Security news from around the web with our take: what happened, what it means for you, and what defenders should do. We link every original story.
3 stories match your filters.
CERT-UA says APT28 sent Office documents exploiting CVE-2026-21509 to Ukrainian government bodies and EU organizations days after Microsoft disclosed the flaw, planting a Covenant implant that talks through Filen.
The UK NCSC says APT28 exploited TP-Link and MikroTik routers to change their DNS settings and intercept Outlook logins and OAuth tokens from 2024 into 2026.
ExaTrack tracked about 90 samples of PixyNetLoader, an APT28 loader that pulls a Covenant implant out of PNG pixels and talks to its operators through the Filen cloud service.