Netcrook
#APT28
When Malware Hides in Images, Documents, and Memory, the Disk Sees Nothing
A reported intrusion chain tied to APT28 combines Office lures, COM hijacking, PNG steganography, and reflective loading to keep payloads out of sight and traffic inside trusted services.
Windows Explorer Hijack Puts a Hidden PNG in the Driver’s Seat
A reported intrusion chain combines COM hijacking, image-based concealment, and AES encryption, showing how ordinary Windows features can be bent into a stealth delivery path.
Router Shadows and Botnet Relay: The New Infrastructure Behind APT28
A reported shift toward hijacked routers and criminal botnet infrastructure shows how covert operators are moving away from easily traced hosting.
Inbox as Tripwire: The Outlook Path That Can Turn Hidden Mail Into Credential Leakage
A reported Outlook zero-click flaw tied to APT28 underscores a hard truth: mail rendering and legacy NTLM authentication can intersect in ways that expose credential material without a deliberate click.
When Military Doctrine Meets the Keyboard: Reading the GRU Through Its Cyber Playbook
The GRU debate is not just about attribution; it is about how state power, identity abuse, and edge-device targeting fit into a long-running cyber strategy.
Zero-Click Danger: How a Windows Shell Flaw Opened Doors for Elite Hackers
A newly revealed vulnerability in Windows Shell has been exploited by Russian state hackers, leaving users at risk of silent credential theft.
Patchwork Peril: How a Botched Windows Fix Opened the Gates to Stealth Attacks
An incomplete Windows security update allowed Russian hackers to launch zero-click attacks against high-profile European targets.
Bear in the Inbox: Russian APT28 Strikes at Ukraine’s Justice System
Ukrainian prosecutors and anti-corruption agencies face a sophisticated email breach linked to Russian military intelligence hackers.
Invisible Intruders: How Russia’s APT28 Hacked Microsoft Accounts Without Malware
APT28’s FrostArmada campaign hijacked global networks, stealing credentials in plain sight-no malware required.
Stealth in the Shadows: Russia’s APT28 Unleashes PRISMEX Malware on Ukraine and NATO Supply Chains
A new wave of Russian cyber-espionage leverages advanced malware and zero-day exploits to target Ukraine and its allies, threatening both information security and critical infrastructure.
Routers Under Siege: How U.S. Agents Crushed Russia’s Global DNS Espionage Web
U.S. authorities, tech giants, and cyber researchers unite to dismantle a sprawling Russian spy network hijacking home routers worldwide.
GhostMail: Russian Military Hackers Breach Ukrainian Government via Zimbra Email Trap
APT28 exploits critical Zimbra vulnerability in a sophisticated phishing campaign targeting Ukraine’s state infrastructure.
Shadow Play: Russian Hackers Unleash New Espionage Arsenal on Ukraine’s Military
Russian state-backed APT28 deploys an evolving suite of malware, including BEARDSHELL and COVENANT, to conduct covert surveillance operations against Ukrainian military targets.
Bears in the Cloud: How APT28 Weaponized Open-Source Tools for Espionage
Russian state hackers are customizing open-source frameworks and cloud services to supercharge their cyber-espionage campaigns against Ukraine and Europe.
Russian Hackers Slip Through Microsoft’s Defenses: The MSHTML Zero-Day Microsoft Didn’t See Coming
Before Microsoft could patch it, APT28 weaponized a critical Windows flaw to launch stealthy attacks worldwide.
Shadow Over MSHTML: How APT28 Exploited a Zero-Day Before Microsoft’s Patch
Russian-linked cyber espionage group APT28 weaponized a critical MSHTML vulnerability weeks before Microsoft’s official fix, raising alarms about evolving attack tactics.
Inside Operation MacroMaze: How APT28’s Low-Tech Lures Breached European Targets
Russia-linked hackers exploited simple macros and public webhooks to infiltrate European organizations in a stealthy campaign.
Phishing in Troubled Waters: Russian Hackers Hijack European Maritime and Transport Sectors via Microsoft Office Flaw
APT28 unleashes a rapid-fire espionage campaign across Europe, exploiting a fresh Microsoft Office vulnerability to compromise critical maritime and transportation organizations.