espionage

Breaches & attacks · Exploited · since 13 Nov 2026

A state-sponsored threat group named SilentAir compromised equipment across Asian mobile operators to intercept calls and text messages. The campaign primarily targeted users in Taiwan across at least six countries.

Breaches & attacks · Exploited · since 12 Nov 2026

State-sponsored threat actors linked to Kazakhstan utilized an autonomous AI agent to conduct espionage operations and infiltrate critical infrastructure across Central Asia. The campaign resulted in the theft of sensitive government documents.

Breaches & attacks · Exploited · since 10 Nov 2026

Three threat clusters utilizing the Sparrow malware ecosystem have targeted telecommunications, government, and critical infrastructure across multiple regions. Researchers identified shared infrastructure and code similarities linking these campaigns.

Breaches & attacks · Exploited · since 10 Nov 2026 · updated 12 Nov 2026

Russian state-linked hackers compromised government email servers in Romania and Kazakhstan to intercept correspondence with NATO and EU officials. Researchers revealed the covert espionage campaign affecting diplomatic communications.

Do:Investigate server logs for unauthorized access and review government email security controls.

Breaches & attacks · Exploited · since 10 Nov 2026

The Russia-aligned threat group Turla deployed a modular .NET toolset named Cereal on Microsoft Exchange servers at government organizations in Kazakhstan and Romania. The malware hijacks mail flow traffic to stealthily exfiltrate emails without requiring an external command-and-control server.

Breaches & attacks · Real loss · since 3 Nov 2026

Russia-linked cyber spies targeted Ukrainian organizations near the front lines using simple malware. The attackers stole sensitive documents, login credentials, and investigative data.

Breaches & attacks · Exploited · since 3 Nov 2026

A China-nexus espionage group and separate Chinese-speaking operators used large language model agents to orchestrate attacks against over 200 organizations and educational institutions. The AI agents automated command execution and scaled operations based on human-defined goals.

Breaches & attacks · Exploited · since 2 Nov 2026 · updated 9 Nov 2026

An India-linked threat group is conducting cyber-espionage operations against organizations in South Asia. The attackers utilize legitimate Windows functionality across three distinct attack chains to maintain persistence and gather intelligence.

Research · since 2 Nov 2026

Researchers uncovered a cyber espionage campaign targeting government Linux infrastructure using SysGoRAT and suspected AI-generated scripts. The activity was tracked between October 2025 and April 2026 by Unit 42.

Breaches & attacks · Real loss · since 2 Nov 2026

An Iran state-aligned threat group conducted an espionage campaign between August and October 2026, compromising a high-profile individual in Israel and a government cloud environment in the Kurdistan Region of Iraq. Dream Research Labs disclosed the intrusions.

Breaches & attacks · Exploited · since 28 Oct 2026 · updated 29 Oct 2026

Breaches & attacks · Exploited · since Jul 2025 (approx.)

Breaches & attacks · Exploited · since 20 Oct 2026

Breaches & attacks · Exploited · since 15 Oct 2026

Breaches & attacks · Exploited · since 2024 (approx.)