Flughafen Wien AG
June 24, 2026
•[ hack, espionage, technology ]
Flughafen Wien AG confirmed that 2025 aircraft cargo load sheets were removed without authorization from one email inbox. Bashe, also known as APT73 or Eraleig, claimed more than 500,000 emails and 4,473 files and threatened to publish or sell the data, but the airport did not verify those figures and reported no direct ransom demand. Airport operations were unaffected, and no passenger-related or business-critical data was reported affected.
Undisclosed Australian critical infrastructure operator
June 26, 2026
•[ espionage, hack, government ]
Australia's Security Intelligence Organisation disclosed that state-sponsored actors had compromised the network of an undisclosed Australian critical infrastructure operator and obtained login details and passwords belonging to active users, including information-technology personnel. ASIO assessed that the actors were preparing to sabotage the network, but no disruptive effect was reported and the sponsoring state was not publicly identified.
Undisclosed current and former U.S. officials, military leaders, allied personnel, journalists, and Ukrainian officials
June 29, 2026
•[ espionage, phishing, government ]
Russian intelligence-linked actors tracked as UNC5792 and UNC4221 impersonated support accounts for Signal, WhatsApp, and other messaging applications to obtain verification codes, account PINs, and backup-recovery keys. The actors compromised accounts belonging to current and former U.S. officials, military leaders, allied personnel, journalists, and Ukrainian officials, accessed communications, and used compromised accounts to send messages and conduct additional phishing.
At least one undisclosed Taiwan government agency
July 1, 2026
•[ espionage, government, energy ]
From July 1 to July 4, 2026, attackers used an AI-agent framework to map 21 connected Taiwanese government systems, compromise 85 employee accounts, and extract at least 2,564 personnel-related records across the campaign. The operation also obtained SSO client secrets, database credentials, and internal network information and later scanned government IT vendors, a nuclear safety agency, a government email system, and energy companies. Simplified Chinese operator material and the targeting pattern support state-sponsored intelligence collection, but no named group or actor country has been publicly verified.
Undisclosed United Kingdom gas-fired peaker plant
July 1, 2026
•[ espionage, hack, energy ]
A cyberattack forced an undisclosed approximately 15 MW gas-fired peaker plant in the United Kingdom offline for four days in July 2026. The incident did not affect the wider electricity grid. Multiple reports linked the attack to an Iran-linked state actor, but the UK government and NCSC have not publicly named a specific group. Public reporting does not disclose the precise technical mechanism used to take the generator offline.
Undisclosed Israeli government organization(s)
July 7, 2026
•[ espionage, government, technology ]
Check Point Research reported that the MOIS-linked Cavern Manticore cluster gained access to undisclosed Israeli government organizations during Operation Epic Fury. The operators used compromised IT service providers, trusted remote-management relationships, and browser-based remote-desktop technology to move into and through victim environments. The Cavern framework provided capabilities for file and database access, credential-related activity, reconnaissance, tunneling, and lateral movement. Check Point observed data exfiltration through remote-printing features in some campaign intrusions but did not state whether those cases involved government victims or disclose the stolen information, victim names, counts, or exact intrusion dates.
Undisclosed Chinese research institution
July 7, 2026
•[ espionage, insider, government ]
According to China's Ministry of State Security, an outsourced database maintenance worker recruited by an unidentified foreign intelligence agency used remote maintenance privileges to download core research data from an undisclosed institution's experimental database and transfer it abroad. The worker was reportedly arrested, but the institution, contractor, foreign service, incident date, and transfer channel were not disclosed. No operational disruption was reported; because the incident date is unknown, event_date defaults to the supplied source's publication date.
Undisclosed Netherlands IP-camera owners or operators
July 14, 2026
•[ espionage, hack, government ]
AIVD and MIVD disclosed that a small number of internet-accessible IP cameras along military logistics routes in the Netherlands had been compromised and that the operators used image-recognition software to identify military vehicles and cargo. The Dutch advisory did not name the Russian service; GRU Unit 26165 is coded from a separate official multinational advisory, cited by the Dutch agencies, that linked the unit to closely matching IP-camera operations.
Undisclosed IP-camera owners or operators in other EU or NATO member states
July 14, 2026
•[ espionage, hack, government ]
AIVD and MIVD disclosed that Russian operators compromised internet-accessible IP cameras in multiple EU and NATO member states beyond the Netherlands and used image-recognition software to collect military-logistics and other militarily relevant intelligence. The Dutch advisory did not name the Russian service; GRU Unit 26165 is coded from a separate official multinational advisory, cited by the Dutch agencies, that linked the unit to closely matching IP-camera operations.
Undisclosed Western government organization
July 22, 2026
•[ espionage, government, misconfiguration ]
An unnamed Western government organization lost more than 18,000 records from its backend database on July 22, 2026 after an attacker exploited its WordPress site, per GreyNoise, which links the suspected Chinese-speaking actor to the Red Heron group and a ZyXEL switch campaign.
City of Plymouth Water and Sewer Utility
July 26, 2026
•[ hack, espionage, energy ]
Beginning at approximately 7:30 p.m. on July 26, 2026, Plymouth lost SCADA communications with cellular-connected programmable logic controllers at two water towers and 14 sanitary-sewer lift stations. A second facility stopped communicating shortly after midnight, prompting a coordinated response. The city disconnected affected equipment, used manual site checks and procedures, hard-reset and secured systems location by location, and restored normal communications by the afternoon of July 28. Water levels, pressure, treatment, quality, and delivery remained unaffected. No data theft, ransom demand, or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
City of Maple Plain Water Utility
July 27, 2026
•[ espionage, hack, government ]
On July 27, 2026, the City of Maple Plain identified a cybersecurity incident affecting certain automated control functions supporting portions of its water utility system. Employees immediately used contingency procedures and maintained water and wastewater services without interruption. The city declared a local emergency on July 27 and terminated it on July 29 after conditions stabilized. No affected product, access method, data theft, ransom demand, or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
City of South St. Paul Water Utility
July 27, 2026
•[ espionage, hack, government ]
Early on July 27, 2026, the City of South St. Paul identified a cybersecurity incident affecting some automated controls supporting portions of its water utility system. Public Works employees immediately transitioned to manual operations and maintained uninterrupted water and wastewater service. The city reported no impact on drinking-water treatment, quality, pressure, or delivery and no indication that resident or customer data was accessed. No affected product, access method, ransom demand, or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
City of Braham Water Utility
July 27, 2026
•[ hack, espionage, government ]
On July 27, 2026, a malicious cyberattack shut down computerized operating controls at Braham's municipal well and water treatment plant. Public Works isolated the affected system, restored a backup, and restarted the plant in approximately 90 minutes. The city temporarily asked residents to minimize water use because it was relying on stored tower water, but customers did not lose service. Officials reported no physical plant damage, change to chemical feed rates, or impact on water quality or safety. No ransom demand or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
Undisclosed U.S. water utilities
July 27, 2026
•[ hack, espionage, government ]
Hackers hijacked internet-exposed PLCs at more than 30 Minnesota public water systems from about July 27, 2026, and at utilities in other states, locking out operators, forcing manual operations and shutting off a well in Braham. No contamination; FBI/EPA warned, Iran suspected.
Undisclosed South Korean healthcare website owner or operator
July 30, 2026
•[ espionage, healthcare, government ]
An unnamed state-sponsored group compromised at least one South Korean healthcare website and used it as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in the healthcare sector, individual compromise dates, and specific server-access method were not disclosed. No operational disruption or data theft from the website owner was reported.
Undisclosed South Korean educational website owner or operator
July 30, 2026
•[ espionage, hack, education ]
An unnamed state-sponsored group compromised at least one South Korean educational website and used it as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in the education sector, individual compromise dates, and specific server-access method were not disclosed. No operational disruption or data theft from the website owner was reported.
Undisclosed South Korean manufacturing website owner or operator
July 30, 2026
•[ espionage, manufacturing, technology ]
An unnamed state-sponsored group compromised at least one South Korean manufacturing website and used it as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in the manufacturing sector, individual compromise dates, and specific server-access method were not disclosed. No operational disruption or data theft from the website owner was reported.
Undisclosed South Korean small website owner or operator
July 30, 2026
•[ espionage, hack, government ]
An unnamed state-sponsored group compromised at least one smaller, poorly secured South Korean website and used it as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in this residual category, individual compromise dates, and specific server-access method were not disclosed. No operational disruption or data theft from the website owner was reported.
Undisclosed South Korean organization infected through an AnySign4PC watering hole
July 30, 2026
•[ espionage, technology, government ]
An unnamed state-sponsored group infected at least one target organization's Windows endpoints when a user visited a compromised website while running a vulnerable AnySign4PC version. The malicious page exploited a buffer overflow without a download prompt, installed a backdoor, established command-and-control, escalated privileges, harvested credentials, and enabled lateral movement. Researchers reported evidence of related attacks at 72 organizations, but cautioned that this was not a count of 72 equally confirmed full compromises. The broader campaign was not formally attributed to Lazarus or another named group.
