Check Point researchers report large-scale phishing campaigns that abuse fake calendar invitations to harvest Microsoft account credentials. Lures arrive either as a malicious .ics attachment or as a link, for example in a fake Microsoft Teams meeting invite, that appears to point to one destination but leads to a credential-harvesting pa…
Silent Lynx, tracked as UAT-6275 by Cisco Talos and TAG-193 by Recorded Future Insikt Group, has been linked to a new set of attacks on government organizations across the Commonwealth of Independent States. The activity ran from June 2025 through August 2026 and used four infection chains to deploy custom reverse shells (FoalShell, Chvos…
Swallowtail (also tracked as APT28, Fancy Bear and Forest Blizzard), a Russian espionage group linked by the U.S. government to the GRU, targeted organizations in two NATO member states. Victims included a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. Symantec's Threat Hunter Team reported th…
Symantec reports that the Russia-linked APT28 (aka BlueDelta, Fancy Bear, Forest Blizzard), tracked by Symantec as Swallowtail, targeted entities in two NATO member states. Victims include a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. In the shipbuilder intrusion in late July 2026, operator…