ThreatCluster

Rise of AI-Driven Attacks and NFC Threats in Cybersecurity

First seen 18 Dec 2025, 15:57 UTC • •24

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

ESET Research reports a significant increase in AI-powered malware and NFC threats in late 2025. The MuddyWater group, aligned with Iran, has been targeting critical infrastructure in Israel and Egypt, while the China-aligned PlushDaemon group has employed a new network implant called EdgeStepper for adversary-in-the-middle attacks. These developments highlight a growing trend in sophisticated cyber threats.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 243d ago How this analysis works

More articles in this cluster (2)

Threat Graph

5 entities, 6 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (2)

MuddyWater
PlushDaemon

Technique (2)

Malware
Man-in-the-Middle

Malware (1)

EdgeStepper

Relationships

MuddyWater uses EdgeStepper
PlushDaemon uses EdgeStepper
MuddyWater uses Malware
MuddyWater uses Man-in-the-Middle
PlushDaemon uses Malware
PlushDaemon uses Man-in-the-Middle

Following this threat?

Track MuddyWater and EdgeStepper in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Cyber Espionage Escalates in Europe Amid Geopolitical Tensions Cyberattacks on the public sector have surged by 114% in Europe over the past 30 months, with an average of 2,563 attacks per week per organization. This increase is attributed to rising geopolitical tensions, particularly related to the ongoing conflict between Russia and Ukraine. Check Point Research reports that…

Iranian Espionage Campaign UNK_SmudgedSerpent Targets Academics Proofpoint has identified an Iranian-linked espionage group named UNK_SmudgedSerpent, which has been active since mid-2025. This group targets academics and foreign policy experts, utilizing highly targeted phishing techniques and credential theft operations. The campaign began with benign emails discussing Iran's…