{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-23T01:02:50.524Z",
  "tag": {
    "id": "nation-state",
    "label": "Nation-state",
    "isStack": false,
    "url": "https://pwn.watch/t/nation-state",
    "feed": "https://pwn.watch/t/nation-state/feed.xml"
  },
  "counts": {
    "incidents": 5,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 5
  },
  "incidents": [
    {
      "slug": "sonicwall-mysonicwall-cloud-backup-breach-2025",
      "title": "SonicWall: state actor stole firewall config backups of every cloud-backup customer",
      "url": "https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025",
      "json": "https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "SonicWall MySonicWall cloud backup",
      "tags": [
        "sonicwall",
        "nation-state",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [
        "n/a"
      ],
      "fixedVersions": [],
      "startedAt": "2025-09-17",
      "closedAt": "2025-11-05",
      "updatedAt": "2025-11-05",
      "summary": "SonicWall and Mandiant confirmed that a state-sponsored actor used an API call to pull firewall configuration backup files for all customers using MySonicWall cloud backup, after first saying fewer than 5% were affected. The files include credentials and network details, so customers had to reset firewall, VPN, directory and API secrets.",
      "xPost": null
    },
    {
      "slug": "f5-nation-state-breach-big-ip-source-code-2025",
      "title": "F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen",
      "url": "https://pwn.watch/i/f5-nation-state-breach-big-ip-source-code-2025",
      "json": "https://pwn.watch/i/f5-nation-state-breach-big-ip-source-code-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "F5 BIG-IP (vendor breach)",
      "tags": [
        "f5",
        "nation-state",
        "china",
        "brickstorm",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [
        "BIG-IP, F5OS, BIG-IP Next and others (see F5 K000154696 and Oct 2025 Quarterly Security Notification)"
      ],
      "fixedVersions": [
        "F5 October 2025 Quarterly Security Notification releases"
      ],
      "startedAt": "2025-08-09",
      "closedAt": "2025-10-15",
      "updatedAt": "2025-10-15",
      "summary": "F5 disclosed that a sophisticated nation-state actor had long-term access to its BIG-IP development and engineering systems and stole parts of the BIG-IP source code, information on undisclosed vulnerabilities and some customer configuration data. CISA issued Emergency Directive 26-01 ordering agencies to inventory and patch F5 gear. Researchers linked it to China-nexus UNC5221 and BRICKSTORM.",
      "xPost": null
    },
    {
      "slug": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "title": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "json": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS)",
      "tags": [
        "beyondtrust",
        "remote-support",
        "espionage",
        "data-breach",
        "cisa-kev",
        "rce",
        "nation-state"
      ],
      "cveIds": [
        "CVE-2024-12356"
      ],
      "affectedVersions": [
        "Remote Support and Privileged Remote Access 24.3.1 and earlier (BeyondTrust)"
      ],
      "fixedVersions": [
        "Patches BT24-10-ONPREM1 / BT24-10-ONPREM2 (BeyondTrust); cloud instances patched 2024-12-16"
      ],
      "startedAt": "2024-12-05",
      "closedAt": "2024-12-19",
      "updatedAt": "2024-12-30",
      "summary": "Attackers stole a BeyondTrust infrastructure API key for its Remote Support SaaS service and used it to reset local passwords and access 17 customer instances. The US Treasury, one of the customers, said a China state-sponsored actor accessed some Departmental Offices workstations and unclassified documents. During the investigation BeyondTrust found a critical command injection in Remote Support and Privileged Remote Access (CVE-2024-12356, CVSS 9.8) and patched it on 2024-12-16. Added to the CISA KEV catalog on 2024-12-19.",
      "xPost": null
    },
    {
      "slug": "salt-typhoon-us-telecom-breaches",
      "title": "Salt Typhoon: Chinese state hackers inside US telecom networks",
      "url": "https://pwn.watch/i/salt-typhoon-us-telecom-breaches",
      "json": "https://pwn.watch/i/salt-typhoon-us-telecom-breaches.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "no-fix-needed",
      "product": "US telecommunications carriers",
      "tags": [
        "salt-typhoon",
        "telecom",
        "espionage",
        "china",
        "nation-state"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2024-11-13",
      "closedAt": "2024-12-04",
      "updatedAt": "2024-12-04",
      "summary": "PRC-affiliated actors (publicly called Salt Typhoon) compromised networks at multiple US telecommunications companies. The FBI and CISA said they stole customer call records, got into the private communications of a limited number of people mainly involved in government or political activity, and copied information subject to US law enforcement wiretap requests. Allied agencies then published hardening guidance for communications infrastructure.",
      "xPost": null
    },
    {
      "slug": "microsoft-midnight-blizzard-corporate-email-breach",
      "title": "Midnight Blizzard breaches Microsoft corporate email",
      "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach",
      "json": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Microsoft corporate email (Microsoft 365)",
      "tags": [
        "microsoft",
        "microsoft-365",
        "midnight-blizzard",
        "espionage",
        "password-spraying",
        "data-breach",
        "nation-state"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2024-01-12",
      "closedAt": "2024-04-02",
      "updatedAt": "2024-04-02",
      "summary": "Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "sonicwall-mysonicwall-cloud-backup-breach-2025",
      "incidentTitle": "SonicWall: state actor stole firewall config backups of every cloud-backup customer",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-11",
      "title": "SonicWall says the investigation is complete and attributes it to a state-sponsored actor",
      "body": null,
      "sourceUrl": "https://www.sonicwall.com/blog/cloud-backup-security-incident-investigation-complete-and-strengthened-cyber-resilience",
      "url": "https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025"
    },
    {
      "incident": "f5-nation-state-breach-big-ip-source-code-2025",
      "incidentTitle": "F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-15",
      "title": "F5 discloses the breach (SEC 8-K) and ships patches",
      "body": null,
      "sourceUrl": "https://my.f5.com/manage/s/article/K000154696",
      "url": "https://pwn.watch/i/f5-nation-state-breach-big-ip-source-code-2025"
    },
    {
      "incident": "f5-nation-state-breach-big-ip-source-code-2025",
      "incidentTitle": "F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-15",
      "title": "CISA issues Emergency Directive 26-01 for F5 devices",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/directives/ed-26-01-mitigate-vulnerabilities-f5-devices",
      "url": "https://pwn.watch/i/f5-nation-state-breach-big-ip-source-code-2025"
    },
    {
      "incident": "sonicwall-mysonicwall-cloud-backup-breach-2025",
      "incidentTitle": "SonicWall: state actor stole firewall config backups of every cloud-backup customer",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-10-08",
      "title": "SonicWall and Mandiant confirm all cloud-backup customers' files were accessed",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/sonicwall-firewall-configs-stolen-for-all-cloud-backup-customers/",
      "url": "https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025"
    },
    {
      "incident": "sonicwall-mysonicwall-cloud-backup-breach-2025",
      "incidentTitle": "SonicWall: state actor stole firewall config backups of every cloud-backup customer",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-09-17",
      "title": "SonicWall discloses unauthorized access to cloud backup files (initially <5% of customers)",
      "body": null,
      "sourceUrl": "https://www.sonicwall.com/support/notices/mysonicwall-cloud-backup-file-incident/kA1VN0000000RoD0AU",
      "url": "https://pwn.watch/i/sonicwall-mysonicwall-cloud-backup-breach-2025"
    },
    {
      "incident": "f5-nation-state-breach-big-ip-source-code-2025",
      "incidentTitle": "F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-09",
      "title": "F5 learns of the intrusion",
      "body": null,
      "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1048695/000104869525000149/ffiv-20251015.htm",
      "url": "https://pwn.watch/i/f5-nation-state-breach-big-ip-source-code-2025"
    },
    {
      "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-30",
      "title": "Treasury tells Congress of a 'major incident' attributed to a China state-sponsored APT",
      "body": null,
      "sourceUrl": "https://s3.documentcloud.org/documents/25472698/letter-from-treasury-re-december-2024-cyberattack.pdf",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356"
    },
    {
      "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-19",
      "title": "CISA added CVE-2024-12356 to the KEV catalog (federal deadline 2024-12-27)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356"
    },
    {
      "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-17",
      "title": "CVE-2024-12356 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-12356",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356"
    },
    {
      "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-16",
      "title": "BeyondTrust advisory BT24-10; cloud instances patched",
      "body": null,
      "sourceUrl": "https://www.beyondtrust.com/trust-center/security-advisories/bt24-10",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356"
    },
    {
      "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-08",
      "title": "BeyondTrust notifies the US Treasury",
      "body": null,
      "sourceUrl": "https://s3.documentcloud.org/documents/25472698/letter-from-treasury-re-december-2024-cyberattack.pdf",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356"
    },
    {
      "incident": "beyondtrust-remote-support-us-treasury-breach-cve-2024-12356",
      "incidentTitle": "BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-05",
      "title": "BeyondTrust identifies a compromised Remote Support SaaS infrastructure API key",
      "body": null,
      "sourceUrl": "https://www.beyondtrust.com/remote-support-saas-service-security-investigation",
      "url": "https://pwn.watch/i/beyondtrust-remote-support-us-treasury-breach-cve-2024-12356"
    },
    {
      "incident": "salt-typhoon-us-telecom-breaches",
      "incidentTitle": "Salt Typhoon: Chinese state hackers inside US telecom networks",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-12-04",
      "title": "CISA, NSA, FBI and Five Eyes partners release hardening guidance for communications infrastructure",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/resources-tools/resources/enhanced-visibility-and-hardening-guidance-communications-infrastructure",
      "url": "https://pwn.watch/i/salt-typhoon-us-telecom-breaches"
    },
    {
      "incident": "salt-typhoon-us-telecom-breaches",
      "incidentTitle": "Salt Typhoon: Chinese state hackers inside US telecom networks",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-11-13",
      "title": "FBI and CISA joint statement on PRC targeting of commercial telecommunications",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/news/joint-statement-fbi-and-cisa-peoples-republic-china-prc-targeting-commercial-telecommunications",
      "url": "https://pwn.watch/i/salt-typhoon-us-telecom-breaches"
    },
    {
      "incident": "microsoft-midnight-blizzard-corporate-email-breach",
      "incidentTitle": "Midnight Blizzard breaches Microsoft corporate email",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-04-02",
      "title": "CISA issues Emergency Directive 24-02 for agencies whose email with Microsoft was exposed",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/directives/ed-24-02-mitigating-significant-risk-nation-state-compromise-microsoft-corporate-email-system",
      "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach"
    },
    {
      "incident": "microsoft-midnight-blizzard-corporate-email-breach",
      "incidentTitle": "Midnight Blizzard breaches Microsoft corporate email",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-01-25",
      "title": "Microsoft publishes guidance for responders on the Midnight Blizzard attack",
      "body": null,
      "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/",
      "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach"
    },
    {
      "incident": "microsoft-midnight-blizzard-corporate-email-breach",
      "incidentTitle": "Midnight Blizzard breaches Microsoft corporate email",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-01-12",
      "title": "Microsoft detects a nation-state attack on its corporate systems",
      "body": null,
      "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/",
      "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach"
    }
  ]
}