ESET maps APT activity from April through September 2026
China-, Iran-, North Korea- and Russia-aligned groups hit governments, semiconductors, drones, crypto firms and Ukraine.
72
- Mentions · 7d2
- Mentions · 30d6
- All mentions13
- First seenAug 11, 2026
- Last mentioned3d ago
Timeline
13 articles · newest firstCheck Point weekly brief covers Onamae intrusion, PHP exploits, GitLab RCE
The October 26 bulletin also flags an exploited Arista flaw, a LiteLLM package compromise, and the Aokigahara infostealer.
66
Lazarus uses ML-KEM-1024 to hide payloads in Operation FlashHole
Securelist says at least three South Korean organizations were hit, with the earliest evidence in July 2025.
74
Rapid7: high-severity flaws exploited within three days in Q3
The Gentlemen and Qilin led claimed ransomware incidents, the US accounted for 60% of attacks, and AI was operational in 8%.
56
New Dell System Update flaw lets hackers gain root privileges
Dell warns a critical System Update path-traversal flaw, CVE-2026-86360, lets unauthenticated attackers run code as root.
71
Dell asks admins to patch max severity CSM flaws as soon as possible
Dell patched six critical Container Storage Modules flaws that let unauthenticated attackers gain admin control of enterprise storage.
73
Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
DPRK TraderTraitor's FLATROOF and ROOFDECK macOS backdoors resurfaced on an Indian IT services victim, delivered via weaponized Terraform lock files in fake job interviews.
68
North Korea's fake job interviews infected 30,000 devices
International advisories attribute 30,000 compromised devices, 7,000 crypto wallets, and $10.71 million in thefts to North Korea's WaterPlum fake-recruiter malware campaigns.
66
North Korean Hackers Deploy New Linux Espionage Toolkit
Rapid7 says North Korea-aligned actors use a new Linux espionage toolkit (ted HAProxy backdoor, CurlRAT) against South Korean automotive and media targets.
72
Risky Bulletin: Expired cards can be used for new transactions
Researchers show expired Visa contactless cards can be revived via NFC man-in-the-middle relay to run fraudulent transactions; roundup also covers major breaches.
55
Stately Taurus Activity in Southeast Asia Links to Bookworm Malware
Unit 42 links Stately Taurus APT activity in ASEAN region and Myanmar to the decade-old Bookworm malware family via infrastructure overlaps.
65
Lazarus hackers pair fake job offers with Windows zero-day exploit
Lazarus' Operation Dream Job targets the defense sector with fake job offers, a Windows LPE zero-day (CVE-2026-68820), and new Troy and RelayShell backdoors.
82
Microsoft Patches 398 Flaws Including a Windows Driver Zero
Microsoft's August Patch Tuesday fixes 398 CVEs, including actively exploited Windows zero-day CVE-2026-68820 used by Lazarus for SYSTEM privilege escalation.
82
Related CVEs
by mentions- CVE-2026-2276914%10.0Hard-coded credentials in Dell RecoverPoint for Virtual Machines allow root OS access
- CVE-2021-2155180%7.8Local Privilege Escalation in Dell dbutil_2_3.sys Driver
- CVE-2026-688209%7.0Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver
- CVE-2026-6369210.0Unauthenticated Privilege Escalation in Dell Container Storage Modules (<1.18.0)
- CVE-2026-6368810.0Unauthenticated Credential Theft in Dell Container Storage Modules (CSM) gRPC Server
- CVE-2026-1146251%9.4SQL injection in Arista VeloCloud Orchestrator grants superuser
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- Hard-Coded Credentials in Dell Container Storage Modules (CSM) Authorization, pre-1.18.0
- Path Traversal to Root Code Execution in Dell System Update before 2.3.0.0
- Improper Certificate Validation in Dell System Update Enables Root-Level RCE
Appears with
- Microsoftvendor · 3
- HAProxyproduct · 2
- Mandiantorganization · 2
- ShinyHuntersthreat actor · 2
- CISAorganization · 2
- Rapid7organization · 2
- Dellvendor · 2
- Rapid7vendor · 2
- The Gentlementhreat actor · 2
- Ziplinemalware · 2
- Spawnantmalware · 2
- Sandwormthreat actor · 2
- UNC6201threat actor · 2
- Windowsproduct · 2
- Container Storage Modulesproduct · 2
- Silk Typhoonthreat actor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.