Nation-state

Security incidents tagged Nation-state. Newest first.

0 Nation-state incidents in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore

Show 5 older incidents

Sep 17HighSonicWall: state actor stole firewall config backups of every cloud-backup customerNo fix needed
SonicWall MySonicWall cloud backup No fix needed
SonicWall and Mandiant confirmed that a state-sponsored actor used an API call to pull firewall configuration backup files for all customers using MySonicWall cloud backup, after first saying fewer than 5% were affected. The files include credentials and network details, so customers had to reset firewall, VPN, directory and API secrets.
Open incident →

CriticalPatched
F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen
F5 disclosed that a sophisticated nation-state actor had long-term access to its BIG-IP development and engineering systems and stole parts of the BIG-IP source code, information on undisclosed vulnerabilities and some customer configuration data. CISA issued Emergency Directive 26-01 ordering agencies to inventory and patch F5 gear. Researchers linked it to China-nexus UNC5221 and BRICKSTORM.
F5 BIG-IP (vendor breach)Closed Oct 15, 2025updated Oct 15, 2025

Dec 5CriticalBeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)Patched
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Patched
Attackers stole a BeyondTrust infrastructure API key for its Remote Support SaaS service and used it to reset local passwords and access 17 customer instances. The US Treasury, one of the customers, said a China state-sponsored actor accessed some Departmental Offices workstations and unclassified documents. During the investigation BeyondTrust found a critical command injection in Remote Support and Privileged Remote Access (CVE-2024-12356, CVSS 9.8) and patched it on 2024-12-16. Added to the CISA KEV catalog on 2024-12-19.
Open incident →CVE-2024-12356

Nov 13CriticalSalt Typhoon: Chinese state hackers inside US telecom networksNo fix needed
US telecommunications carriers No fix needed
PRC-affiliated actors (publicly called Salt Typhoon) compromised networks at multiple US telecommunications companies. The FBI and CISA said they stole customer call records, got into the private communications of a limited number of people mainly involved in government or political activity, and copied information subject to US law enforcement wiretap requests. Allied agencies then published hardening guidance for communications infrastructure.
Open incident →

Jan 12HighMidnight Blizzard breaches Microsoft corporate emailNo fix needed
Microsoft corporate email (Microsoft 365) No fix needed
Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.
Open incident →