Full List

Search

Search Results (Espionage)

• Bibi Gate: The Gatekeeper’s Fall | Tzachi Braverman December 28, 2025 • [ ransomware, government, espionage ] Bibi Gate: The Gatekeepers Fall | Tzachi Braverman was listed as a victim on the leak site of the handala ransomware group; the attack is estimated to have taken place on 2025-12-28. Sector: Government & Defense. Country: Israel. Bibi Gate Operation: The Gatekeepers Fall To Netanyahus inner circle, To every official still clutching the illusion of secrecy You feel it now: the tightening chest, the cold sweat, the gnawing dread. Thats not just fear, its the knowledge that every layer of your security, every secret entrusted to Tzachi Braverman, Netanyahus Chief of Staff,
• Braverman Files Unleashed: Every Secret Now Exposed December 28, 2025 • [ ransomware, government, espionage ] Braverman Files Unleashed: Every Secret Now Exposed was listed as a victim on the leak site of the handala ransomware group; the attack is estimated to have taken place on 2025-12-28. Sector: Government & Defense. Handala Hack | Bibi Gate: The Truth Denied, The Evidence Unfolds Once again, as expected, the Prime Ministers Office of the Zionist regime rushes to deny what can no longer be hidden. They claim, as always, that the hack of Tzachi Braverman, Netanyahus Chief of Staff, the gatekeeper, the vault of secrets, is nothing but
• 10 corpses November 22, 2025 • [ ransomware, hack, espionage ] 10 corpses was listed as a victim on the leak site of the handala ransomware group; the attack is estimated to have taken place on 2025-11-22. Today, Saturday, Handala RedWanted tears the mask off the Zionist regimes aerospace elite. We are lifting the veil of secrecy from 10 senior operatives, exposing those who believed their crimes could remain hidden in the darkness. Your names are no longer whispers, we shout them into the world. This is not just an announcement. It
• 8200 Unit corpses November 29, 2025 • [ ransomware, government, technology ] 8200 Unit corpses was listed as a victim on the leak site of the handala ransomware group; the attack is estimated to have taken place on 2025-11-29. WANTED $10,000 REWARD Ron Weinberg Email: ron.wnbrg@gmail.com Phone: +972 53 279 0256 Ron Weinberg is currently under investigation. He is an experienced cyber security and network research specialist, formerly Head of Cyber Security and Network Research at the IDF 8200 Unit (Aham Shhakim). Weinberg possesses extensive knowledge in cyber security, network protocols, technological research,
• Presidential Office of the Republic of North Macedonia May 21, 2026 • [ insider threat, espionage, data theft ] An unnamed IT administrator in the Presidential Office of the Republic of North Macedonia was reportedly suspected of copying, decrypting, encrypting, and storing confidential state data from presidential administration computer systems, with allegations that the material may have been intended for a foreign intelligence service. Public reporting did not name the administrator, identify the foreign service, quantify the data, or confirm operational disruption.
• At least one Russian government agency or aviation company September 1, 2025 • [ phishing, malicious advertising, malware ] HeartlessSoul has targeted Russian government agencies, aerospace firms, aviation companies, and drone operators since at least September 2025 using phishing emails with infected attachments, malicious advertising, fake aviation-software download sites, fake SourceForge projects, and malware disguised as legitimate software. Public reporting indicates the campaign was successful against one or more victims and resulted in the exfiltration of GIS, satellite, GPS, terrain, digital geographic relief, and other proprietary geospatial data.
• Undisclosed Polish defense-sector organization April 30, 2026 • [ espionage, web shells, ShadowPad ] Shadow-Earth-053, a China-aligned espionage cluster, was reported to have compromised an undisclosed Polish defense-sector organization by exploiting unpatched Microsoft Exchange and IIS servers, deploying web shells and ShadowPad, collecting credentials, and exporting mailbox contents.
• Undisclosed Taiwanese government entity April 30, 2026 • [ espionage, state-sponsored, web shells ] Shadow-Earth-053, a China-aligned espionage cluster, was reported to have compromised an undisclosed Taiwanese government environment by exploiting unpatched Microsoft Exchange and IIS servers, deploying web shells and ShadowPad, collecting credentials, and exporting mailbox contents.
• Undisclosed Malaysian government entity April 30, 2026 • [ espionage, vulnerability exploitation, unpatched software ] Shadow-Earth-053, a China-aligned espionage cluster, was reported to have compromised an undisclosed Malaysian government environment by exploiting unpatched Microsoft Exchange and IIS servers, deploying web shells and ShadowPad, collecting credentials, and exporting mailbox contents.
• Undisclosed Indian government entity April 30, 2026 • [ espionage, web shell, ShadowPad ] Shadow-Earth-053, a China-aligned espionage cluster, was reported to have compromised an undisclosed Indian government environment by exploiting unpatched Microsoft Exchange and IIS servers, deploying web shells and ShadowPad, collecting credentials, and exporting mailbox contents.
• Undisclosed Thai government entity April 30, 2026 • [ espionage, vulnerability exploitation, web shells ] Shadow-Earth-053, a China-aligned espionage cluster, was reported to have compromised an undisclosed Thai government environment by exploiting unpatched Microsoft Exchange and IIS servers, deploying web shells and ShadowPad, collecting credentials, and exporting mailbox contents.
• Undisclosed South Korean electronics manufacturer February 20, 2026 • [ espionage, DLL side-loading, reconnaissance ] Ministry of Intelligence and Security (MOIS) (MuddyWater), also tracked as Seedworm, breached a major South Korean electronics manufacturer in February 2026 as part of a broader espionage campaign. The actor spent about one week inside the victim network, abused signed Fortemedia and SentinelOne binaries for DLL side-loading, conducted reconnaissance and credential-access activity, and exfiltrated data through a public file-transfer service.
• At least one unnamed victim organization January 1, 2026 • [ social engineering, credential theft, MFA manipulation ] MuddyWater, an Iran-linked APT associated with Iran's Ministry of Intelligence and Security (MOIS), used Microsoft Teams social engineering against an unnamed victim organization in early 2026. The attackers established remote access, stole credentials, manipulated MFA protections, deployed AnyDesk and DWAgent for persistence, moved laterally, harvested VPN configuration files and other sensitive data, and exfiltrated information. The attackers later sent extortion emails referencing Chaos ransomware and directed the victim to a Chaos leak site, but reporting said no file-encrypting ransomware was deployed, indicating the ransomware framing was likely a false flag for espionage activity.
• 170 Ukrainian prosecutors and investigators March 1, 2026 • [ espionage, email compromise, state-sponsored ] Russia-linked hackers compromised Ukrainian prosecutors and investigators email accounts as part of a broader email-espionage campaign involving at least 284 inboxes.
• Jordan Civil Aviation Commission September 1, 2025 • [ APT35, Charming Kitten, data exfiltration ] KittenBusters/CloudSEK reporting described APT35 activity in which files from Jordans Civil Aviation Commission were silently exfiltrated before Irans February 2026 regional missile and drone campaign; the reporting linked APT35/Charming Kitten to Irans IRGC Intelligence Organization.
• Venezuelan Ministry of Foreign Affairs January 1, 2026 • [ espionage, state-sponsored attack, data breach ] The same China-linked espionage campaign that compromised the Cuban Embassy in Washington D.C. also reportedly exploited Microsoft Exchange servers used by Venezuelas Ministry of Foreign Affairs and accessed officials email communications during the same January 2026 regional campaign.
• Former Mossad Chief Tamir Pardo March 25, 2026 • [ data leak, espionage, email breach ] Handala published material from the personal Gmail account of former Mossad chief Tamir Pardo, and later reporting said the leak included business correspondence and a draft letter addressed to a CIA chief.
• At least one member of the Ukrainian armed forces March 16, 2026 • [ espionage, spyware, phishing ] The Record reported researchers attributed a new espionage campaign targeting Ukrainian organizations to the Russia-linked group Laundry Bear (Void Blizzard), active since at least 2024. The campaign used spyware embedded in documents themed around Starlink satellite terminals and a well-known Ukrainian charity. The article is campaign reporting (multiple targets) and does not provide a single named victim incident with bounded impact metrics.
• Israeli surveillance cameras March 10, 2026 • [ espionage, security cameras, password security ] Israels National Cyber Directorate stated it had identified dozens of Iranian breaches into security cameras for espionage purposes since the start of the regional war. The directorate said it was alerting hundreds of camera owners and urged the public to change passwords and update software to reduce both national and personal security risk.
• Undisclosed Qatari organization March 1, 2026 • [ DLL hijacking, PlugX, backdoor malware ] HackRead summarized Check Point Research describing a China-linked campaign beginning March 1, 2026 that used conflict-themed lures and DLL hijacking to install PlugX backdoor malware against targets in Qatar. The report described lures disguised as war news and a separate energy-sector lure delivering a Rust loader and ultimately Cobalt Strike, with the goal of espionage against Qatars military and oil/gas interests.