Loading story…
SentinelOne reported that reexamining older cyber intrusions with modern tooling is yielding new intelligence that can improve present-day defense. The research says retrospective analysis can expand indicators of compromise, reveal broader victimology, strengthen attribution, and surface infrastructure or malware relationships that were missed during the original investigations.
Examples cited include new insights into the Sandman cluster, ModifiedElephant activity targeting individuals in India, Chinese-attributed operations in Africa linked to Backdoor Diplomacy and BRONZE STARLIGHT, and the Appin hack-for-hire operation in India. SentinelOne said improved YARA techniques and access to large malware repositories such as Stairwell and VirusTotal are helping analysts extract fresh findings from historical datasets, malware samples, and legacy infrastructure.
TTPs, infrastructure, and targeting history in one profile.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recent DFIR reporting detailed how investigators can reconstruct attacker activity from Windows and Unix artifacts while avoiding common misreads of legitimate security tooling. Securelist published deep analyses of **UserAssist** and **AmCache**, showing how `shell32.dll` updates GUI execution records, how session statistics and undocumented bytes can reveal usage patterns, and why AmCache can identify executables, drivers, shortcuts, and installed applications even after deletion, despite limits such as SHA-1 hashing only the first `31,457,280` bytes of large files. Separate research showed that **Zsh session files** can preserve command evidence even when `.zsh_history` is deleted, and that binaries wrapped with **shc** or **AutoIT** often remain recoverable or observable through runtime artifacts rather than being truly opaque. Incident write-ups and field notes also showed how attackers and defenders alike can complicate investigations. Analysts documented a typosquatted npm package, **`peritter`**, that dropped `OneDrive.exe` into Startup and stole Chrome credentials; an intrusion in which phishing, Slack installation, RDP access, and Google Drive traffic were tied to document staging and exfiltration; and broader cases in Brazilian educational institutions involving ransomware, valid-account abuse, AnyDesk, PsExec, and insider-planted malware. Other reports warned that legitimate tools and platform features can masquerade as threats or hide them: **NSSM** was used to run payloads such as `ngrok` as Windows services, Azure Batch was abused for cryptomining, RMM cleanup scripts attempted to conceal remote access software, and Microsoft Defender for Endpoint activity including **device discovery** and **Defender XDR deception accounts** generated telemetry that could be mistaken for attacker reconnaissance or privileged account misuse unless investigators validated the underlying configuration and scripts.
Aug 10, 2026
Google Threat Intelligence Group (GTIG) reported that the **defense industrial base (DIB)** is under sustained, multi-vector pressure from state-backed and aligned actors seeking to steal sensitive military technology, disrupt supply chains, and undermine national security. The report highlights Russian-linked activity focused on **unmanned aircraft systems (UAS)** and other emerging technologies, including **TEMP.Vermin** using drone-themed lures to deliver malware and **APT44 (Sandworm/GRU)** targeting military personnel devices with tooling such as **INFAMOUSCHISEL** to harvest data from battlefield-related applications; it also notes some Russian operators are using **LLMs** to improve reconnaissance and social-engineering effectiveness. GTIG also describes North Korea’s continued use of **IT-worker/insider** placement to generate revenue and access within Western organizations. Separately, reporting on **Transparent Tribe (APT36)** describes ongoing espionage campaigns against Indian government and defense targets across Windows and Linux, including spear-phishing that deploys **Geta RAT** and execution chains abusing legitimate Windows components (e.g., `mshta.exe`) and **XAML deserialization** for evasion, alongside a shift toward more mature Linux tooling and persistence. A third report (Picus Labs’ *Red Report*) is broader trend research rather than a specific incident, claiming ransomware encryption is declining while “**sleeperware**”/dormant extortion tradecraft is rising based on ATT&CK technique prevalence across large-scale simulation and telemetry; it does not materially add to the defense-sector espionage narrative beyond general attacker TTP trends.
Jun 29, 2026
Two threat-landscape reports describe an increasingly aggressive **nation-state/APT** environment, emphasizing how stolen credentials and access sold in underground markets reduce the need for bespoke initial access while enabling long-dwell espionage. SOCRadar’s U.S.-focused writeup frames state-linked operations as prioritizing persistent visibility into high-value environments such as **email, identity systems, telecom, and government-adjacent infrastructure**, citing China-nexus activity (including **Salt Typhoon**) as emblematic of strategic access over smash-and-grab theft. NSFOCUS’s 2025 global APT overview highlights a marked increase in **0-day vulnerability** use across operating systems, browsers, network devices, and even security software, enabling extended stealth and broad impact. It cites examples including **BlindEagle** targeting Colombian judicial/government entities by exploiting a variant of `CVE-2024-43451` (Windows shortcut/SMB link behavior enabling **NTLMv2 hash capture** with low-interaction triggers), **Lazarus Group** weaponizing a 0-day in South Korea’s widely deployed *CrossEX* banking/security software for large-scale intrusion and data theft, and Turkey-linked **Marbled Dust/Sea Turtle** conducting an operation against the Iraqi Kurdish military (disclosed later) using vulnerability exploitation as part of the intrusion chain.
Jun 29, 2026