Loading story…
U.S. and allied officials have tied multiple high-profile cyber incidents to Russian-linked actors, including the SolarWinds espionage campaign, follow-on targeting of roughly 150 organizations flagged by Microsoft, and newer phishing operations aimed at Signal and WhatsApp users. The activity has also intersected with politically sensitive investigations, including an FBI review of claims that hacked files were involved in a Trump campaign-related incident, underscoring how state-aligned intrusion and influence operations continue to overlap with espionage and credential theft.
At the same time, Russian-speaking cybercriminal ecosystems have remained a major source of disruption through ransomware and fraud. A prominent Russian-speaking ransomware gang was reported to have gone offline, even as ransomware attacks hit public-sector and healthcare victims including Dallas police and court websites and MedStar hospitals. Separate financially motivated operations also showed the breadth of the threat landscape, from the takeover of high-profile Twitter accounts in a bitcoin scam to large-scale phishing campaigns impersonating E-ZPass and USPS, prompting legal action by Google against an alleged Chinese scam ring.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
Dutch officials warned that a Russian-linked campaign was using phishing techniques to target users of Signal and WhatsApp, aiming to compromise accounts and gain access to sensitive communications.
Google sued operators it said were behind a large phishing campaign that impersonated toll agencies and the U.S. Postal Service in scam text messages designed to steal victims' personal and payment information.
The Trump campaign said hacked files had been obtained, and the FBI confirmed it was investigating the matter, marking a federal response to the alleged intrusion involving campaign-related materials.
A ransomware attack affected the City of Dallas, knocking police and court-related websites offline and disrupting some municipal services while officials investigated and worked to restore systems.
A prominent Russian-speaking ransomware gang's infrastructure and public-facing sites went offline, suggesting disruption or a strategic retreat amid heightened international law-enforcement and political pressure.
Microsoft said the Russian-linked group behind the SolarWinds espionage campaign was conducting a new wave of attacks and had targeted roughly 150 organizations, many involved in foreign policy and humanitarian work.
In the days following disclosure of the SolarWinds breach, the company's stock dropped about 23% as investors reacted to the scale and seriousness of the compromise.
SolarWinds disclosed that attackers had inserted malicious code into Orion software updates, enabling a broad espionage campaign affecting U.S. government agencies and private-sector organizations.
Attackers compromised prominent Twitter accounts, including those of Bill Gates and Elon Musk, and used them to post fraudulent bitcoin giveaway messages. The incident exposed weaknesses in Twitter's internal administrative controls.
MedStar Health suffered a ransomware attack that disrupted computer systems across its hospitals and forced staff to rely on paper records and manual procedures while recovery efforts began.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
10 references tracked. Mallory keeps watching after this page renders.
nbcnews.com
Open sourcenbcnews.com
Open sourcenbcnews.com
Open sourcenbcnews.com
Open sourcenbcnews.com
Open sourcenbcnews.com
Open sourcenbcnews.com
Open sourcecnbc.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports highlight active campaigns using *phishing* and *software supply-chain abuse* to steal credentials and establish persistence. eSentire described an espionage-focused operation targeting residents of India with emails impersonating the Income Tax Department, leading victims to a malicious archive that uses DLL side-loading with a legitimate signed Microsoft application, extensive anti-analysis checks, in-memory shellcode unpacking, UAC bypass, and process masquerading; the payload was identified as a **Blackmoon**-family variant that specifically attempts to disable **Avast Free Antivirus** by automating UI interactions to add exclusions. Separately, Aikido reported a malicious npm package (`ansi-universal-ui`) that deploys a multi-stage infostealer (“**G_Wagon**”) by abusing `postinstall` execution, downloading a Python runtime, running an obfuscated payload, and exfiltrating browser credentials, cloud credentials, Discord tokens, and data from 100+ cryptocurrency wallets to an Appwrite storage bucket; it also includes a Windows DLL used for browser-process injection via NT native APIs. In parallel, network-edge exploitation remains a key access vector: Risky Business reported a renewed wave of attacks against **Fortinet FortiGate** devices via a vulnerability Fortinet allegedly “patched” in December but which attackers can still exploit, enabling SSO authentication bypass (via crafted SAML), creation of new admin accounts, and theft of device configuration; mitigations include disabling the FortiCloud SSO feature (not enabled by default). Several other items are general awareness or roundup content rather than specific incident reporting: TechTarget and other blogs emphasized ongoing phishing/email risk (including relay spam abusing legitimate Zendesk instances) and password hygiene, while The Hacker News published a multi-story bulletin that includes (among other items) a spear-phishing campaign in Afghanistan delivering a FALSECUB backdoor via a GitHub-hosted ISO and LNK execution chain; Risky Business also covered Iran’s internet blackout and Starlink jamming/spoofing as a communications-control issue rather than an enterprise cyber incident.
Jun 29, 2026
U.S. authorities unsealed indictments against three **FSB** officers and one **TsNIIKhM** employee over long-running Russian state-sponsored cyber campaigns that penetrated energy-sector organizations and, in one case, deployed **TRITON** malware against a foreign oil refinery’s safety systems, forcing a shutdown. A joint **CISA**, **FBI**, and **DOE** advisory said the operations spanned 2011 to 2018 and included the **Havex** malware campaign, remote access to energy networks, theft of enterprise and ICS-related data, and activity consistent with operational preparation against critical infrastructure. Separate reporting and industry analysis tied related Russian-linked activity to **Energetic Bear**/**Dragonfly**/**TEMP.Isotope**, a cluster associated with intrusions into U.S. state and local government networks and earlier compromises of electric utilities and other critical infrastructure. Officials said some election-support IT systems were accessed in limited cases, but there was no evidence that vote tabulation systems, voting machines, or election data integrity were affected; defenders were urged to strengthen **IT/ICS segmentation**, apply patches, enforce **MFA**, restrict remote access, and follow established industrial control system guidance such as **NIST SP 800-82**.
Aug 15, 2026
Ukraine said Russia-linked threat groups intensified cyberattacks against its critical infrastructure, government, communications, energy, and humanitarian logistics networks, using phishing and multiple destructive malware families including **HermeticWiper**, **IsaacWiper**, **CaddyWiper**, and **DoubleZero**. CERT-UA attributed activity during the period to several tracked clusters such as `UAC-0056`, `UAC-0051/UNC1151`, `UAC-0028/APT28`, and `UAC-0033/XDSpy`, and said the operations were tied to actors affiliated with Russian and Belarusian state structures and proxy entities. Ukrainian officials also reported targeting of organizations documenting war crimes and of European charities supporting refugees, underscoring that the campaign extended beyond domestic wartime targets. Researchers separately documented destructive intrusions in which **HermeticWiper** and **CaddyWiper** were deployed through Windows Group Policy after attackers had already gained broad control of victim networks. HermeticWiper hit finance organizations, government contractors, and other Ukrainian systems while also affecting some machines in Latvia and Lithuania; it corrupted local data and the master boot record, leaving devices unable to boot. In parallel, CERT-UA warned that phishing emails posing as antivirus updates delivered **Cobalt Strike** along with the **GraphSteel** and **GrimPlant** backdoors, a campaign linked with medium confidence to `UAC-0056`, showing that espionage, access operations, and destructive attacks were being conducted in tandem.
Aug 15, 2026