APT28
In 27 briefs, most recently 25 October 2026. RSS for this tag
Learn more: Malpedia ↗ ThreatFox ↗ MalwareBazaar ↗
Coverage in DanSec Daily
- Quest Diagnostics and Capcom breaches, LiteLLM master key leak, and unpatched PHP2Shell RCE drawing Mirai botnet exploitation attempts.
- Quest Diagnostics patient data breach, Capcom's 11.7M-record exposure, and PHP2Shell RCE with no patch, plus Brotli and ArubaOS flaws.
- OVHcloud CLI and Rank Math PRO supply chain compromises, the Ahold Delhaize cyberattack, and actively exploited Plex2Shell flaws.
- Hasbro breach, ATF ransomware incident and Hugging Face takeover by rogue AI agents lead; also ServiceNow and PaperCut flaws.
- The TeamPCP supply chain attacks on Checkmarx and Bitwarden, ShinyHunters breaches of ADT and Medtronic, and new Windows privilege escalation flaws.
- Eurail breach exposing 300,000+ passport records, ChipSoft ransomware shutdown, and Smart Slider 3 Pro backdoored update supply chain attack.
- Bitcoin Depot $3.6M crypto theft, Signature Healthcare hospital cyberattack, and TeamPCP supply chain breach exposing Cisco source code.
- APT28 router DNS hijacking stealing Microsoft 365 tokens, a SaaS integrator breach hitting a dozen-plus firms, and Flowise RCE flaw under active exploitation.
- Stryker wiper attack wiping ~80,000 devices, Lazarus linked to Bitrefill breach, and PolyShell Magento RCE flaw.
- Ericsson data breach, suspected FBI wiretap network breach, and Salesforce data theft campaign, plus APT28 espionage malware and Ivanti EPM exploitation.
- The Wikipedia JavaScript worm, a $46M crypto theft arrest, LeakBase's takedown, and Cisco SD-WAN zero-days exploited in the wild.
- The Oracle E-Business Suite breach at Madison Square Garden, APT28's MSHTML zero-day CVE-2026-21513, and North Korea's Contagious Interview npm campaign.
- Optimizely vishing breach, Vanta Diagnostics breach claimed by Everest ransomware, and actively exploited RoundCube Webmail flaws.
- UNC3886 breaches Singapore's top telcos, Warlock exploits SmarterMail to hit SmarterTools, and a Firebase flaw exposes 300M Chat & Ask AI messages.
- Notepad++ supply chain attack, ShinyHunters' Panera Bread leak of 5.1M records, and actively exploited SolarWinds Web Help Desk RCE added to CISA KEV.
- Hackers selling Target source code, the n8n "Ni8mare" flaw hitting about 60,000 instances, and a Gogs zero-day under a CISA patch order.
- IDHS exposing ~700,000 residents' health data, a VMware ESXi zero-day exploited via SonicWall VPN, and Trend Micro Apex Central RCE patches.
- LKQ Oracle EBS breach, Cisco AsyncOS zero-day CVE-2025-20393 exploited by China-linked APT, and Kimwolf botnet hijacking 1.8M Android devices for DDoS.
- PowerSchool sued by Texas over 62M-student breach; Sitecore zero-day exploited with WeepSteel malware; APT28 deploys NotDoor Outlook backdoor.
- Jaguar Land Rover cyberattack disrupts operations, Workiva breach via Salesforce CRM, and Salesloft/Drift fallout hits Cloudflare, Palo Alto Networks and …
- NCSC attributes Microsoft 365 Authentic Antics malware to APT28, CrushFTP zero-day hijacks servers, and Google sues BADBOX 2.0 botnet operators.
- Nucor's data-theft breach, a trojanized SonicWall NetExtender VPN client, Microsoft Exchange login-page injections, and APT28 Signal-based malware campaigns in …
- The McLaren Health Care breach (743,000 patients), Citrix NetScaler patches, and Salt Typhoon's breach of Canadian telecoms via a Cisco flaw.
- Marks & Spencer cyberattack disrupting operations, Coinbase breach hitting 69,461 customers, and the Lumma infostealer takedown.
- Coinbase breach via bribed support agents, Nucor halted by a cyber incident, and APT28 exploiting webmail zero-days in the RoundPress campaign.
- The Coinbase insider data breach and extortion attempt, SAP NetWeaver exploitation by BianLian and RansomExx, and Samsung MagicINFO Mirai attacks.
- SK Telecom's USIM breach and SIM replacements, APT28's attribution by France, and the AirBorne AirPlay zero-click RCE flaws.