# Espionage security incidents · pwn.watch

> Security incidents tagged Espionage (vendor, product, platform or attack type).

Page: https://pwn.watch/t/espionage · generated 2026-10-22T19:58:23.236Z

## Status (as of 2026-10-22)
- Incidents: 4 (0 live, 0 live and not fully patched, 4 patched)
- Days without a Espionage security incident: 675
- Newest incident started: 2024-12-05

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/espionage.json
- RSS (one item per incident, bumped on each update): https://pwn.watch/t/espionage/feed.xml
- This file: https://pwn.watch/t/espionage/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)](https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356) ([json](https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356.json)): critical, closed, patched, started 2024-12-05, CVE-2024-12356
- [Salt Typhoon: Chinese state hackers inside US telecom networks](https://pwn.watch/i/salt-typhoon-us-telecom-breaches) ([json](https://pwn.watch/i/salt-typhoon-us-telecom-breaches.json)): critical, closed, no-fix-needed, started 2024-11-13
- [Cisco ASA/FTD zero-days used in the ArcaneDoor espionage campaign](https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359) ([json](https://pwn.watch/i/cisco-asa-ftd-arcanedoor-cve-2024-20353-20359.json)): high, closed, patched, started 2024-04-24, CVE-2024-20353, CVE-2024-20359
- [Midnight Blizzard breaches Microsoft corporate email](https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach) ([json](https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach.json)): high, closed, no-fix-needed, started 2024-01-12