Undisclosed freelance employment platform users
June 1, 2016
•[ malware, social, technology ]
Russian national Searzhudin Aktulaev, extradited from Cyprus, was indicted for messaging ~80,000 users of a California freelance platform (June 2016-Nov 2017) with malicious Excel files that installed TVRAT/DarkVNC, infecting thousands of computers and stealing credentials.
Baydöner
May 21, 2022
•[ hack, malware, retail ]
Turkish kebab chain Baydner was breached on May 21, 2022: malware on its IT manager's computer exposed web-service passwords, and attackers copied data on 505,337 people, then messaged an executive. Turkey's KVKK fined the chain 1M TL in 2026.
Syrian National Army Military Police Investigation Section, Suluk
May 10, 2023
•[ leak, malware, government ]
A RedLine infostealer infected a senior officer's Windows computer used by the Syrian National Army Military Police Investigation Section in Suluk on May 10, 2023. Hudson Rock recovered a stealer log timestamped 09:39 showing the unit-named Windows account and theft of saved passwords, browser cookies, a live Telegram session, and 14 desktop files, including seven active detainee interrogation records. Five recovered Office lock files indicate some records were open when the malware ran. The log subsequently circulated in criminal markets. The individual RedLine affiliate responsible has not been identified. RedLine is commodity malware-as-a-service designed for credential and financial-data theft and resale, supporting Criminal actor type and Financial motive.
Undisclosed North American medical research university
September 1, 2023
•[ espionage, malware, healthcare ]
In September 2023, UNC6508 compromised a REDCap server belonging to an undisclosed North American medical research university. Three months later, the actor deployed the INFINITERED backdoor, harvested credentials, persisted through REDCap upgrades, obtained domain-administrator access, and created a Google Workspace content-compliance rule that silently forwarded selected emails to an actor-controlled account. Activity continued through November 2025. Google also identified additional organizations in the United States and Canada compromised with INFINITERED, but this row represents the detailed September 2023 university victim.
Balochistan Police
February 27, 2024
•[ espionage, malware, government ]
Between February 27, 2024, and December 5, 2025, one or more unnamed suspected China-linked operators maintained PlugX, ShadowPad, and Cobalt Strike command-and-control activity involving Balochistan Police network appliances and web servers. In late 2024, an operator uploaded malicious cms_plugin.exe variants to the police Complaint Management System, including a Rust stager and a .NET implant that loaded AsyncRAT, creating a malware-delivery path to police and public users. SentinelLabs did not name the actor and warned that the shared or commodity tooling may represent more than one operator; no theft of the records stored on the affected systems was confirmed.
Royal Thai Police
December 1, 2024
•[ espionage, malware, government ]
Yokai backdoor deployed via LNK / PDF decoy and DLL side-loading to infiltrate Thai police systems for espionage.
Undisclosed Ukrainian organization
April 2, 2025
•[ espionage, phishing, malware ]
On April 2, 2025, a phishing email sent from a compromised account induced a victim at an undisclosed Ukrainian organization to open a malicious Remote Desktop Protocol file and connect to actor-controlled infrastructure. Google Threat Intelligence Group observed Turla deploy the StockStay.MarketMaker downloader to the victim device, which retrieved the StockStay backdoor from compromised Ukrainian government infrastructure. The victim's identity and any acquired information were not disclosed.
Multiple undisclosed JetBrains Marketplace users
October 31, 2025
•[ malware, technology ]
From 2025-10-31 through June 2026, 15 malicious third-party JetBrains Marketplace plugins published under seven vendor accounts posed as functional AI developer tools while secretly exfiltrating user-supplied AI provider API keys over unencrypted HTTP to a hard-coded server. The plugins accumulated approximately 70,000 installations. JetBrains removed all 15 plugins, banned the publisher accounts, and remotely disabled installed copies on 2026-06-17. JetBrains confirmed that its internal systems, source code, and corporate infrastructure were not compromised. The server's location in Beijing does not establish the perpetrator's country.
Balochistan Police
January 13, 2026
•[ espionage, malware, government ]
From January 13 to April 9, 2026, Balochistan Police infrastructure communicated with Remcos command-and-control server 89.31.121[.]220 attributed to TAG-179, a suspected India-linked espionage actor. A related lure imitated an operational plan for repatriating undocumented foreigners and referenced police, NADRA, and Pakistani intelligence coordination. TAG-179 overlaps to varying degrees with Mysterious Elephant and Bitter, but no specific Indian intelligence service or unit has been publicly identified.
Undisclosed banking customers, financial-services customers, and small-to-medium businesses in Portugal, Spain, Mexico, and Latin America
February 24, 2026
•[ phishing, malware, financial ]
WatchGuard telemetry identified Grandoreiro infections beginning in late February 2026. Phishing links delivered ZIP archives containing legitimate applications and malicious DLLs for side-loading, while a related campaign used an obfuscated VBS file to install the banking trojan. The confirmed victim population comprised banking and financial-services customers, small-to-medium businesses, and users in Portugal, Spain, Mexico, and other parts of Latin America; references to banks in the malware code identify targeted banking applications, not confirmed compromises of the banks themselves.
Undisclosed Windows users seeking system and hardware utilities
March 1, 2026
•[ malware, technology, financial ]
Beginning in March 2026, attackers used poisoned search results and fake download sites impersonating utilities such as CrystalDiskInfo, HWMonitor, PDFgear, and FurMark to compromise Windows users, with some malicious links also appearing in AI-chatbot recommendations during April. The malware installed ScreenConnect for persistent access, collected host information, and deployed GPU-focused cryptocurrency miners through process hollowing. Microsoft identified more than 150 malicious domains associated with the campaign.
Sage Water Resources, LLC
March 15, 2026
•[ espionage, energy, malware ]
An advanced nation-state threat actor maliciously modified PLC logic at Sage Water Resources' Blue Bench 13-1 saltwater-disposal facility in Duchesne, Utah on March 15, 2026. The changes bypassed pump shutdown safeguards and allowed pumps to continue running dry while the control system displayed normal operation. A truck driver noticed the abnormal conditions and operators shifted to manual control before equipment failure, environmental damage, or service interruption occurred.
Ultrahuman
March 27, 2026
•[ leak, malware, healthcare ]
On March 27, 2026, attackers used credentials stolen from a malware-infected employee laptop to obtain read-only access to Ultrahuman's internal analytics system. Ultrahuman said wellness data belonging to approximately 0.1% of users was accessed, took the affected system offline, and revoked access. The company reported that passwords, payment information, production systems, and Ultrahuman Ring devices were not compromised and did not confirm whether data was exfiltrated.
Undisclosed insurance organization
April 1, 2026
•[ espionage, malware, finance ]
Beginning in April 2026, researchers observed the Backdoor.Mistic remote access trojan deployed on the network of at least one undisclosed insurance organization. The backdoor enabled file upload and download, file manipulation, folder creation, and in-memory code execution. The victim's identity, location, affected systems, and any acquired information were not disclosed. SecurityWeek attributed the activity to Woodgnat, also known as KongTuke, while Broadcom assessed that Mistic may be associated with the group.
Undisclosed professional services organization
April 1, 2026
•[ espionage, malware, technology ]
Beginning in April 2026, researchers observed the Backdoor.Mistic remote access trojan deployed on the network of at least one undisclosed professional services organization. The backdoor enabled file upload and download, file manipulation, folder creation, and in-memory code execution. The victim's identity, location, affected systems, and any acquired information were not disclosed. SecurityWeek attributed the activity to Woodgnat, also known as KongTuke, while Broadcom assessed that Mistic may be associated with the group.
At least one business traveler
May 1, 2026
•[ phishing, malware, espionage ]
Attackers manipulated hospitality captive-portal traffic to redirect at least one business traveler to credential-phishing and malware infrastructure. Microsoft later attributed the CaptiveCrunch campaign to the SVR-linked Midnight Blizzard cluster and confirmed endpoint collection and exfiltration; no operational disruption to the traveler was reported.
United States Department of Homeland Security
May 15, 2026
•[ espionage, hack, malware ]
An unidentified actor compromised DHS's Homeland Security Information Network servers and an associated SharePoint environment. From May 15 through May 24, analysts observed altered files on testing and production servers, malicious code executed through a legitimate web-server program, and deleted activity logs, but the activity was dismissed as a false positive. Similar activity continued from May 25 through June 3. On June 4, the attackers installed hidden backdoors and stole credential files, prompting confirmation of the breach. DHS isolated affected systems and mitigated the vulnerability; HSIN remained operational, classified networks were not affected, and neither the actor nor any theft of additional HSIN documents had been established.
Red Hat, Inc.
May 29, 2026
•[ hack, malware, technology ]
On 2026-05-29, a Red Hat GitHub account compromised through a malicious VS Code extension was used to push unauthorized commits to repositories in the RedHatInsights organization. Attackers injected the Miasma credential-stealing worm into 32 @redhat-cloud-services npm packages and altered configuration files to infect developers opening affected directories. Red Hat removed the malicious versions and contained the compromised extension by 2026-06-01. Red Hat confirmed that the packages were not part of released products and that identified managed cloud services and customer environments were not affected.
Multiple undisclosed Windows users
June 1, 2026
•[ leak, malware, phishing ]
Attackers distributed a PureLogs information-stealing payload through fake purchase-order emails containing a RAR archive. The archive launched JavaScript and PowerShell, used process hollowing to inject a downloader into MsBuild.exe, and retrieved a fileless PureLogs payload from command-and-control infrastructure. The malware collected browser, cryptocurrency-wallet, messaging, VPN, application, clipboard, screenshot, and system data and exfiltrated it through encrypted HTTP POST requests. Public reporting did not identify the affected users or provide an infection count, so the source publication date is used as the event date.
Undisclosed operators of at least 10 Ukrainian websites and infected device users
June 1, 2026
•[ espionage, malware, government ]
CERT-UA attributed the June-July 2026 campaign to UAC-0145, a sub-cluster of SANDWORM. The attackers compromised at least 10 Ukrainian websites, injected SMARTAXE to display fake CAPTCHA instructions and resolve command-and-control infrastructure through an Ethereum smart contract, and deployed multiple Windows and Android malware families for reconnaissance, persistence, remote access, and data collection.
