Netcrook
Cyber Warfare & Nation-State Operations / Asia
Overlapping Spy Campaigns Put a Pakistani Police Force Under a Sharper Light
Separate espionage activity tied to China and India reportedly converged on the same police environment, a pattern that points to exposure points worth examining rather than a single clean breach narrative.
Two Attribution Buckets, One Police Force: A Quiet Cyber Campaign in Balochistan
A provincial police force in Pakistan was described as a target for both China-linked and India-linked hackers over at least two years, but the technical path and impact remain unconfirmed.
When a Router Becomes a Relay: The Quiet Expansion of UAT-7810's Malware Mesh
A China-linked cluster tracked by Cisco Talos is being tied to a newer implant, LONGLEASH, as part of a broader effort to grow an ORB network from internet-facing networking devices.
Fake Tax Utility Turns Routine Compliance Into a Hidden RAT Trap
A researcher-tracked phishing campaign used government-themed lures and a counterfeit filing tool to push DcRAT onto Windows systems, showing how trust in official workflows can be turned into an attack path.
When Trusted Repositories Become Delivery Chains for Malware
PolinRider shows how a software supply-chain operation can turn legitimate open source assets into a route for backdoors and credential theft, putting developer workstations at the center of the blast radius.
When a Dependency Update Becomes the Doorway: PolinRider and the Open-Source Trust Trap
A supply-chain campaign tied to PolinRider shows how package ecosystems can turn routine development work into a high-risk execution path.
Mustang Panda’s India Push Shows How Loader Malware Hides Behind Ordinary Workflows
A June espionage wave tied to Mustang Panda used archive-based delivery, DLL sideloading, and cloud-service abuse to blur the line between office traffic and operator traffic.
When a USB Drive Becomes a Spy: The Defense Risk Hidden in Plain Sight
A reported case involving counterfeit USB drives in Japan's defense ecosystem shows how unvetted removable media can still slip into highly sensitive environments.
The USB Trap Inside a Defense Network
A reported case involving counterfeit, malware-infected USB drives shows how a single removable device can become a trust-boundary problem in sensitive military environments.
macOS Malware Finds a Quiet Door in LaunchAgents and a Loud One in AI Triage
A Rust-based implant tied to a DPRK-linked macOS cluster pairs ordinary startup persistence with a Python stealer stage and prompt-injection text aimed at analysts.
The Telecom Spy Machine: Why Salt Typhoon Still Matters
A 2025 attribution wave pointed to China-based private firms, but the unresolved question is how commercial cyber capacity fits into state espionage without a clean public chain of proof.
Security-Alert Phishing Gives ScarCruft a Trusted Mask
A North Korea-linked group is using fake Microsoft account warnings as a lure, showing how defenders must treat “urgent” security mail as a hostile delivery channel.
Inside the Login Path: How Tampering With PAM and SSH Turns Trust Into a Trap
A reported long-running intrusion tied to Velvet Ant shows why defenders now have to verify authentication integrity, not just patch software and hope the login stack is still honest.
Inside the Login Path: A Quiet Intrusion That Turned SSH Into a Trapdoor
A long-running campaign tied to Velvet Ant highlights a brutal lesson for defenders: once attackers tamper with authentication software, the trust model itself starts to collapse.
The Algorithmic Border: When Surveillance Starts Guessing Who Might Resist
The Geedge-related censorship debate matters less as prophecy than as infrastructure: DPI, blocklists, VPN telemetry, and AI-style profiling can turn ordinary network traffic into political risk signals.
The Shortcut Trap: How a Cloud-Hid Backdoor Turns a Microsoft Lure into Quiet Access
A reported APT37 intrusion chain shows how a familiar brand, a Windows shortcut, and a legitimate cloud service can be stitched into a low-noise control path.
Sheets, Shortcuts, and a Diplomatic Bait: Why This RAT Chain Matters
A themed ISO, a disguised Windows shortcut, and a Google Sheets command channel show how ordinary tools can be stitched into an espionage workflow.
When a Trading Plugin Becomes the Entry Point
A reported FireAnt MetaKit supply-chain incident shows how a trusted market-data tool can become a risk surface for selective espionage.
When Market Data Becomes Malware: The FireAnt MetaKit Trust-Chain Risk
A reported OceanLotus operation inside a Vietnamese investor tool shows how one compromised updater can turn routine market access into a wider software-trust problem.
OceanLotus and the New Trust Trap: When Investor Software Turns into a Spyware Route
A long-running intrusion and a separate supply-chain path point to the same lesson: in espionage campaigns, the weakest link is often the software people already trust.