Loading story…
Yoroi researchers disclosed SteelCorgi, a sophisticated modular espionage framework described as a "Swiss Army knife" for advanced persistent threat operations. The toolkit appears designed for flexible post-compromise activity, supporting surveillance, persistence, and broader intelligence collection through a range of interchangeable capabilities that make it suitable for long-term covert intrusions against high-value targets.
Separate reporting by IrpiMedia said a prominent Italian businessman was among the targets of Paragon spyware, adding to scrutiny of commercial and state-grade surveillance activity affecting individuals in Italy. Taken together, the reports point to an active threat environment in which advanced spyware and modular cyber-espionage tooling are being used against politically or economically significant targets, underscoring the risk to executives, public-interest figures, and other high-profile organizations.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
IRPI Media reported that a prominent Italian businessman was among the targets of Paragon spyware, adding a newly disclosed victim to the spyware targeting story in Italy. No earlier event date is provided in the reference, so the publication date is used as the estimate.
Yoroi published research describing Steelcorgi as a sophisticated APT "Swiss Army knife," indicating public disclosure of technical details about the threat and its capabilities. The reference does not provide an earlier event date, so the publication date is used as the estimate.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting highlighted multiple **state-sponsored espionage** operations, including a China-linked campaign attributed to **Camaro Dragon** targeting entities in **Qatar** with conflict-themed phishing lures that install the **PlugX** backdoor. The activity was observed rapidly following a new Middle East escalation, using war-related decoy documents and parallel infection chains with differing delivery methods and payloads, indicating more than one operator set involved and underscoring how quickly geopolitical events are operationalized for access and collection. Separately, **Russia’s APT28** (aka *Fancy Bear/Forest Blizzard/Sednit*) was reported using a heavily modified variant of the open-source **Covenant** post-exploitation framework alongside implants such as **BeardShell** and **SlimAgent** in long-term espionage against **Ukrainian** targets. The tradecraft described includes exploitation of `CVE-2026-21509` via malicious Microsoft Office documents and command-and-control over legitimate cloud services (e.g., *Icedrive*), consistent with stealth-focused persistence and surveillance operations against government and military-related environments.
Jun 29, 2026
Francesco Nicodemo, a prominent Italian political adviser and communications executive, was identified as the fifth Italian individual targeted with Paragon’s Graphite spyware. Nicodemo, who has managed numerous election campaigns and is known for his work with center-left political candidates, was notified by WhatsApp of evidence linking his device to the spyware. The attack was later confirmed by Citizen Lab’s John Scott-Railton, highlighting ongoing concerns about the use of invasive surveillance tools against political figures in Italy. The Italian government has acknowledged using Paragon spyware in some cases but denies involvement in all incidents, particularly those involving journalists. The growing number of unexplained infections, now totaling at least 90 victims notified by WhatsApp, underscores the broader issue of government surveillance and the targeting of individuals involved in politics and elections. Experts have raised alarms about the human rights implications of such spyware, calling for greater transparency and potential bans on its use.
Jun 29, 2026
Investigations and legal filings described a growing **mercenary spyware** market in which private vendors developed and sold intrusion capabilities to government customers, with **NSO Group** emerging as the best-known example but not the only one. Reporting tied NSO’s **Pegasus** spyware to attacks on activists, journalists, and government personnel, including the targeting of UAE activist Ahmed Mansoor and more than **1,400 devices** via a WhatsApp exploit that reportedly required no answer from the victim. Microsoft, Google, Cisco, GitHub, LinkedIn, VMware, and others backed WhatsApp’s lawsuit against NSO, arguing the company should not receive sovereign immunity for operating as a private offensive cyber actor, while broader reporting said Facebook had identified **seven** spyware firms targeting roughly **50,000** people across its platforms. Separate investigations showed the industry stretching beyond NSO into Europe and Asia. Lighthouse Reports linked Italy’s **RCS Lab** and its Tykelab unit to covert mobile-phone tracking through telecom signaling weaknesses and to **Hermit** spyware infrastructure, while Citizen Lab and Motherboard connected a fake WhatsApp phishing campaign to Italian vendor **Cy4Gate** and its **Epeius** lawful-intercept product. Earlier reporting on **Hacking Team** and allegations about **APT17** selling stolen data underscored how surveillance and intrusion capabilities have been commercialized, repackaged, and marketed across borders, despite repeated scandals, lawsuits, and sanctions aimed at curbing abuse.
Aug 15, 2026