Platforms
An updated catalog from Unit 42 consolidates selected threat groups and reflects changes through Aug. 1, 2025. The reference organizes actors by primary motivation using a constellation-based naming scheme: nation‑state clusters (for example, Draco, Taurus, Ursa, Serpens, Pisces), general cybercrime (Libra), and ransomware (Scorpius). Each profile lists aliases, a concise summary, affected sectors, and observed tactics, techniques and procedures. The entry set spans longstanding espionage activity, data‑theft operations enabled by social engineering, and an expansive ransomware ecosystem run by RaaS affiliates. The latest update adds several groups (including Bling Libra, Fiery Scorpius, Flighty Scorpius, Repellent Scorpius, Tarnished Scorpius, and Tropical Scorpius) and notes telemetry‑driven refinements grounded in an Attribution Framework.
Operational trends documented across entries include supply‑chain compromise, credential harvesting, command‑and‑control tunneling via DNS, zero‑day exploitation, and cryptocurrency theft. The catalog highlights nuances such as selective targeting (for instance, some ransomware operators avoiding CIS‑language victims), double‑ and multi‑extortion models, and the use of "living off the land" techniques that repurpose built‑in tools to avoid detection. It also emphasizes breadth of impact, with recurring activity against government, defense, healthcare, finance, high technology, utilities, and manufacturing. The listing is structured alphabetically by constellation to serve as a centralized starting point for analysts, defenders, and incident responders, with references to deeper technical reports for indicators, mitigations, and response guidance.
Research
The latest episode of Unlocked 403 examines how mobile espionage has shifted toward scalable surveillance conducted through malicious apps and covert services. The discussion centers on BadBazaar, a modular spyware family capable of operating through legitimate‑looking apps, abusing Android permissions, running stealthy background processes, and using obfuscation and covert channels to persist and exfiltrate data. Infection vectors include sideloading, untrusted app stores, trojanized applications, and social‑engineering lures—some requiring minimal user interaction. These behaviors complicate both detection and forensic analysis.
Practical indicators of compromise highlighted in the conversation include unexpected permission prompts, unexplained battery drain, spikes in data usage, unsolicited popups, and device instability. Recommended mitigation steps are concrete: limit installations to trusted sources, scrutinize app permissions, keep operating systems and apps updated, deploy reputable mobile security tools, remove suspicious apps, and, when compromise is confirmed, conduct a factory reset. The episode places these measures in the broader context of mobile threat trends and urges organizations to reinforce user education, develop incident response procedures that account for mobile endpoints, and stack layered controls to reduce exposure and speed containment.
Policies
A commentary on encryption policy from WeLiveSecurity argues that mandates for access to end‑to‑end encrypted content would in practice require backdoors that vendors say they will not build. The piece notes Apple’s February withdrawal of Advanced Data Protection for UK users after a non‑public notice under the Investigatory Powers Act allegedly sought a means to access encrypted content, and points to public support from WhatsApp for Apple’s position. The author contends per‑country restrictions are technically and operationally impractical—settings can be changed to bypass limits, encrypted data stays unreadable unless decrypted before disabling protection, and border‑based enforcement would strain inspection processes. The analysis concludes that such requirements burden law‑abiding users, are trivial for determined criminals to evade, and risk prompting broader moves by other governments that would weaken global security. The recommended path is to preserve strong end‑to‑end encryption while enabling lawful access through court warrants, transparency, and robust oversight instead of engineering vulnerabilities.
Separately, CISA and FEMA announced a Notice of Funding Opportunity totaling more than $100 million to strengthen community cybersecurity. For FY2025, the State and Local Cybersecurity Grant Program provides $91.7 million to state and local jurisdictions, and the Tribal Cybersecurity Grant Program provides $12.1 million to tribal governments. Eligible activities include planning and exercises, hiring and training of cybersecurity personnel, hardening networks and services, and improving digital services that support citizens. The announcement underscores goals of measurable risk reduction aligned to local threats and infrastructure needs, with an emphasis on resilience of critical services and prudent use of funds. Interested governments are directed to the application guidance to prioritize investments tied to capabilities, preparedness, and workforce development.