Cisco Talos and Recorded Future tie a June 2025 to August 2026 campaign against CIS governments to UAT-6275. Talos rates its Kazakhstan nexus at medium confidence, and Recorded Future tracks the same activity as TAG-193.
Perspective Coverage
4 publishers
- Builder
- Builder 15%
- Operator
- Operator 56%
- Investor
- Investor 29%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+8
- Incentives35
- Confidence66
UAC-0099, a Russia-aligned group, has pushed its MATCHBOIL downloader from Ukrainian transport firms into a manufacturer and an energy company, ESET says. The researchers tracked the tool for almost two years; it installs MATCHWOK, a C# backdoor that grabs screenshots and runs PowerShell.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence66
Acronis says a new backdoor pair is hitting Afghan telecom and South Asian critical infrastructure, with one implant running command and control through the Google Sheets API.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence55
Bitdefender says a China-nexus cluster hit Central Asian governments with seven RAT families, five undocumented. The AI fingerprint is in the workflow, not the code.
Reality
- Evidence60
- Adoption20
- Hype gap+10
- Incentives
- Not scored
- Confidence58
Hunt.io only found the intrusion because the operator left his staging directory browsable on port 8000 in Amsterdam. The scripts inside needed no passwords, just valid usernames and an ownCloud install nobody had updated.
Perspective Coverage
3 publishers
- Builder
- Builder 33%
- Operator
- Operator 57%
- Investor
- Investor 10%
Reality
- Evidence64
- Adoption
- Not scored
- Hype gap+8
- Incentives38
- Confidence60
ESET traced more than a year of espionage against government organizations in eight Latin American countries and territories to a modular C++ implant that hooks CreateThread so every thread it spawns looks like AnimateWindow.
Perspective Coverage
5 publishers
- Builder
- Builder 22%
- Operator
- Operator 68%
- Investor
- Investor 10%
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence68
Securonix pulled four scheduled tasks and a Startup folder copy out of one infected machine, and the two PowerShell modules restart each other. Delete the desktop script and the backdoor keeps collecting documents.
Perspective Coverage
3 publishers
- Builder
- Builder 28%
- Operator
- Operator 66%
- Investor
- Investor 6%
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence62
APT36 hides Operation RapidRust command traffic inside private GitHub repositories
Zscaler ThreatLabz says the Pakistan-aligned group worked government and defense targets in India and Afghanistan with four undocumented tools, one of them a Rust backdoor that takes its orders from files in a private repo.
Reality
- Evidence40
- Adoption25
- Hype gap+18
- Incentives65
- Confidence45
Nexus sold access to 153 million genuine US and Canadian driver's licences
Krebs On Security watched the database grow by nearly 400,000 records in one day, matching Nexus's own claim of more than a year of continuous exfiltration from an identity verification company.
Reality
- Evidence62
- Adoption68
- Hype gap+22
- Incentives40
- Confidence58
Nearly four in ten breached German companies now name a foreign intelligence service
German firms' own attribution of attacks to state services has moved from 7% to nearly 40% in two years. That puts nation-state tradecraft on the risk register of any mid-sized manufacturer with a supplier list.
Reality
- Evidence48
- Adoption55
- Hype gap+22
- Incentives68
- Confidence55