Advanced Persistent Threats

Advanced Persistent Threats | News, how-tos, features, reviews, and videos

CISOs can no longer ignore the nation-state threat

AI is lowering the barrier to sophisticated attacks and shrinking defenders’ response time, forcing CISOs to treat geopolitical threats as an increasingly urgent enterprise risk.

By Cynthia Brumfield

Sep 22, 20268 mins

Advanced Persistent ThreatsCyberattacksCybercrime

Threat actors are coming for your AI assets to operationalize their use of AI

By Lucian Constantin

Sep 15, 20266 mins

Advanced Persistent ThreatsCyberattacksCybercrime

How China industrialized the infrastructure behind state hacking

By Cynthia Brumfield

Sep 2, 20268 mins

Advanced Persistent ThreatsCyberattacksCybercrime

Researchers unearth industrial sabotage malware that predated Stuxnet by 5 years

By Lucian Constantin

Apr 29, 20267 mins

Advanced Persistent ThreatsCritical InfrastructureMalware

10 years later, Bangladesh Bank cyberheist still offers cyber-resiliency lessons

By John Leyden

Feb 16, 20268 mins

Advanced Persistent ThreatsCyberattacksCybercrime

New APT group breached gov and critical infrastructure orgs in 37 countries

By Lucian Constantin

Feb 5, 20265 mins

Advanced Persistent ThreatsCyberattacksCybercrime

Articles

Iranian APT Prince of Persia returns with new malware and C2 infrastructure

Once considered dormant, the threat group has been quite active in evolving its techniques and tools, with updated malware for reconnaissance and data exfiltration.

By Lucian Constantin

Dec 19, 2025 5 mins

Advanced Persistent ThreatsCyberattacksCybercrime

Chinese cyberspies target VMware vSphere for long-term persistence

CISA and the NSA warn that Chinese state-sponsored attackers are deploying malware dubbed BRICKSTORM on VMware servers to perform lateral movement inside victim networks.

By Lucian Constantin

Dec 5, 2025 4 mins

Advanced Persistent ThreatsCyberattacksCybercrime

ToddyCat APT evolves to target Outlook archives and Microsoft 365 tokens

The new ToddyCat tooling shifts the group’s focus from browser theft to extracting Outlook mail archives and Microsoft 365 access tokens.

By Shweta Sharma

Nov 26, 2025 3 mins

Advanced Persistent ThreatsCyberattacksCybercrime

Iranian APT hacks helped direct missile strikes in Israel and the Red Sea

Amazon Threat Intel has correlated activity by Iranian threat groups with subsequent missile strikes, and suggests that IT threat modeling should include scenarios involving potential physical attacks.

By Lucian Constantin

Nov 19, 2025 5 mins

Advanced Persistent ThreatsCyberattacksCybercrime

Zero-day exploits hit Cisco ISE and Citrix systems in an advanced campaign

According to the Amazon Threat Intelligence team, attackers exploited bugs in Cisco and Citrix appliances before they were made public, deploying custom in-memory tooling against core identity infrastructure.

By Shweta Sharma

Nov 13, 2025 4 mins

Advanced Persistent ThreatsCyberattacksCybercrime

Russian APT abuses Windows Hyper-V for persistence and malware execution

Recently documented Curly COMrades group bypasses traditional host-based EDR solutions by spinning up VMs with deceptive names using Windows’ own bare-metal hypervisor.

By Lucian Constantin

Nov 5, 2025 5 mins

Advanced Persistent ThreatsCyberattacksWindows Security

North Korean threat actors turn blockchains into malware delivery servers

‘EtherHiding’: Nation-state and cybercriminal groups are leveraging smart contracts as command-and-control servers for deliveing malicious payloads hidden on blockchains.

By Lucian Constantin

Oct 17, 2025 5 mins

Advanced Persistent ThreatsCyberattacksMalware

Flax Typhoon exploited ArcGIS to gain long-term access

Flax Typhoon turned the trusted ESRI mapping tool into a web shell, gaining persistent access.

By Nidhi Singal

Oct 15, 2025 7 mins

Advanced Persistent ThreatsSecurity

Chinese APT group Phantom Taurus targets gov and telecom organizations

Researchers have attributed separate clusters of previously tracked malicious activity to a single group that has elevated its tactics this year, adding previously undocumented Microsoft IIS backdoors to its arsenal.

By Lucian Constantin

Oct 1, 2025 4 mins

Advanced Persistent ThreatsCyberattacks

Chinese spies had year-long access to US tech and legal firms

Backdoor on edge devices allowed a starting point for threat actors to use lateral movement to access VMware vCenter and ESXi hosts, Windows workstations and servers and Microsoft 365 mailboxes.

By Lucian Constantin

Sep 24, 2025 5 mins

Advanced Persistent ThreatsNetwork SecurityThreat and Vulnerability Management

Salt Typhoon APT techniques revealed in new report

An advisory details the activities and techniques used by Chinese state-sponsored cyberespionage group Salt Typhoon that has breached telecommunications providers, military networks and government agencies over the past few years.

By Lucian Constantin

Aug 28, 2025 5 mins

Advanced Persistent ThreatsCritical InfrastructureCyberattacks

Black Hat: Latest news and insights

The Black Hat series of international cybersecurity conferences brings together top IT security pros, researchers, and thought leaders to discuss the latest cyber techniques, vulnerabilities, threats, and more. Here’s the latest to know.

By CSO Staff

Aug 18, 2025 8 mins

Advanced Persistent ThreatsThreat and Vulnerability ManagementWindows Security

View all

CISOs can no longer ignore the nation-state threat

Threat actors are coming for your AI assets to operationalize their use of AI

How China industrialized the infrastructure behind state hacking

Researchers unearth industrial sabotage malware that predated Stuxnet by 5 years

The espionage reality: Your infrastructure is already in the collection path

Zero-day exploits hit enterprises faster and harder

The rise of the evasive adversary

10 years later, Bangladesh Bank cyberheist still offers cyber-resiliency lessons

New APT group breached gov and critical infrastructure orgs in 37 countries

Articles

Iranian APT Prince of Persia returns with new malware and C2 infrastructure

Chinese cyberspies target VMware vSphere for long-term persistence

ToddyCat APT evolves to target Outlook archives and Microsoft 365 tokens

Iranian APT hacks helped direct missile strikes in Israel and the Red Sea

Zero-day exploits hit Cisco ISE and Citrix systems in an advanced campaign

Russian APT abuses Windows Hyper-V for persistence and malware execution

North Korean threat actors turn blockchains into malware delivery servers

Flax Typhoon exploited ArcGIS to gain long-term access

Chinese APT group Phantom Taurus targets gov and telecom organizations

Chinese spies had year-long access to US tech and legal firms

Salt Typhoon APT techniques revealed in new report

Black Hat: Latest news and insights

Resources

Managing modern identity complexity and reducing executive risk

The new era of executive risk: Why identity security must be continuous

5 identity security questions CISOs must be ready to answer

Video on demand

Defending against mobile technology threats | Salted Hash Ep 24

Honeypots and the evolution of botnets | Salted Hash Ep 23

Kaspersky Lab, U.S. Cyber Command, Hollywood hacking and ransomware | Salted Hash Ep 1