setup.exe

• Exposing Fox Tempest: A malware-signing service operation

  Exposing Fox Tempest: A malware-signing service operation Fox Tempest is a financially motivated threat actor operating a malware‑signing‑as‑a‑service (MSaaS) used by other cybercriminals, including Vanilla Tempest and Storm groups, to more effectively distribute malicious code,

• Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns

  Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns Unit 42 details Screening Serpens' use of AppDomainManager hijacking and new RAT variants to target tech and defense sectors in recent campaigns. The post Tracking Iranian APT Screening Serpens’ 2026 Espionage Camp

• AI brands as bait: How threat actors are using the AI hype in social engineering

  AI brands as bait: How threat actors are using the AI hype in social engineering As threat actors operationalize AI to accelerate attacks, they are also leveraging the wider global interest around AI itself as a social engineering lure. The post AI brands as bait: How threat act

• Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict

  Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict Key Findings Introduction During the recent geopolitical tensions in the Middle East, we reported on multiple Iran-nexus threat actors advancing Iran’s strategic objectives through cyber operati

• OceanLotus: From external espionage to domestic targeting

  OceanLotus: From external espionage to domestic targeting A shift in operational pattern of the infamous Vietnam-aligned APT group OceanLotus: From external espionage to domestic targeting Award-winning news, views, and insight from the ESET security community English Español D

• CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure

  CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure Government entities and critical infrastructure were targeted for espionage in SE Asia by attackers using a hybrid toolkit, including custom TinyRCT backdoor. The post CL-STA-1062 Targets Southeast Asian

All reports →

• Connector · intel_report_ingest6