Espionage

Security incidents tagged Espionage. Newest first.

0 Espionage incidents in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore

Show 4 older incidents

Dec 5CriticalBeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)Patched
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Patched
Attackers stole a BeyondTrust infrastructure API key for its Remote Support SaaS service and used it to reset local passwords and access 17 customer instances. The US Treasury, one of the customers, said a China state-sponsored actor accessed some Departmental Offices workstations and unclassified documents. During the investigation BeyondTrust found a critical command injection in Remote Support and Privileged Remote Access (CVE-2024-12356, CVSS 9.8) and patched it on 2024-12-16. Added to the CISA KEV catalog on 2024-12-19.
Open incident →CVE-2024-12356

Nov 13CriticalSalt Typhoon: Chinese state hackers inside US telecom networksNo fix needed
US telecommunications carriers No fix needed
PRC-affiliated actors (publicly called Salt Typhoon) compromised networks at multiple US telecommunications companies. The FBI and CISA said they stole customer call records, got into the private communications of a limited number of people mainly involved in government or political activity, and copied information subject to US law enforcement wiretap requests. Allied agencies then published hardening guidance for communications infrastructure.
Open incident →

Apr 24HighCisco ASA/FTD zero-days used in the ArcaneDoor espionage campaignPatched
Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Patched
Cisco Talos disclosed ArcaneDoor, a state-sponsored campaign against perimeter devices that exploited two Cisco Adaptive Security Appliance and Firepower Threat Defense zero-days: a denial of service (CVE-2024-20353) and a persistent local code execution bug (CVE-2024-20359), used to plant the Line Dancer and Line Runner implants. Added to the CISA KEV catalog on 2024-04-24.
Open incident →CVE-2024-20353 · CVE-2024-20359

Jan 12HighMidnight Blizzard breaches Microsoft corporate emailNo fix needed
Microsoft corporate email (Microsoft 365) No fix needed
Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.
Open incident →