APT28 (aka Fancy Bear or UAC-0001) has launched a sophisticated espionage campaign targeting European military government, and transportation entities, The attackers weaponized a newly disclosed Microsoft Office 1-day (CVE-2026-21509) within 24 hours of its public revelation, using spear-phishing documents, a multi-stage infection chain and novel payloads.
Read More →A Russian APT has been targeting Spain, Lithuania, Bulgaria, and more, since at least 2023.
Read More →UNC1151 has operated with a higher operational tempo in 2025, and in this blog, Labs shows how to track this actor, by surfacing two clusters of activity, and tying it to previously attributed samples.
Read More →A blog that describes tracking a targeted threat actor using StrikeReady, passive dns, ssl certificates, and malware analysis.
Read More →A blog that describes tracking a targeted threat actor using StrikeReady, passive dns, ssl certificates, and malware analysis.
Read More →