Rapid7 says 71% of tracked exploitation starts within a week
Across 43 newly exploited high- and critical-severity flaws, disclosure-to-exploitation averaged three days.
54
Country
Pakistan
- Mentions · 7d2
- Mentions · 30d10
- All mentions24
- First seenAug 15, 2026
- Last mentioned3d ago
Timeline
24 articles · newest firstSolar electricity generation is overtaking nuclear worldwide
Ember data shows solar narrowly surpassed nuclear generation in 2025 and is expected to exceed it in 2026.
4
AOMEI Backupper update servers briefly hijacked to push a backdoor
Tampered configs sent Backupper 8.3.0 and later a dropper that installed Radmin and SHINYROAD.
78
AOMEI Backupper updates briefly served malware in 2026
UNC7017 used five-to-ten-minute windows to deliver CrossRoad and the ShinyRoad backdoor to anyone fetching packages.
78
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
UNC7017 briefly tampered with AOMEI Backupper updates to install the SHINYROAD backdoor on polling hosts.
78
Investigating Ephemeral Supply Chain Tampering
UNC7017 briefly hijacked AOMEI updates to deliver CROSSROAD and SHINYROAD malware.
82
DOJ charges 14 over a sprawling North Korean remote work scheme
DOJ charged 14 people for a North Korean remote-IT scheme that drew about $3 million from 70 U.S. employers.
74
CyberXero Combines Claude Code, PentAGI and Cobalt Strike in AI-Augmented Cyberattacks
CyberXero used Claude Code, PentAGI and Cobalt Strike to breach sites and steal Ukrainian data.
82
Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign
Cisco Talos says China-nexus UAT-11587 deployed the Antino backdoor against Asian government and policy organizations.
78
Researchers find Chinese hacking campaigns targeting AI firms, Asian governments
Chinese state-backed groups phished AI researchers and used the Antino backdoor against Asian governments, hitting about 350 endpoints.
76
Meta Partners With Government Agencies, Law Enforcement, and Safety Organizations to Launch Regional Anti-Scam Education Campaign
Meta's One Step Ahead anti-scam campaign reached 303 million people across 18 Asia-Pacific countries.
32
Dark Web Profile: Blue Locker Ransomware
Blue Locker ransomware resurfaced with an August 2025 attack linked to Pakistan after years of quiet.
46
SideCopy Broadens India Targeting to Academia With ReverseRAT Spear-Phishing
SideCopy used spear-phishing and mshta.exe to deploy ReverseRAT against Indian academic institutions, Trellix reports.
68
Nations take action on North Korean IT workers after UN report
Multiple countries took legal action against North Korean IT worker facilitators following a new UN-linked MSMT report on the illicit scheme.
50
APT36 Uses USB-Spreading Malware to Reach Air-Gapped Government Networks
Zscaler attributes the RapidRust campaign by Pakistan-linked APT36 to USB-propagating Rust malware targeting air-gapped government networks in India and Afghanistan.
78
APT36 Targets Indian Government and Defense Organizations With New Rust Malware Arsenal
Pakistan-linked APT36 deployed a Rust malware suite, including RUSTYSHADE and USB-spreading RUSTYMOVE, against Indian and Afghan government and defense targets.
78
Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH
Zscaler details Operation RapidRust: APT36 deploys four new tools including RUSTYSHADE, a Rust backdoor using private GitHub repos for encrypted C2.
70
Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor
Seqrite Labs details Operation QUICSILVER, a China-nexus espionage campaign targeting Myanmar government and IT with graduation-invite lures deploying QUICAgent backdoor.
65
Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall
Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.
48
Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent
Unit 42 details Patchwork APT campaigns against the Indian subcontinent using EPS exploits and an updated BADNEWS backdoor targeting Pakistani military and nuclear interests.
54
Multiple ArtraDownloader Variants Used by BITTER to Target Pakistan
BITTER used three ArtraDownloader variants since 2015 to target Pakistan, China, and Saudi Arabia, deploying BitterRAT and exploiting CVE-2017-11882 in one wave.
48
Mustang Panda Upgrades CoolClient With a Kernel Rootkit
Mustang Panda's updated CoolClient backdoor deploys a signed kernel driver to hide processes, files and network activity in Asian intrusions.
62
Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth
Kaspersky reports Mustang Panda's updated CoolClient backdoor now deploys a signed kernel-mode Windows rootkit, hitting government victims in Myanmar, Mongolia, Pakistan, and Russia.
62
New PATCHCORD Backdoor Targets Afghan Telecom and Indian Critical Infrastructure
Acronis links APT36 (Transparent Tribe) to new backdoors PATCHCORD and SHEETCORD targeting Afghan Telecom and Indian government, defense, and energy networks.
61
Related CVEs
by mentions- CVE-2017-11882100%7.8Memory Corruption RCE in Microsoft Office via Legacy Equation Editor
- CVE-2017-026178%7.8Use-After-Free RCE in Microsoft Office 2010/2013/2016
- CVE-2015-254586%—Malformed EPS Image RCE in Microsoft Office
- CVE-2026-4815<1%8.7A SQL Injection vulnerability has been found in Support Board v3.7.7
- CVE-2024-6387100%8.1A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd)
Appears with
- Google Threat Intelligence Grouporganization · 4
- APT36threat actor · 4
- AOMEI Backupperproduct · 4
- Mandiantorganization · 4
- UNC7017threat actor · 4
- CrossRoadmalware · 4
- ShinyRoadmalware · 4
- CoolClientproduct · 3
- Zscalervendor · 3
- PlugXmalware · 3
- ManageEngineorganization · 3
- Mustang Pandathreat actor · 3
- Transparent Tribethreat actor · 3
- RUSTYSHADEmalware · 3
- Kasperskyvendor · 3
- AOMEI Technologyvendor · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.