Loading story…
Reporting tied to Google’s Threat Intelligence Group (GTIG) and Mandiant describes ongoing nation-state cyber operations affecting critical infrastructure and defense-related targets, including activity attributed to Russian actors in Ukraine and broader campaigns against Western logistics and technology entities. Ukrainian officials said Russian intrusions into the power sector are increasingly used for intelligence collection—such as facility mapping and monitoring repairs—to support or assess missile strikes, rather than purely to cause operational disruption. Separate threat reporting also described China-aligned activity (e.g., UnsolicitedBooker) targeting telecom providers in Kyrgyzstan and Tajikistan using phishing-delivered backdoors (LuciDoor and MarsSnake) capable of command execution and data theft, with some operations leveraging compromised routers for command-and-control.
A technical review of the GTIG/Mandiant reporting identified potential indicator-of-compromise (IOC) quality issues in a prior CISA alert (AA25-141A) that shared overlapping domains, despite the CISA alert being framed around Russian GRU Unit 26165 / APT28. The analysis flagged likely typos that could misdirect defenders—such as accesscan[.]org (suspected to be accesscam[.]org) and glize[.]com (suspected to be giize[.]com or gleeze[.]com)—noting that the corrected-looking domains were associated with dynamic DNS provider Dynu Systems, while glize[.]com appeared to have been a legitimate marketing site. The overlap and possible transcription errors underscore the need for defenders to validate IOCs before enforcement actions (blocking/sinkholing) and to treat government-published indicators as inputs requiring corroboration rather than as authoritative ground truth.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Mandiant's 2025 M-Trends report found that voice phishing rose to become the second most common initial access vector overall and the leading tactic for cloud compromises. The report also highlighted rapid access hand-offs to ransomware actors, long dwell times tied to edge-device abuse, and suspected UNC6201 use of Brickstorm and stolen credentials to persist in VMware environments.
A Netresec analysis identified suspected transcription errors in domain IOCs published by CISA in alert AA25-141A, including accesscan[.]org and glize[.]com. The post warned that such mistakes could misdirect defenders and potentially implicate benign infrastructure, noting overlap with domains cited in Google Threat Intelligence Group and Mandiant reporting.
Researchers observed UnsolicitedBooker targeting telecommunications companies in Kyrgyzstan and Tajikistan, marking a geographic and sectoral shift in the cluster's activity. The campaign used phishing emails with malicious Office documents to deploy the LuciDoor and MarsSnake backdoors via associated loaders.
At the Kyiv International Cyber Resilience Forum, Ukrainian officials said Russia uses cyber access before missile attacks to prepare targeting and after attacks to assess strike effectiveness and refine follow-on operations. They said the pattern aligns with recent reporting that Sandworm has prioritized intelligence gathering.
Ukrainian cyber officials said Russian intrusions against energy infrastructure increasingly focused on intelligence collection to support missile strikes rather than causing direct disruption. The activity included mapping facilities, monitoring repair crews, and tracking restoration efforts before and after strikes.
The China-aligned activity cluster UnsolicitedBooker has been active since at least March 2023. Early activity previously focused on entities in Saudi Arabia before later expanding to Central Asian telecommunications targets.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcenetresec.com
Open sourcevulnu.com
Open sourcescworld.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Threat Intelligence Group (GTIG) reported that the **defense industrial base (DIB)** is under sustained, multi-vector pressure from state-backed and aligned actors seeking to steal sensitive military technology, disrupt supply chains, and undermine national security. The report highlights Russian-linked activity focused on **unmanned aircraft systems (UAS)** and other emerging technologies, including **TEMP.Vermin** using drone-themed lures to deliver malware and **APT44 (Sandworm/GRU)** targeting military personnel devices with tooling such as **INFAMOUSCHISEL** to harvest data from battlefield-related applications; it also notes some Russian operators are using **LLMs** to improve reconnaissance and social-engineering effectiveness. GTIG also describes North Korea’s continued use of **IT-worker/insider** placement to generate revenue and access within Western organizations. Separately, reporting on **Transparent Tribe (APT36)** describes ongoing espionage campaigns against Indian government and defense targets across Windows and Linux, including spear-phishing that deploys **Geta RAT** and execution chains abusing legitimate Windows components (e.g., `mshta.exe`) and **XAML deserialization** for evasion, alongside a shift toward more mature Linux tooling and persistence. A third report (Picus Labs’ *Red Report*) is broader trend research rather than a specific incident, claiming ransomware encryption is declining while “**sleeperware**”/dormant extortion tradecraft is rising based on ATT&CK technique prevalence across large-scale simulation and telemetry; it does not materially add to the defense-sector espionage narrative beyond general attacker TTP trends.
Jun 29, 2026
Google’s Threat Intelligence Group (GTIG) reported sustained and expanding cyber operations against the **defense industrial base (DIB)** by state-linked and aligned actors from **China, Iran, North Korea, and Russia**, driven by battlefield technology demands and geopolitical conflict. Reported themes include targeting defense organizations supporting the Russia–Ukraine war, **social engineering and recruitment/hiring-process abuse** aimed at employees (notably attributed to North Korean and Iranian activity), increased reliance on **edge devices and appliances** for initial access by China-nexus groups, and heightened **supply-chain exposure** tied to compromises in adjacent manufacturing ecosystems. The reporting highlights specific tactics and actor activity, including Russia-linked **APT44 (Sandworm)** efforts to access data from **Telegram and Signal**, including use of a Windows batch script (`WAVESIGN`) to decrypt and exfiltrate data from Signal Desktop after likely obtaining physical access to devices in Ukraine. Additional activity described includes Ukraine-focused campaigns using defense-themed lures (e.g., drones and counter-drone systems) and broader nation-state use of **zero-day exploitation in edge devices** to establish footholds in defense contractors’ networks, reinforcing GTIG’s assessment that “pre-positioning” and continuous access-building are now baseline expectations for DIB organizations.
Jun 29, 2026
Multiple reports and leaked documents indicate **China-linked cyber operations** are expanding in scale and sophistication, with a strong emphasis on targeting government, telecommunications, and other strategic sectors. A Forescout *Vedere Labs* analysis cited by Cybernews reported China as the top origin of threat operations last year (210), with Russia and Iran also major contributors; the reporting also highlighted suspected China-linked activity tied to a multi-year compromise of South Korea’s **Onnara System**, including theft of civil servants’ **GPKI certificates and credentials**, and noted Taiwan’s National Security Bureau reporting an average of **2.63 million attacks per day** last year. Separately, leaked technical materials reviewed by Recorded Future News describe a purported Chinese internal training environment—part of an integrated system called **“Expedition Cloud”**—used to rehearse offensive cyberattacks against replicas of neighboring countries’ real-world networks, including **power/energy transmission, transportation, and smart home infrastructure**. In parallel, a Google Threat Intelligence Group report warned of a “relentless barrage” of nation-state activity against the **U.S. defense industrial base**, describing a shift beyond classic espionage into **supply-chain attacks, workforce infiltration, and battlefield-adjacent operations**; Google attributed much of the activity to **Chinese, Russian, Iranian, and North Korean** actors and noted continued Russian targeting of organizations supporting Ukraine, including phishing, malware aimed at mobile battlefield-management apps, and attempts to access encrypted messaging platforms.
Jun 29, 2026