Loading story…
SentinelOne reported that reexamining older cyber intrusions with modern tooling is yielding new intelligence that can improve present-day defense. The research says retrospective analysis can expand indicators of compromise, reveal broader victimology, strengthen attribution, and surface infrastructure or malware relationships that were missed during the original investigations.
Examples cited include new insights into the Sandman cluster, ModifiedElephant activity targeting individuals in India, Chinese-attributed operations in Africa linked to Backdoor Diplomacy and BRONZE STARLIGHT, and the Appin hack-for-hire operation in India. SentinelOne said improved YARA techniques and access to large malware repositories such as Stairwell and VirusTotal are helping analysts extract fresh findings from historical datasets, malware samples, and legacy infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Threat Intelligence Group (GTIG) reported that the **defense industrial base (DIB)** is under sustained, multi-vector pressure from state-backed and aligned actors seeking to steal sensitive military technology, disrupt supply chains, and undermine national security. The report highlights Russian-linked activity focused on **unmanned aircraft systems (UAS)** and other emerging technologies, including **TEMP.Vermin** using drone-themed lures to deliver malware and **APT44 (Sandworm/GRU)** targeting military personnel devices with tooling such as **INFAMOUSCHISEL** to harvest data from battlefield-related applications; it also notes some Russian operators are using **LLMs** to improve reconnaissance and social-engineering effectiveness. GTIG also describes North Korea’s continued use of **IT-worker/insider** placement to generate revenue and access within Western organizations. Separately, reporting on **Transparent Tribe (APT36)** describes ongoing espionage campaigns against Indian government and defense targets across Windows and Linux, including spear-phishing that deploys **Geta RAT** and execution chains abusing legitimate Windows components (e.g., `mshta.exe`) and **XAML deserialization** for evasion, alongside a shift toward more mature Linux tooling and persistence. A third report (Picus Labs’ *Red Report*) is broader trend research rather than a specific incident, claiming ransomware encryption is declining while “**sleeperware**”/dormant extortion tradecraft is rising based on ATT&CK technique prevalence across large-scale simulation and telemetry; it does not materially add to the defense-sector espionage narrative beyond general attacker TTP trends.
Jun 29, 2026
Two threat-landscape reports describe an increasingly aggressive **nation-state/APT** environment, emphasizing how stolen credentials and access sold in underground markets reduce the need for bespoke initial access while enabling long-dwell espionage. SOCRadar’s U.S.-focused writeup frames state-linked operations as prioritizing persistent visibility into high-value environments such as **email, identity systems, telecom, and government-adjacent infrastructure**, citing China-nexus activity (including **Salt Typhoon**) as emblematic of strategic access over smash-and-grab theft. NSFOCUS’s 2025 global APT overview highlights a marked increase in **0-day vulnerability** use across operating systems, browsers, network devices, and even security software, enabling extended stealth and broad impact. It cites examples including **BlindEagle** targeting Colombian judicial/government entities by exploiting a variant of `CVE-2024-43451` (Windows shortcut/SMB link behavior enabling **NTLMv2 hash capture** with low-interaction triggers), **Lazarus Group** weaponizing a 0-day in South Korea’s widely deployed *CrossEX* banking/security software for large-scale intrusion and data theft, and Turkey-linked **Marbled Dust/Sea Turtle** conducting an operation against the Iraqi Kurdish military (disclosed later) using vulnerability exploitation as part of the intrusion chain.
Jun 29, 2026
A weekly threat-intelligence roundup highlighted **Microsoft’s January Patch Tuesday** release addressing **112 vulnerabilities** across Windows and *Microsoft Edge*, spanning multiple classes including elevation of privilege, remote code execution, and information disclosure. The same briefing reported active interest in **CVE-2025-64155**, a **critical FortiSIEM** vulnerability, with observed exploitation activity against honeypot environments following an out-of-band alert from Kroll Threat Intelligence—an indicator of likely broader scanning and attempted exploitation. The update also covered multiple threat developments: Check Point research described **VOIDLINK**, a Linux-focused malware framework (implants/rootkits/loaders) designed for long-term access, including in cloud environments; **North Korean-linked KTA082 (Kimsuky/APT43)** was reported using **QR-code phishing (“quishing”)** to target government, education, and think tanks; and **Iran-linked KTA060 (MuddyWater)** was associated with development of the **RUSTYWATER RAT**. Separately, detection-engineering updates noted new and refined rules for **OAuth/Entra ID consent phishing** patterns (including *ConsentFix*-style authorization flows), correlations between Entra ID risk events and privileged actions (e.g., PIM elevation/device-code auth), Windows persistence/defense-evasion behaviors (e.g., scheduled tasks by unsigned executables, Chrome security feature tampering), and updated YARA/behavioral detections for malware families (e.g., **Agent Tesla**, **MintsLoader**) and **Cobalt Strike** TTPs; the briefing also referenced a leak of a database purportedly containing ~**324,000 BreachForums** user records posted to `shinyhunte[.]rs`.
Jun 29, 2026