Advanced persistent threat

Side Copy, which is also tracked as Tag 140, they're a group with heavy tactical overlaps with Transparent Tribe.

So they are a Pakistan-based APT active since about 2019, right? Now, historically, they've gone after Indian defense forces or government networks like the Afghan Ministry of Finance.

But Trellix recently documented a massive shift.

They are now heavily spear phishing academic institutions in India.

And at the network layer, you need to hunt for anomalous traffic on non-standard ports like 5863.

It's just an intense game of cat and mouse.

We've talked about malware hiding inside application architecture and APTs living visibly in system memory, which really brings us to the irony of our third section.

Because while you are out there hunting for highly complex, reflectively loaded .NET objects.

That style of using a delimiter and de-obfuscating stuff within a Google Drive is known to Kim Suki, which is the name of the adversary or threat actor.

It's a North Korea APT, Advanced Persistent Threat.

And we thought, whoa, okay, stakes are a little bit

high.

targeted information espionage from an advanced persistent threat on a place of certain caliber, position, and

power.

But, the question that everyone wants to ask, right, when we get to tell the story to, I don't know, journalists or headlines, what everyone tends to ask is, how do they get in? How do the hackers break into the environment? So, finding and discovering that this was Kimsuki, that APT, their tradecraft and their style is to use a phishing email, fair to say.

So,

Source, Security Week.

Night Eagle APT, Advanced Persistent Threat, targets Russian companies Kaspersky, GERT-investigated Night Eagle, AppQ95.

Incidents targeting Russian businesses using compromised VPN credentials for initial access.

Tackers deployed Ghost Container Backdoor on Microsoft Exchange servers, incorporating neorejorgtunnel, CVE-2020-0688 exploit, and Ghost web shell components.

Th-there's a lot of disconnects, at least in my experience, in the entire AI spectrum here from how much it's being used in vulnerability research in, in the real world as opposed to sort of the testing from an elite cadre of people who are very good at this anyway and are now just using frontier models to do the tippy top of that kind of work that took them forever and a day before, and now they're just like, "Okay, let me use this highly trained model to do that stuff that I could do but would take me longer." But like, uh, I mean, I guess we don't totally know the answer to this, but are there...

You know, I don't know that we've seen a bunch of cybercrime groups doing this or, y-you know, APT teams doing this kind of stuff.

Maybe they are in limited capacities, but I'm not seeing like broad evidence of that.

If, uh, if we iso- you know, the, the adversary is us- using some amount of AI in their overall campaigns, but if we isolate ourselves to using AI to find and exploit a vulnerability in the wild for some kind of material harm, we haven't seen one yet.

They, they never have.

Yeah, they, they have their own stuff and, you know, they, they sell it and trade it back and forth and that, that kind of stuff.

I, I do assume that they have these discussion amongst themselves like, like we said earlier, and they're-- they, you know, they bend towards efficiency and what's gonna make me the most money or achieve my goal in the most efficient manner, right? Like depending on what they're-- if they're a cybercrime group or an APT group.

Like if you're an APT, I've got these orders from my boss, gotta go, go do this thing in the most efficient way possible.

Cyber Threat Brief for September 13, 2026 CISA, the Cybersecurity and Infrastructure Security Agency, added five actively exploited flaws to the KEV, Known Exploited Vulnerabilities Catalog, catalog with patch deadlines through September 25, including artifactory bugs chained for admin takeover and a Screen Connect flaw enabling unauthorized file execution.

Chinese APT, Advanced Persistent Threat, groups deployed a new exploit kit called Blue Moon that chains three zero days in Chrome and Windows, spreading across multiple espionage operations within days.

Google leaked identifying information for sex crime victims globally through its content removal request system.

Here's the full breakdown of today's top security stories.

1.

CISA, the Cybersecurity and Infrastructure Security Agency, Kev Known Exploited Vulnerabilities Catalog, Additions 5 Actively Exploited Vulnerabilities, Artifactory, Screen Connect, Router OS, High Priority 2, BlueMoon Exploit Kit Chrome Slash Windows Zero Day Chain Used by Chinese APT, Advanced Persistent Threat, Groups High Priority 3.

XFCE desktop customization not security relevant should be excluded 4.

NVIDIA slash GROK DOJ investigation not threat intelligence should be excluded 5.

The campaign took place in late March, a week after Google and other security vendors publicly exposed the existence of the DarkSword kit.

At least four different APT groups are using a new exploit kit to hack into Windows computers.

The BlueMoon kit uses Chrome and Windows zero-days to deploy malware on a user's computer if they click a malicious link inside a Chromium-based browser.

The kit was spotted in late August.

Proofpoint CyberScoop CISA.

Cisco Secure Firewall Management Center Under Active Attack CVE-2026-20079 CVE-2026-20316 Cisco Talos Confirmed Active Exploitation of Critical Authentication Bypass CVE-2026-20079 CVSS The Common Vulnerability Scoring System 10.0 Low Privilege Login Vulnerabilities in Cisco Secure FMC Software Three Distinct Threat Actor Clusters Identified UAT 12197 deployed web shells and credential exfiltration tools, UAT 11823, linked to Russian APT, advanced persistent threat, sandworm, deployed Cyclops blink malware, and UAT 11988, assessed as Killen ransomware affiliate.

Conducted extensive reconnaissance and built endpoint encryption target lists, added to CIS a KEV with August 1 remediation deadline, already passed.

Hotfixes released.

CIS-KEV deadlines September 18 and 22, and two additional CVEs.

See show notes for the full list.

Cisco Secure FMC, critical authentication bypass, CVE-2026-20079, CVSS 10.0, exploited by APT and ransomware.

Apply hotfixes immediately.

Cyber Safety Review Board, Review of the December 2021 Log4j Event, July 11th, 2022.

CISA, Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations.

SolarWinds SUNBURST Advisory.

SolarWinds, An Investigative Update of the Cyberattack.