Nation-State Cyber Threats | Iran, Russia, China & North Korea

Featured Report · Part 2 · Most Downloaded

Critical Threat Research: The Iranian Cyber War Intensifies

HiveForce Labs releases critical findings on the most significant cyber-kinetic conflict in history. Tactics, techniques, and procedures observed across Iranian state-sponsored operations targeting Western infrastructure.

Download the Report →

🔒 Gated · Form Required

Why This Matters

Nation-state attacks aren't theoretical.

They're

targeting you now.

Geopolitical conflict has moved into the network layer. Iranian, Russian, Chinese, and North Korean operations are actively probing Western enterprises, with TTPs that bypass traditional vulnerability management. This hub is where HiveForce Labs publishes what we're seeing in the field.

01

Gated, in-depth threat reports for each nation-state actor we actively track.

02

Open threat advisories on specific CVEs, exploits, and campaigns tied to state-sponsored groups.

03

Briefing-list signup for nation-state coverage we're actively researching.

Iran · ACTIVE COVERAGE

Iran · Threat Reports

🔒

Report · Part 2

The Iranian Cyber War Intensifies (Part 2)

Updated TTPs, infrastructure mapping, and remediation guidance based on Q1-Q2 2026 incident telemetry.

32 pages · Published April 2026

Download Report →

🔒

Report · Part 1

The Iranian Cyber War Intensifies (Part 1)

The original HiveForce Labs report on Iranian operations: threat actor profiles, observed TTPs, and target industries.

28 pages · Published Q4 2025

Download Report →

🔒

eBook · Companion Guide

Is Your Environment Exposed to the Iranian Cyber Threat?

Self-assessment guide for security leaders. Map the Iranian TTPs against your current controls and exposure posture.

12 pages · Briefing-style read

Read the eBook →

🔒

Free Tool

Free Iranian Exposure Assessment

Get a tailored report on your organization's exposure to active Iranian campaigns. Runs against your scan data, returns in 48 hours.

No charge · Sales follow-up included

Request Assessment →

Iran · Recent Threat Advisories

Apr 2026

Iran-Linked

Inside Storm-2949's Cloud Takeover Campaign Targeting Microsoft 365 and Azure

Read →

Mar 2026

Iran-Linked

FamousSparrow's Persistent Hold on Azerbaijani Oil & Gas

Read →

Feb 2026

Iran-Linked

PAN-OS Buffer Overflow Flaw Under Active State-Sponsored Exploitation

Read →

Russia · COMING SOON

Russia · Threat Reports

TA2026093

APT28 Exploits SOHO Routers for Large-Scale DNS Hijacking and Credential Theft

APT28, the Russian state-sponsored threat group operating under GRU Military Intelligence Unit 26165, conducted a large-scale DNS hijacking campaign dubbed Operation FrostArmada by compromising small office and home office routers to build distributed credential theft infrastructure.

Read →

Russia · Recent Threat Advisories

TA2026153

Vibe-Coding the Kill Chain: The GREYVIBE Story

Read →

TA2025256

Static Tundra Fuels Espionage Campaigns Through an Old Cisco Bug

Read →

TA2025117

APT29 Deploys GRAPELOADER via Wine-Tasting Phishing Emails

Read →

China · COMING SOON

China · Threat Reports

TA2025371

ShadyPanda's Seven-Year Operation Built a Browser Extension Spy Empire

ShadyPanda threat actor, a likely China-based cybercriminal group, orchestrated a seven-year browser extension malware operation that compromised more than 4.3 million Chrome and Edge users worldwide.

Read →

China · Recent Threat Advisories

TA2026237

One Team, Two Payrolls: Jewelbug's Parallel Operations

Read →

TA2026133

FamousSparrow's Persistent Hold on Azerbaijani Oil & Gas

Read →

TA2026049

CVE-2026-22769: UNC6201 Exploiting Dell RecoverPoint Zero-Day

Read →

North Korea · COMING SOON

North Korea · Threat Reports

TA2025122

Kimsuky's Stealthy RDP Espionage Campaign

A newly uncovered cyber espionage campaign by North Korea-linked Kimsuky (aka Larva-24005) has been active since at least October 2023, targeting South Korea’s software, energy, and financial sectors, as well as global organizations.

Read →

North Korea · Recent Threat Advisories

TA2026059

Ruby Jumper: APT37’s Cloud-to-Air-Gap Espionage Framework

Read →

TA2026231

Operation Dream Job: Lazarus Exploits a Windows Zero-Day to Deploy Backdoor

Read →

TA2026075

Konni APT’s Covert RAT Deployment

Read →

UAE · COMING SOON

UAE · Recent Threat Advisories

TA2025183

Zero-Day Stealth: Inside Stealth Falcon’s Abuse of CVE-2025-33053

Stealth Falcon, a long-active cyber-espionage group, exploited a zero-day vulnerability in Windows (CVE-2025-33053) to target a Turkish defense firm using a malicious file disguised as a PDF.

Read →

Other Actors · COMING SOON

Other Actors · Threat Reports

TA2026084

TeamPCP's Automated Supply Chain: From Trivy to LiteLLM in a Multi-Ecosystem Breach

Stealth Falcon, a long-active cyber-espionage group, exploited a zero-day vulnerability in Windows (CVE-2025-33053) to target a Turkish defense firm using a malicious file disguised as a PDF.

Read →

Other Actors · Recent Threat Advisories

TA2026194

Coinbase Cartel: The Encryption-Free Data Extortion Group

Read →

TA2026107

Brand Hijack in Cybercrime: Who Is Pretending to Be ShinyHunters?

Read →

Frontline intelligence on

Critical Threat Research: The Iranian Cyber War Intensifies

Nation-state attacks aren't theoretical.

Iran

Iran · Threat Reports

The Iranian Cyber War Intensifies (Part 2)

The Iranian Cyber War Intensifies (Part 1)

Is Your Environment Exposed to the Iranian Cyber Threat?

Free Iranian Exposure Assessment

Iran · Recent Threat Advisories

Russia

Russia · Threat Reports

APT28 Exploits SOHO Routers for Large-Scale DNS Hijacking and Credential Theft

Russia · Recent Threat Advisories

China

China · Threat Reports

ShadyPanda's Seven-Year Operation Built a Browser Extension Spy Empire

China · Recent Threat Advisories

North Korea

North Korea · Threat Reports

Kimsuky's Stealthy RDP Espionage Campaign

North Korea · Recent Threat Advisories

UAE

UAE · Recent Threat Advisories

Zero-Day Stealth: Inside Stealth Falcon’s Abuse of CVE-2025-33053

Other Actors

Other Actors · Threat Reports

TeamPCP's Automated Supply Chain: From Trivy to LiteLLM in a Multi-Ecosystem Breach

Other Actors · Recent Threat Advisories

Want a tailored briefing on the

threats targeting your industry?