#nation-state

China- and India-linked hacking crews independently broke into the same Pakistani police systems for over two years, planting AsyncRAT and custom malware that could snare officers and citizens alike.

Source: SentinelOne

An Iran-linked hacking crew is quietly burrowing into Israeli government and IT organizations using a stealthy, modular malware framework built to dodge detection at every turn.

Source: Check Point Research

Chinese state-linked hackers Mustang Panda are deploying two stealthy new implants against India's government and energy sectors, abusing the legitimate Zoho WorkDrive cloud service as a covert command channel.

Source: Acronis Threat Research Unit

A DPRK-linked Rust implant called Gaslight embeds 38 fabricated system messages designed to confuse and derail AI-assisted malware analysis, while quietly stealing your browser data, keychain, and terminal history through an encrypted Telegram channel.

Source: SentinelLABS

North Korean and Russian-linked operations dominated the week as Operation Endgame dismantled SocGholish infrastructure, FortiBleed exposed tens of thousands of Fortinet credentials, and supply chain attacks hit npm, JetBrains, and WordPress ecosystems amid active exploitation of critical flaws in Oracle PeopleSoft and Cisco SD-WAN.

A suspected China-nexus group known as UNC6508 infiltrated medical and military research systems by exploiting REDCap servers and silently rerouting sensitive emails for long-term espionage.

Attackers deployed custom malware, escalated privileges, and abused Google Workspace rules to covertly siphon research communications without detection for over a year.

Source: Google Threat Intelligence Group

State-backed actors linked to China and North Korea are intensifying intrusions against global technology firms, focusing on intellectual property theft and AI development pipelines. Murky Panda and Warp Panda accounted for a majority of state-sponsored activity, while FAMOUS CHOLLIMA drove large-scale IT worker infiltration campaigns. Additional eCrime operations supported access to hundreds of targeted organisations through brokered credentials.

Source: CrowdStrike | CrowdStrike Report