Sign in Subscribe

APT28

APT28 is a Russian military intelligence (GRU)-linked espionage group. Also tracked as Fancy Bear, Forest Blizzard, Sednit, and Strontium depending on the reporting vendor.

Trending Topics

Trending Topics

Docker Engine flaw CVE-2026-34040 enables host takeover. Forest Blizzard (Fancy Bear) hijacks SOHO routers for surveillance. Contagious Interview poisons 1,700 packages, tied to BlueNoroff (UNC1069). OpenSSL RSA KEM leaks key data.

Trending Topics

Trending Topics

Aura discloses targeted account compromise. FancyBear (APT28) server leak exposes live espionage operations across NATO-aligned governments. Apple patches critical WebKit same-origin flaw.

Trending Topics

Trending Topics

APT28 (Fancy Bear) revives espionage with Covenant/BeardShell malware. A0Backdoor spreads via Teams impersonation. Camaro Dragon targets Qatar. GhostLoader poses as OpenClaw npm package.

GRU Tradecraft and Network Edge Access

Threat Intelligence

GRU Tradecraft and Network Edge Access

A GRU-aligned team is abusing misconfigured, cloud-hosted network edge devices as passive listening posts, harvesting and replaying credentials into Western energy, logistics, and telecom networks without deploying any malware.

Trending Topics

SafePay Ransomware

Trending Topics

SafePay claims the Ingram Micro breach. Mustang Panda hits maritime shipping firms via USB malware. ShinyHunters, overlapping with Scattered Spider (UNC3944), exploits Salesforce via vishing. APT28 deploys AI-powered LameHug malware.

Trending Topics

Trending Topics

CVE-2025-49596 Critical MCP Inspector A remote code execution vulnerability in

Trending Topics

Trending Topics

APT28 exploits webmail XSS in Operation RoundPress. DarkCloud Stealer resurfaces via AutoIt payloads. Chihuahua Stealer abuses cloud storage. Bitpixie revives BitLocker bypass concerns.

Trending Topics

Proof-of-Concept

Trending Topics

Erlang/OTP SSH flaw CVE-2025-32433 enables critical RCE. Linux kernel CVE-2024-53141 gets public PoC exploit. CVE-2025-24054 NTLM hash leak used in active phishing campaigns.