Search: “Windows Server 2016”

6 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 277 Vulnerability 264 Ransomware 146 Exploit / PoC 114 Threat actor 54 Data breach 37 Policy & legal 18 Advisory 16 Phishing & fraud 8 Industry 7 Research 5 AI research 2 Tools 2 AI industry 1

SeverityAll critical 382 high 355 medium 170 low 35 info 9

MILE TEA: Cyber Espionage Campaign Targets Asia Pacific Businesses and Government Agencies

Unit 42 names MILE TEA, a cyber-espionage campaign since 2011 targeting Japanese and Taiwanese businesses and government agencies with e-ticket phishing lures and Elirks-family malware.

Unit 42 tracks the MILE TEA espionage campaign, observed as early as 2011, targeting Japanese trading, petroleum, and mobile companies, a Beijing office of a Japanese public organization, and a Taiwanese government agency. The primary infection vector is spear-phishing emails with attachments, mostly custom executable installers posing as flight e-tickets, dropping Elirks, Micrass, or Logedrut as initial bridgehead malware. Elirks and Logedrut retrieve encrypted C2 addresses from attacker-posted blog articles, decoded with Base64 and TEA or DES ciphers. The campaign's focus shifted from Taiwan to Japan around 2013.

Palo Alto Unit 42Aug 17, 12:56 UTC · Aug 17, 2026Threat actor in the wild1

Russia-linked hackers target webmail servers in Ukraine-related espionage operation

Help Net SecurityMay 15, 00:00 UTC · May 15, 2025Threat actor CVE-2023-43770 CVE-2024-11182

Magic Hound Campaign Attacks Saudi Targets

Palo Alto Unit 42Nov 1, 10:44 UTC · Nov 1, 2018Threat actor

New Threat Actor Group DarkHydrus Targets Middle East Government

Palo Alto Unit 42Jan 22, 18:56 UTC · Jan 22, 2019Threat actor

New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit

Palo Alto Unit 42Dec 11, 14:41 UTC · Dec 11, 2018Threat actor CVE-2018-81741

“Tick” Group Continues Attacks

Unit 42 tracks the Tick espionage group attacking Korean and Japanese defense and high-tech targets with Daserf, Minzen, 9002, Invader, and custom Gh0st RAT variants.

The Tick group has conducted long-running espionage attacks against organizations in the Republic of Korea and Japan, focusing on defense and high-tech companies holding intellectual property, and repeatedly attacked one high-profile Japanese target for three years. Unit 42 links the Daserf backdoor, the 9002 RAT, and the Invader backdoor through shared C2 infrastructure used between July 2012 and April 2013. Minzen samples install a "NamelessHdoor" backdoor derived from publicly available code over a decade old, modified with ReflectiveDLLLoader DLL injection, and the group also uses custom Gh0st RAT variants. Tick has shifted from privacy-protected domain registration to compromised websites for C2 infrastructure.

Palo Alto Unit 42Aug 17, 12:55 UTC · Aug 17, 2026Threat actor in the wild1