Threat bulletin covers library ransomware and exploited SonicWall, OpenSSH flaws
SonicOS SAML VPN bypass and OpenSSH before 10.6p2 are described as actively exploited; Android 14–17 RCE is also patched.
4
Stories per day · 30 days
2 RSS
Relatedwatering-hole10android8ios5n-day3apple2exploits2iphone2kev2midnight-blizzard2mobile-exploits2mobile-security2supply-chain2ai-malware1cisa1claude1cozy-bear1detection1exploit-chains1
16 stories, newest first · one card per story
Stories tagged #apt29
APT29 uses watering hole attacks on mobile devices
Sekoia linked APT29 to a mid-October 2026 campaign targeting iOS and Android via hacked sites and compromised analytics service.
1
APT29 ran zero-click smartphone espionage campaign against Ukraine, US and Europe
Sekoia says the SVR-linked group watered legitimate and spoofed websites and compromised Plerdy analytics to steal messages, passwords and photos from iPhones and Androids.
APT29 targets iOS and Android users with n-day exploits
APT29 uses compromised sites and lookalike domains to deliver n-day exploits stealing cookies and device data from iOS and Android users spotted in mid-October 2026.
2
APT29 hijacks web analytics script to deliver iOS and Android exploits
APT29 uses Plerdy SEO Tracker supply chain compromise to serve n-day exploits stealing cookies and device data from iOS and Android users in 2026.
7
APT29 watering holes target patched iPhones and Android
Attackers served exploit chains for already-patched iOS and Android flaws via legitimate websites and lookalikes.
1
APT29 uses fake US UK sites for iOS Android exploits
APT29 campaign hits iOS 16.7 18.5 and Android Chrome with patched n-day flaws via JavaScript injection and supply-chain compromise.
3
APT29 Uses Watering Hole Attacks on Trusted Sites
APT29 planted malicious scripts on real and cloned websites in the US, Ukraine and Europe to compromise outdated iPhones and Androids by stealing cookies and data.
3
Russian Hackers Use N-Day Exploits in Zero-Click Attacks on iOS and Android
APT29 deploys n-day exploits via watering-hole sites on iOS and Android devices with no user interaction.
Malware evasion made easier with AI — but behavior still gives it away
ReversingLabs says Midnight Blizzard’s AI-rebuilt backdoor kept the same detectable behavior across five variants.
7
Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection
Anthropic disrupted APT29-linked GTG-20006, which used Claude to autonomously rebuild malware, hijack hotel Wi-Fi DNS, and target 20-plus Ukrainian, European, and US-linked organizations.
9
Anthropic caught Russia-linked spies using Claude in hacking operations
Anthropic disrupted Russia-linked APT29 using Claude in espionage against 20+ organizations, including Ukrainian government targets and a military drone maker whose vision SDK was stolen.
Latest Anthropic horror story chills with tales of kamikaze drone swarms and bioweapons research
Anthropic threat report says APT29, ShinyHunters and others used Claude models to automate cyberattacks, surveillance, and bioweapons research.
Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts
Google tracked three suspected Russian espionage clusters abusing OAuth flows, app passwords, and WhatsApp linking to hijack accounts of diplomats and defense targets.
Fake Conferences, OAuth and WhatsApp: Inside Russia’s New Espionage Tactics
Google tracks three Russia-linked espionage clusters abusing OAuth, app passwords, and device code phishing against Western researchers and diplomats.
3
CaptiveCrunch: Midnight Blizzard Weaponizes Hotel Wi-Fi Captive Portals to Steal Microsoft 365 Credentials
Zscaler details CaptiveCrunch: Midnight Blizzard's Storm-2945 compromises hotel Wi-Fi captive portals to redirect guests and harvest Microsoft 365 credentials via device code phishing.
2