 spoofed the Libyan Navy’s Office of Protocol to send a then-zero-day exploit in Zimbra’s Collaboration Suite, CVE-2025-27915, targeting Brazil’s military. This leveraged a malicious .ICS file, a popular calendar format.
Read More →Sidewinder APT is leveraging the ongoing turmoil in Nepal to distribute mobile malware.
Read More →Between March and July 2025, DPRK-linked actors are believed to have carried out at least 19 spear-phishing email attacks against embassies worldwide, impersonating trusted diplomatic contacts and luring embassy staff with credible meeting invites, official letters, and event invitations.
Read More →A South Asian APT has been persistently targeting Sri Lanka, Bangladesh, Pakistan, and Turkey. This post walks through infrastructure and malware pivots to expose novel tooling that compromised the phones of military-adjacent folks.
Read More →A blog that describes tracking a targeted threat actor using StrikeReady, passive dns, ssl certificates, and malware analysis.
Read More →A blog that describes tracking a targeted threat actor using StrikeReady, passive dns, ssl certificates, and malware analysis.
Read More →