Roundup: Tor exit hijacks, Heartbreaker ransomware, and platform breaches
A researcher says 333 Tor exits, about a tenth of them, captured SSH passwords and tried to plant Ebury.
Stories per day · 30 days
1 RSS
Relatedhookedge5nato5defense3credential-theft2espionage2ssh-tunnel2ebury1fancy-bear1gru1incomplete-patch1legionrelay1macos1naval1ntlm1ransomware1roundcube1spearphishing1ssrf1
15 stories, newest first · one card per story
Stories tagged #apt28
APT28 used Hookedge to tunnel into NATO shipbuilder
The unnamed intrusion began July 24, 2026, via a Word macro and lasted at least two months.
APT28 uses Hookedge and an SSH tunnel against NATO defense firms
A naval shipbuilder intrusion starting July 24, 2026 lasted at least two months and included stolen credentials.
APT28 targeted NATO shipbuilder, engine maker and police agency
Symantec says the operators used Hookedge and an undocumented loader, ld.exe, whose decrypted payload was not recovered.
Incomplete security patches rose about eightfold in 2026
KEV fixes were later reported broken about four times as often as other fixes from the same vendors.
1
APT28 breaches NATO naval shipbuilder, deploys reflective loader
Symantec says operators stole credentials two ways, opened an SSH tunnel and ran a new in-memory loader.
APT28 targeted European defense firms in two NATO countries, Symantec says
A July Word attachment led to Hookedge and an in-memory tool; activity ran from July 24 to September 24.
1
AI Malware Keeps Changing Its Code to Break Traditional Signature-Based Detection
Google's GTIG documents AI-enabled malware PROMPTFLUX and PROMPTSTEAL that query LLMs at runtime to rewrite code and evade signature-based detection.
4
2,000 Leaked Documents Reveal How Russia Turns Engineering Students Into GRU Cyber Operators
Leaked Bauman Moscow State Technical University files reveal a hidden GRU training pipeline feeding APT28 and Sandworm units.
Leaked Russian Cyber-Operations Training Materials
Leaked Bauman university records reveal a formalized Russian pipeline training GRU cyber personnel, linking a graduate to Sandworm's Military Unit 74455.
Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations
Russian GRU-linked BlueDelta (APT28) deployed HOOKEDGE backdoor via macro Word lures against European governments using webhook.site and Microsoft Edge for stealthy C2.
APT28-Linked HOOKEDGE Backdoor Targets European Government and Diplomatic Organizations
Recorded Future links new HOOKEDGE batch-script backdoor campaigns against Romanian, Spanish and Turkish government targets to Russia's APT28 (BlueDelta).
The AI Malware Maturity Gap
Recorded Future introduces AIM3, a five-level maturity model for AI malware, showing current attacker AI use is mostly AI-assisted rather than autonomous.
6
8,539 Reasons To Rethink How Vulnerabilities Get Patched
Rapid7 counted 8,539 high and critical CVEs in Q2 2026, double last year, with PoC availability up 76%.
Hackers target Ukrainian agency managing assets seized from sanctioned Russians
Ukraine's ARMA asset agency reported a cyberattack amid selecting a manager for seized IDS Ukraine assets linked to sanctioned Russians.