Stelios Kouloglou
October 21, 2022
•[ espionage, government, technology ]
Citizen Lab found with high confidence that former Greek MEP Stelios Kouloglou's iPhone was successfully infected with NSO Group's Pegasus on October 21, 2022 and again on March 6-7, 2023 using the PWNYOURHOME zero-click exploit. The infections occurred during sensitive PEGA Committee work. Researchers did not attribute the operation to a government, found no indication Greece was responsible, and assessed that the first infection overlapped with an operator previously targeting Russian- and Belarusian-speaking journalists and activists.
Undisclosed North American medical research university
September 1, 2023
•[ espionage, malware, healthcare ]
In September 2023, UNC6508 compromised a REDCap server belonging to an undisclosed North American medical research university. Three months later, the actor deployed the INFINITERED backdoor, harvested credentials, persisted through REDCap upgrades, obtained domain-administrator access, and created a Google Workspace content-compliance rule that silently forwarded selected emails to an actor-controlled account. Activity continued through November 2025. Google also identified additional organizations in the United States and Canada compromised with INFINITERED, but this row represents the detailed September 2023 university victim.
Balochistan Police
February 27, 2024
•[ espionage, malware, government ]
Between February 27, 2024, and December 5, 2025, one or more unnamed suspected China-linked operators maintained PlugX, ShadowPad, and Cobalt Strike command-and-control activity involving Balochistan Police network appliances and web servers. In late 2024, an operator uploaded malicious cms_plugin.exe variants to the police Complaint Management System, including a Rust stager and a .NET implant that loaded AsyncRAT, creating a malware-delivery path to police and public users. SentinelLabs did not name the actor and warned that the shared or commodity tooling may represent more than one operator; no theft of the records stored on the affected systems was confirmed.
Royal Thai Police
December 1, 2024
•[ espionage, malware, government ]
Yokai backdoor deployed via LNK / PDF decoy and DLL side-loading to infiltrate Thai police systems for espionage.
Gazprombank
December 5, 2024
•[ hack, finance, espionage ]
Russian users report difficulties accessing services at Gazprombank, one of the countrys largest privately owned banks, following an alleged cyberattack by Ukraines military intelligence agency.
Undisclosed U.S. industrial automation company
March 1, 2025
•[ espionage, manufacturing, technology ]
CISA and the FBI reported that foreign cyber actors on the network of an unnamed U.S. industrial automation integrator serving utilities and transport firms collected about 800 files of customer SCADA data, ICS device details and schematics in March-April 2025.
Undisclosed Ukrainian organization
April 2, 2025
•[ espionage, phishing, malware ]
On April 2, 2025, a phishing email sent from a compromised account induced a victim at an undisclosed Ukrainian organization to open a malicious Remote Desktop Protocol file and connect to actor-controlled infrastructure. Google Threat Intelligence Group observed Turla deploy the StockStay.MarketMaker downloader to the victim device, which retrieved the StockStay backdoor from compromised Ukrainian government infrastructure. The victim's identity and any acquired information were not disclosed.
UK Ministry of Defence
July 18, 2025
•[ leak, government, espionage ]
Further reporting on MoD data leak reveals identities of more than 100 UK government personnel compromised; follows ARAP breach revelations and superinjunction details.
Balochistan Police
January 13, 2026
•[ espionage, malware, government ]
From January 13 to April 9, 2026, Balochistan Police infrastructure communicated with Remcos command-and-control server 89.31.121[.]220 attributed to TAG-179, a suspected India-linked espionage actor. A related lure imitated an operational plan for repatriating undocumented foreigners and referenced police, NADRA, and Pakistani intelligence coordination. TAG-179 overlaps to varying degrees with Mysterious Elephant and Bitter, but no specific Indian intelligence service or unit has been publicly identified.
Sage Water Resources, LLC
March 15, 2026
•[ espionage, energy, malware ]
An advanced nation-state threat actor maliciously modified PLC logic at Sage Water Resources' Blue Bench 13-1 saltwater-disposal facility in Duchesne, Utah on March 15, 2026. The changes bypassed pump shutdown safeguards and allowed pumps to continue running dry while the control system displayed normal operation. A truck driver noticed the abnormal conditions and operators shifted to manual control before equipment failure, environmental damage, or service interruption occurred.
Undisclosed insurance organization
April 1, 2026
•[ espionage, malware, finance ]
Beginning in April 2026, researchers observed the Backdoor.Mistic remote access trojan deployed on the network of at least one undisclosed insurance organization. The backdoor enabled file upload and download, file manipulation, folder creation, and in-memory code execution. The victim's identity, location, affected systems, and any acquired information were not disclosed. SecurityWeek attributed the activity to Woodgnat, also known as KongTuke, while Broadcom assessed that Mistic may be associated with the group.
Undisclosed professional services organization
April 1, 2026
•[ espionage, malware, technology ]
Beginning in April 2026, researchers observed the Backdoor.Mistic remote access trojan deployed on the network of at least one undisclosed professional services organization. The backdoor enabled file upload and download, file manipulation, folder creation, and in-memory code execution. The victim's identity, location, affected systems, and any acquired information were not disclosed. SecurityWeek attributed the activity to Woodgnat, also known as KongTuke, while Broadcom assessed that Mistic may be associated with the group.
State Enterprise Centre of Registers
April 1, 2026
•[ espionage, hack, government ]
The State Enterprise Centre of Registers detected unauthorized extraction of more than 600,000 records in early April 2026. The actor used login credentials assigned to institutions authorized to access the Real Estate and Legal Entities Registers. Lithuanian prosecutors suspected involvement by an unnamed foreign country, but no state or threat group was formally attributed. The exact intrusion date was not disclosed, so April 1 is used as the normalized month-only event date.
At least one business traveler
May 1, 2026
•[ phishing, malware, espionage ]
Attackers manipulated hospitality captive-portal traffic to redirect at least one business traveler to credential-phishing and malware infrastructure. Microsoft later attributed the CaptiveCrunch campaign to the SVR-linked Midnight Blizzard cluster and confirmed endpoint collection and exfiltration; no operational disruption to the traveler was reported.
Undisclosed U.S. gas station operators in multiple states
May 15, 2026
•[ espionage, misconfiguration, energy ]
Attackers breached internet-connected automatic tank gauge systems serving gas stations in multiple U.S. states by accessing devices that lacked password protection. The intruders altered displayed fuel-level readings but could not change the actual amount of fuel in the tanks, and no physical damage or safety incidents were reported. U.S. officials suspected Iranian state-sponsored actors, but no specific Iranian group was publicly identified.
United States Department of Homeland Security
May 15, 2026
•[ espionage, hack, malware ]
An unidentified actor compromised DHS's Homeland Security Information Network servers and an associated SharePoint environment. From May 15 through May 24, analysts observed altered files on testing and production servers, malicious code executed through a legitimate web-server program, and deleted activity logs, but the activity was dismissed as a false positive. Similar activity continued from May 25 through June 3. On June 4, the attackers installed hidden backdoors and stole credential files, prompting confirmation of the breach. DHS isolated affected systems and mitigated the vulnerability; HSIN remained operational, classified networks were not affected, and neither the actor nor any theft of additional HSIN documents had been established.
Undisclosed operators of at least 10 Ukrainian websites and infected device users
June 1, 2026
•[ espionage, malware, government ]
CERT-UA attributed the June-July 2026 campaign to UAC-0145, a sub-cluster of SANDWORM. The attackers compromised at least 10 Ukrainian websites, injected SMARTAXE to display fake CAPTCHA instructions and resolve command-and-control infrastructure through an Ethereum smart contract, and deployed multiple Windows and Android malware families for reconnaissance, persistence, remote access, and data collection.
Undisclosed Turkish defense contractor
June 7, 2026
•[ espionage, hack, government ]
Beginning on or after June 7, 2026, unidentified operators associated with the FortiBleed campaign used a captured FortiGate VPN session cookie to enter an undisclosed Turkish defense contractor's internal network and access two SMB file shares with an administrator account. They exfiltrated more than 12,000 files totaling 105 GB, including sensitive military documentation, technical files, field imagery, diagnostic records, and employee identification documents.
California Water Service Company
June 11, 2026
•[ hack, espionage, energy ]
On 2026-06-11, the Iran-linked Handala group claimed that it had compromised California Water Service and published a 5 GB proof-of-concept dataset. Dataminr analysis identified customer billing records, RTKBase GPS correction-system credentials, NTRIP passwords, and network details covering at least seven service districts; records associated with the Chico District were independently confirmed. Handala described the operation as retaliation for U.S. actions in Iran and claimed it could disrupt water service, but no access to water treatment or distribution controls and no operational disruption were confirmed. Handala is linked by threat researchers to Iran's Ministry of Intelligence and Security.
Undisclosed Indian government entities
June 12, 2026
•[ espionage, phishing, malware ]
Between June 12 and June 22, 2026, Acronis observed active beaconing from multiple systems compromised by Mustang Panda within Indian government entities, including devices associated with senior administrative personnel. Spear-phishing archives induced users to execute signed Windows applications that sideloaded malicious DLLs and installed SHARDLOADER, MINIRECON, or ZOHOMURK on the endpoints. The malware established persistence, remote command execution, command-and-control, and data-transfer channels through attacker-controlled infrastructure and Zoho WorkDrive. Acronis attributed the campaign to Mustang Panda with high confidence based on tradecraft, malware-code, infrastructure, and development-artifact overlaps and assisted CERT-In with victim notification and remediation. Public reporting associates Mustang Panda with China's Ministry of State Security, although no subordinate bureau, contractor, or operational unit was identified. The operation supported intelligence collection concerning Indian hydropower initiatives and defense cooperation with Taiwan. No operational disruption was reported.
