Related Threat Clusters
-
Russian Hackers Exploit Zimbra Zero-Day for Espionage Campaign
Since July 2025, Russian state-backed hackers, known as Laundry Bear, have exploited a zero-click vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite to infiltrate Western government and commercial…
82 articles · Updated July 23, 2026 -
Belarus-Aligned Ghostwriter Group Targets Ukraine with Phishing Campaign
A phishing campaign targeting Ukrainian government organizations has been attributed to the Belarus-aligned Ghostwriter group, also known as UAC-0057. The campaign involves sending emails with PDF attachments that lead…
3 articles · Updated May 22, 2026 -
Belarusian Hackers Target Yury Hubarevich with Sophisticated Phishing Attack
On May 29, 2026, Yury Hubarevich, a prominent Belarusian politician, was targeted in a phishing attack linked to the Belarusian espionage group UNC1151. The attack involved an email disguised as a Google notification,…
11 articles · Updated June 5, 2026 -
Chinese Threat Group Exploits Roundcube Vulnerabilities in University Networks
A suspected China-aligned threat group, tracked as UNK_MassTraction, has been exploiting vulnerabilities in Roundcube mail servers at U.S. and Canadian universities since May 2026. The campaign targets physics and…
14 articles · Updated July 7, 2026 -
FrostyNeighbor Cyberespionage Campaign Targets Ukrainian and Polish Governments
The Belarus-aligned cyber group FrostyNeighbor has launched a targeted campaign against government organizations in Ukraine and Poland since March 2026. Utilizing spearphishing techniques, the group delivers malicious…
8 articles · Updated May 14, 2026 -
UNC1151 Cyber Operations Linked to Belarusian Government and Ghostwriter Campaign
Mandiant Threat Intelligence has assessed with high confidence that UNC1151 is linked to the Belarusian government, conducting cyber operations primarily targeting Ukraine, Lithuania, Latvia, Poland, and Germany. The…
3 articles · Updated May 14, 2026
Recent Intelligence Reports
- StrikeReady — strikeready.com · July 24, 2026
- Unc1151 Campaign Roundcube — cert.pl · July 24, 2026
- TA488 Targets Zimbra Mailservers with Half — Proofpoint · July 23, 2026
- Targeted Gmail Phishing Suspicious Account Activity From Unc1151 Ghostwriter May 2026 — resident.ngo · June 5, 2026
- Belarus — Scworld · May 22, 2026
- Belarus — Reform.News · May 14, 2026
- 'FrostyNeighbor' APT Carefully Targets Govt Orgs in Poland, Ukraine — Darkreading · May 14, 2026
- Unc1151 Linked To Belarus Government — www.mandiant.com · May 14, 2026