Loading story…
Trellix reported that a recent espionage campaign compromised a Prime Minister’s Office, indicating a targeted intrusion against a high-value government entity. The incident was described as an intelligence-gathering operation rather than financially motivated crime, underscoring the continued focus of advanced threat actors on senior government networks and politically sensitive communications.
The disclosure highlights the national-security impact of compromises involving executive offices, where attackers can gain access to sensitive correspondence, policy material, and internal government workflows. While the available reference provides limited technical detail, the case points to a deliberate cyber-espionage operation aimed at collecting strategic information from the highest levels of government.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Elastic Security Labs published research on the SiestaGraph malware implant after uncovering it in an ASEAN member state's foreign ministry. The report added technical details about the espionage activity and identified a distinct government victim environment from the later Prime Minister’s Office disclosure.
Trellix published research detailing a recent espionage campaign involving the compromise of a Prime Minister’s Office. The reference indicates public disclosure of the incident and associated campaign details.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
trellix.com
Open sourcetrellix.com
Open sourceelastic.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting indicates **China-linked intelligence activity** is targeting current and former Western government officials through both human and technical collection. In the US case, a suspected Chinese influence/collection network using a purported consultancy (*Foresight and Strategy*) allegedly approached a former senior State Department official and offered payment to produce an assessment of US policy priorities in Venezuela, consistent with prior research describing a nexus of fake companies and websites used to recruit people with government and think-tank policy experience. In the UK, Chinese state-linked hackers are accused of maintaining years-long access to communications associated with senior Downing Street officials, with reporting alleging compromises affecting phones used by aides to former prime ministers **Boris Johnson, Liz Truss, and Rishi Sunak** dating back to 2021 and discovered in 2024. The activity has been linked by sources to **Salt Typhoon**, a China-aligned espionage group associated with telecom-provider intrusions that can enable collection of call metadata and potentially content (texts/calls), allowing intelligence value even without direct handset malware.
Jun 29, 2026
Mexican IT and cybersecurity provider **Be Prime** disclosed a cyberattack after a threat actor using the alias **`dylanmarly`** posted alleged proof of compromise on a cybercrime forum. The attacker claimed to have accessed Be Prime administrative accounts, **Cisco Meraki Vision** surveillance systems, Meraki API keys, and thousands of network devices, and to have leaked **12.6 GB** of data linked to Be Prime and some of its clients. Public reporting said the intrusion may have involved administrator accounts without multifactor authentication, though Be Prime did not confirm those specific allegations. Be Prime said it activated containment, mitigation, investigation, and remediation measures with support from **Cisco Talos**, and stated that it had found no evidence so far of disruption to its own operations or those of customers. At the same time, the company warned it could pursue legal action against parties spreading what it described as false or out-of-context claims about the incident, a response that drew criticism from researchers and journalists who argued that threatening reporters and whistleblowers could intensify scrutiny of the breach and its potential impact on client data and video surveillance exposure.
Jun 29, 2026
Australia’s ACSC and CISA warned that Chinese state-sponsored actors compromised networks worldwide as part of a broad espionage operation that targeted IT service providers and then leveraged that access to reach downstream customer environments. U.S. government reporting tied the activity to Chinese cyber actors associated with the Ministry of State Security, describing a long-running campaign that stole intellectual property and sensitive data from organizations across at least 12 countries and sectors including information technology, energy, healthcare, communications, and critical manufacturing. The intrusions relied on stolen administrative credentials, abuse of digital certificates, and post-compromise tooling including **PowerShell**, **PowerSploit**, **REDLEAVES**, and **PLUGX** to maintain persistence and move laterally. Authorities said the malware used techniques such as **DLL side-loading**, in-memory execution, and **RC4**-encrypted command-and-control over port `443`, including spoofed domains masquerading as Windows update infrastructure, and urged defenders to strengthen privileged account protections, network segmentation, logging, and monitoring for suspicious administrative share activity and protocol mismatches.
Jun 29, 2026