Research from Cisco Talos and Google Threat Intelligence Group underscores the extent to which North Korea-aligned attackers attempt to avoid detection.

Cisco said it was investigating state-sponsored espionage attacks in May. CISA did not explain why it waited four months to issue an emergency directive.

The group, linked to FSB Center 16, has been scanning the internet for end-of-life software, which it has found in droves.

SentinelOne and Beazley Security say the group has been evolving its techniques of late, all with the goal of making money off stolen data.

The Russian cybercrime group attacked more than 180 organizations before members abandoned the brand and dispersed to new ransomware groups earlier this year.

Cisco Talos observed identity-based attacks in 60% of the incidents it responded to last year.

The Chinese nation-state threat group primarily gained access to Cisco devices with legitimate login credentials, according to Cisco Talos.

The activity highlights a rapidly evolving, aggressive cyberespionage operation that played out across Africa, Europe, the Middle East and Asia, a Talos report says.

A virus dating to 2015 is still hitting targets in Ukraine, showing its enduring power.  

Researchers discovered a new ransomware gang that appears to be in the early stages of their extortion campaigns.