TechCrunch reports that a government hacking group called MoustachedBouncer has been targeting or hacking diplomats in the Belarusian government for almost 10 years.
According to a recently released report by the antivirus company ESET, at least four foreign embassies — one from South Asia, two from Africa, and two from Europe — have been attacked by the group since 2014. The group intercepts the connections of diplomats at the internet service provider (ISP) level.
ESET researchers think Belarusian ISPs are helping the attacks, allowing the hackers to utilize a legal intercept system called SORM that is similar to the one used by Russia, although it's unclear how the group uses the adversary-in-the-middle (AitM) tactic to intercept and change traffic.
The operators were trained to find some confidential documents, but were not sure exactly what they were looking for, said ESET researcher Matthieu Faou. "They stayed under the radar for a long time."
New attacks with the updated SysUpdate toolkit have been deployed by Chinese advanced persistent threat operation Budworm, also known as APT27, Emissary Panda, Bronze Union, Lucky Mouse, Iron Tiger, and Red Phoenix, against an Asian government and a Middle East-based telecommunications provider, reports The Hacker News.
Forty-five malicious NPM and PyPI packages have been deployed by threat actors to facilitate extensive data theft operations as part of a campaign that commenced on Sept. 12, according to BleepingComputer.
Sixty thousand emails from U.S. State Department accounts were noted by a staffer working for Sen. Eric Schmitt, R-Mo., to have been exfiltrated by Chinese threat actors during the widespread compromise of Microsoft email accounts that commenced in May, according to Reuters.