TelcoNews Australia - Telecommunications news for ICT decision-makers
Australia

Advanced Persistent Threat (APT) Stories

Australian Stories

Advanced Persistent Threat (APT) stories

Global Stories

Advanced Persistent Threat (APT) stories

China-aligned TA416 resumes spying on EU & Mideast
Phishing

China-aligned TA416 resumes spying on EU & Mideast

Diplomatic missions in Europe and the Middle East face renewed PlugX-backed espionage as TA416 shifts tactics and targets amid regional tensions.

By Sean Mitchell • 4 min read • Last month
DeepLoad malware steals credentials via ClickFix campaign
Malware

DeepLoad malware steals credentials via ClickFix campaign

Businesses face credential theft and reinfection risks as DeepLoad hides inside trusted Windows processes and evades routine clean-up.

By Joseph Gabriel Lagonsin • 4 min read • Last month
Commvault adds threat-hunting tools to backup scans
Data Protection

Commvault adds threat-hunting tools to backup scans

Existing Threat Scan customers get new free tools to spot ransomware in backups before restoration, reducing the risk of reinfecting production systems.

By Mark Tarre • 3 min read • Tue, 31st Mar 2026
China-linked Red Menshen hides inside telecoms networks
Unified Communications

China-linked Red Menshen hides inside telecoms networks

Dormant implants in carrier systems could expose subscriber data and signals across Europe and APAC, Rapid7 warned.

By Joseph Gabriel Lagonsin • 4 min read • Fri, 27th Mar 2026
NCC Group warns Iran cyber threats spread worldwide
Gaming

NCC Group warns Iran cyber threats spread worldwide

Iran-linked cyber attacks are spreading beyond the Middle East, with firms tied to Israel or the US warned they face heightened global risk.

By Joseph Gabriel Lagonsin • 4 min read • Tue, 24th Mar 2026
Iranian cyber shift raises risk to Western infrastructure
Distributed Denial of Service

Iranian cyber shift raises risk to Western infrastructure

Iranian state-aligned hackers are shifting from spying to destructive cyber strikes, putting Western critical infrastructure on high alert.

By Shannon Williams • 6 min read • Fri, 13th Mar 2026
Fake Red Alert app used in Android spyware smishing
Endpoint Protection

Fake Red Alert app used in Android spyware smishing

Attackers push fake Red Alert Android app via SMS, turning Israel rocket warning tool into spyware that steals messages, contacts and location.

By Sean Mitchell • 4 min read • Fri, 13th Mar 2026
Conflict sparks surge in Middle East cyber espionage
Phishing

Conflict sparks surge in Middle East cyber espionage

New research links Iran conflict to a swift surge in tightly targeted cyber espionage across Middle Eastern governments and embassies.

By Mark Tarre • 4 min read • Thu, 12th Mar 2026
Google report warns identity is weak link in cloud
Malware

Google report warns identity is weak link in cloud

Attackers are ditching malware for stolen identities, misconfigurations and abused AI tools, Google warns in its latest cloud threat report.

By Sean Mitchell • 4 min read • Wed, 11th Mar 2026
Kernel in the crosshairs: The BlackSanta threat campaign targeting recruitment workflows
Storage

Kernel in the crosshairs: The BlackSanta threat campaign targeting recruitment workflows

A stealthy BlackSanta malware spree is hijacking HR recruitment workflows, killing endpoint defence tools and exfiltrating sensitive data.

By Aditya K. Sood • 4 min read • Wed, 11th Mar 2026
Google disrupts China-linked cyber espionage on telecoms
Malware

Google disrupts China-linked cyber espionage on telecoms

Google says it has crippled a China-linked cyber espionage group accused of hacking telecoms and governments in at least 42 countries.

By Sean Mitchell • 3 min read • Thu, 26th Feb 2026
LockBit 5.0 ransomware targets Windows, Linux, ESXi
Malware

LockBit 5.0 ransomware targets Windows, Linux, ESXi

New LockBit 5.0 ransomware hits Windows, Linux and ESXi in single campaigns, widening blast radius across mixed and virtualised environments.

By Catherine Knowles • 3 min read • Wed, 18th Feb 2026
Okta warns of North Korean fraud in remote tech hiring
Data Protection

Okta warns of North Korean fraud in remote tech hiring

Okta warns North Korean operatives are landing remote tech jobs with stolen and synthetic identities to fund the regime and enable cyber attacks.

By Sofiah Nichole Salivio • 5 min read • Fri, 13th Feb 2026
Hackers ditch noisy ransomware for stealthy data theft
Firewalls

Hackers ditch noisy ransomware for stealthy data theft

Hackers are abandoning noisy ransomware to quietly steal data, as a report finds 80% of top attack techniques now focus on evasion.

By Shannon Williams • 4 min read • Thu, 12th Feb 2026
Espionage Without Noise: Understanding APT36's Enduring Campaigns
Distributed Denial of Service

Espionage Without Noise: Understanding APT36's Enduring Campaigns

Indian defence faces a decade-long silent siege as APT36 refines cross-platform cyber espionage with stealthy, persistent RAT campaigns.

By Dr Aditya Sood • 5 min read • Wed, 11th Feb 2026
CrowdStrike splits LABYRINTH CHOLLIMA into three units
Malware

CrowdStrike splits LABYRINTH CHOLLIMA into three units

CrowdStrike has split North Korea-linked LABYRINTH CHOLLIMA into three units, two for crypto theft and one for industrial espionage.

By Joseph Gabriel Lagonsin • 5 min read • Fri, 30th Jan 2026

Stories from Other Regions

Advanced Persistent Threat (APT) stories

NGINX config tampering enables stealth web traffic hijack
Firewalls

NGINX config tampering enables stealth web traffic hijack

Attackers are hijacking live web sessions by stealthily tampering with NGINX configs, silently relaying traffic via rogue servers.

By Mark Tarre • 4 min read • Thu, 5th Feb 2026