#state-sponsored

August 2025 was marked by a sharp increase in zero-day exploitation and ransomware campaigns targeting enterprises, critical infrastructure, and cloud platforms. Multiple vendors, including Cisco, Microsoft, Citrix, and Apple, released emergency patches for actively exploited vulnerabilities, highlighting persistent systemic weaknesses.

Large-scale data breaches continued to affect millions of individuals. Notable incidents included Allianz Life, TransUnion, Farmers Insurance, Bouygues Telecom, and Columbia University, often linked to third-party system compromises and phishing campaigns exploiting Salesforce integrations. Personal, financial, and health information were commonly exposed.

AI and LLM security became a focal concern as researchers demonstrated prompt injection, jailbreaks, and other methods to bypass safeguards in GPT-5, GitHub Copilot, and Claude Code. Malicious AI-assisted campaigns increased the sophistication and reach of phishing, credential theft, and ransomware operations.

Ransomware activity remained intense, with groups such as Akira, RomCom, Charon, and BlackSuit conducting targeted attacks. Law enforcement disrupted Royal and BlackSuit ransomware gangs, seizing infrastructure and cryptocurrency. INTERPOL’s Operation Serengeti 2.0 dismantled networks across Africa, recovering millions in illicit funds.

Critical infrastructure vulnerabilities were widely reported. Exploits affecting Dell ControlVault3, Cisco RADIUS, Rockwell and Siemens OT systems, and Docker Desktop highlighted persistent operational technology risks. Industrial, telecommunications, and government networks continued to face espionage campaigns from state-linked actors, including Salt Typhoon and Static Tundra.

Malware, supply chain, and mobile threats expanded, with campaigns such as Anatsa, Hook v3, PipeMagic, and TamperedChef leveraging trojanised apps, phishing, and legitimate tools for persistent compromise. These incidents underscored the growing intersection of software supply chains and AI-assisted attack vectors.

Credit Adam Ellis

📨 An open letter to the U.S. Congress

🏳️‍⚧️ Stop the attacks on trans people! Pass the EQUALITY Act now!

✍️ 2,625 so far! Help us get to 3,000 signers!

I am deeply alarmed by the relentless attacks on LGBTQ+ Americans, especially trans people and trans kids. As President Biden has said, it is Congress’s duty to protect the rights and freedoms of all people. That means passing the bipartisan Equality Act to ensure LGBTQ+ individuals can live with safety and dignity.

Right now, hundreds of state bills seek to strip LGBTQ+ people of free speech, health care, and civil rights—fundamental freedoms due to all Americans. Encouraging hateful rhetoric and violence is a dangerous precedent we’ve seen in history before. It must stop.

Have you publicly opposed these anti-trans and anti-LGBTQ+ laws? What actions are you taking to protect your LGBTQ+ constituents? The time for strong action is now.

▶ Created on March 21, 2023 by Jess Craven

📱 Text SIGN PTFEXR to 50409

🤯 Liked it? Text FOLLOW JESSCRAVEN101 to 50409

Discrimination and subjugation of specific groups by a state can manifest in various ways. Here are some common actions and policies that states may employ when engaging in discrimination or subjugation:

Legal Discrimination: States may enact laws that explicitly discriminate against certain groups, such as racial segregation, discriminatory voting laws, or restrictions on property ownership.

Institutionalized Bias: Discrimination can be institutionalized through biased law enforcement, unequal access to education, or disparities in healthcare.

Segregation: Establishing segregated facilities or neighborhoods, often along racial lines, is a classic form of discrimination.

Violence and Repression: States may use violence, harassment, or intimidation to subdue or control specific groups.

Forced Relocation: Displacing particular communities or groups from their homes or land.

Censorship and Suppression of Information: Controlling or censoring information to limit awareness and organization among discriminated groups.

Economic Exploitation: Exploiting certain groups economically by providing unfair labor conditions or limited economic opportunities.

Denial of Basic Rights: Depriving specific groups of their rights, including the right to vote, work, or access education.

Hate Speech and Propaganda: Promoting hate speech, propaganda, or stereotypes to justify discrimination.

Ethnic Cleansing and Genocide: Extreme cases involve ethnic cleansing and genocide, where the state actively seeks to eliminate a particular ethnic or social group.

Religious Persecution: Discrimination based on religion, including restrictions on religious practices, places of worship, or religious attire.

Sexual Orientation Discrimination: Enforcing discriminatory laws or practices against individuals based on their sexual orientation.

Political Oppression: Targeting groups based on their political beliefs or affiliations, including suppression of opposition parties.

State-Sponsored Discrimination: In some instances, the state sponsors and supports discriminatory groups or organizations.

Marginalization: Marginalizing certain groups from participating in the political, economic, or social life of the country.

Denial of Citizenship or Legal Status: Denying citizenship, legal status, or documentation to certain groups, rendering them stateless.

Gerrymandering: Manipulating political boundaries to dilute the voting power of specific groups.

Selective Law Enforcement: Enforcing the law selectively to target particular groups.

Mass Surveillance: Conducting extensive surveillance of specific communities or groups.

Restricted Movement: Imposing curfews, roadblocks, or travel restrictions on targeted groups.

Degenerate art "Entartete Kunst" exhibition of degenerate art, a term used by the culture of the Hitler regime to indicate the forms of art and aesthetic values expressed contrary to the Nazi concepts. 

Five Eyes intelligence agencies have warned that Chinese operatives are using LinkedIn, Indeed, and Upwork to target individuals with access to sensitive government, military, and economic information through fake consultancy and recruitment profiles. Targets are gradually moved to encrypted messaging platforms after providing reports, with payments offered for continued access and intelligence gathering. The campaign focuses on clearance holders, academics, journalists, and defence-adjacent professionals.

Source: Recorded Future News | MI5

Google and Mandiant dismantled the GRIDTIDE campaign run by UNC2814, which targeted telecoms and governments in 42 countries using Google Sheets API for C2 traffic.

Source: Google Cloud

State-linked actors from Russia, China, North Korea, and Iran are exploiting recruitment channels, messaging apps, and supply chains to target defence contractors, personnel, and connected networks.

Source: Google Threat Intelligence Group

German authorities warned that a state-backed campaign is exploiting Signal verification codes and device linking to compromise politicians, military personnel, and journalists.

Source: The Hacker News | Bundesamt für Verfassungsschutz & BSI