{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:58:23.236Z",
  "tag": {
    "id": "espionage",
    "label": "Espionage",
    "isStack": false,
    "url": "https://pwn.watch/t/espionage",
    "feed": "https://pwn.watch/t/espionage/feed.xml"
  },
  "counts": {
    "incidents": 4,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 4
  },
  "incidents": [
    {
      "slug": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "title": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "json": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS)",
      "tags": [
        "beyondtrust",
        "remote-support",
        "espionage",
        "data-breach",
        "cisa-kev",
        "rce",
        "nation-state"
      ],
      "cveIds": [
        "CVE-2024-12356"
      ],
      "affectedVersions": [
        "Remote Support and Privileged Remote Access 24.3.1 and earlier (BeyondTrust)"
      ],
      "fixedVersions": [
        "Patches BT24-10-ONPREM1 / BT24-10-ONPREM2 (BeyondTrust); cloud instances patched 2024-12-16"
      ],
      "startedAt": "2024-12-05",
      "closedAt": "2024-12-19",
      "updatedAt": "2024-12-30",
      "summary": "Attackers stole a BeyondTrust infrastructure API key for its Remote Support SaaS service and used it to reset local passwords and access 17 customer instances. The US Treasury, one of the customers, said a China state-sponsored actor accessed some Departmental Offices workstations and unclassified documents. During the investigation BeyondTrust found a critical command injection in Remote Support and Privileged Remote Access (CVE-2024-12356, CVSS 9.8) and patched it on 2024-12-16. Added to the CISA KEV catalog on 2024-12-19.",
      "xPost": null
    },
    {
      "slug": "salt-typhoon-us-telecom-breaches",
      "title": "Salt Typhoon: Chinese state hackers inside US telecom networks",
      "url": "https://pwn.watch/i/salt-typhoon-us-telecom-breaches",
      "json": "https://pwn.watch/i/salt-typhoon-us-telecom-breaches.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "no-fix-needed",
      "product": "US telecommunications carriers",
      "tags": [
        "salt-typhoon",
        "telecom",
        "espionage",
        "china",
        "nation-state"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2024-11-13",
      "closedAt": "2024-12-04",
      "updatedAt": "2024-12-04",
      "summary": "PRC-affiliated actors (publicly called Salt Typhoon) compromised networks at multiple US telecommunications companies. The FBI and CISA said they stole customer call records, got into the private communications of a limited number of people mainly involved in government or political activity, and copied information subject to US law enforcement wiretap requests. Allied agencies then published hardening guidance for communications infrastructure.",
      "xPost": null
    },
    {
      "slug": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "title": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "json": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)",
      "tags": [
        "cisco",
        "cisco-asa",
        "cisco-ftd",
        "zero-day",
        "espionage",
        "firewall",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-20353",
        "CVE-2024-20359"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-04-24",
      "closedAt": "2024-04-24",
      "updatedAt": "2024-04-24",
      "summary": "Cisco Talos disclosed ArcaneDoor, a state-sponsored campaign against perimeter devices that exploited two Cisco Adaptive Security Appliance and Firepower Threat Defense zero-days: a denial of service (CVE-2024-20353) and a persistent local code execution bug (CVE-2024-20359), used to plant the Line Dancer and Line Runner implants. Added to the CISA KEV catalog on 2024-04-24.",
      "xPost": null
    },
    {
      "slug": "microsoft-midnight-blizzard-corporate-email-breach",
      "title": "Midnight Blizzard breaches Microsoft corporate email",
      "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach",
      "json": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Microsoft corporate email (Microsoft 365)",
      "tags": [
        "microsoft",
        "microsoft-365",
        "midnight-blizzard",
        "espionage",
        "password-spraying",
        "data-breach",
        "nation-state"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2024-01-12",
      "closedAt": "2024-04-02",
      "updatedAt": "2024-04-02",
      "summary": "Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-30",
      "title": "Treasury tells Congress of a 'major incident' attributed to a China state-sponsored APT",
      "body": null,
      "sourceUrl": "https://s3.documentcloud.org/documents/25472698/letter-from-treasury-re-december-2024-cyberattack.pdf",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356"
    },
    {
      "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-19",
      "title": "CISA added CVE-2024-12356 to the KEV catalog (federal deadline 2024-12-27)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356"
    },
    {
      "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-17",
      "title": "CVE-2024-12356 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-12356",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356"
    },
    {
      "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-16",
      "title": "BeyondTrust advisory BT24-10; cloud instances patched",
      "body": null,
      "sourceUrl": "https://www.beyondtrust.com/trust-center/security-advisories/bt24-10",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356"
    },
    {
      "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-08",
      "title": "BeyondTrust notifies the US Treasury",
      "body": null,
      "sourceUrl": "https://s3.documentcloud.org/documents/25472698/letter-from-treasury-re-december-2024-cyberattack.pdf",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356"
    },
    {
      "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-05",
      "title": "BeyondTrust identifies a compromised Remote Support SaaS infrastructure API key",
      "body": null,
      "sourceUrl": "https://www.beyondtrust.com/remote-support-saas-service-security-investigation",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356"
    },
    {
      "incident": "salt-typhoon-us-telecom-breaches",
      "incidentTitle": "Salt Typhoon: Chinese state hackers inside US telecom networks",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-12-04",
      "title": "CISA, NSA, FBI and Five Eyes partners release hardening guidance for communications infrastructure",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/resources-tools/resources/enhanced-visibility-and-hardening-guidance-communications-infrastructure",
      "url": "https://pwn.watch/i/salt-typhoon-us-telecom-breaches"
    },
    {
      "incident": "salt-typhoon-us-telecom-breaches",
      "incidentTitle": "Salt Typhoon: Chinese state hackers inside US telecom networks",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-11-13",
      "title": "FBI and CISA joint statement on PRC targeting of commercial telecommunications",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/news/joint-statement-fbi-and-cisa-peoples-republic-china-prc-targeting-commercial-telecommunications",
      "url": "https://pwn.watch/i/salt-typhoon-us-telecom-breaches"
    },
    {
      "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-24",
      "title": "CVE-2024-20353 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-20353",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359"
    },
    {
      "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-24",
      "title": "CVE-2024-20359 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-20359",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359"
    },
    {
      "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-24",
      "title": "CISA added CVE-2024-20353 to the KEV catalog (federal deadline 2024-05-01)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359"
    },
    {
      "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-24",
      "title": "CISA added CVE-2024-20359 to the KEV catalog (federal deadline 2024-05-01)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359"
    },
    {
      "incident": "cisco-asa-ftd-arcanedoor-cve-2024-20353-20359",
      "incidentTitle": "Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-24",
      "title": "Cisco Talos discloses the ArcaneDoor campaign; Cisco ships fixes",
      "body": null,
      "sourceUrl": "https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/",
      "url": "https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359"
    },
    {
      "incident": "microsoft-midnight-blizzard-corporate-email-breach",
      "incidentTitle": "Midnight Blizzard breaches Microsoft corporate email",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-04-02",
      "title": "CISA issues Emergency Directive 24-02 for agencies whose email with Microsoft was exposed",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/directives/ed-24-02-mitigating-significant-risk-nation-state-compromise-microsoft-corporate-email-system",
      "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach"
    },
    {
      "incident": "microsoft-midnight-blizzard-corporate-email-breach",
      "incidentTitle": "Midnight Blizzard breaches Microsoft corporate email",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-01-25",
      "title": "Microsoft publishes guidance for responders on the Midnight Blizzard attack",
      "body": null,
      "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/",
      "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach"
    },
    {
      "incident": "microsoft-midnight-blizzard-corporate-email-breach",
      "incidentTitle": "Midnight Blizzard breaches Microsoft corporate email",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-01-12",
      "title": "Microsoft detects a nation-state attack on its corporate systems",
      "body": null,
      "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/",
      "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach"
    }
  ]
}