Chinese-linked cyber espionage resurges, targeting Europe amid rising geopolitical tensions.

Since mid-2025, attackers have focused on EU, NATO, and embassy networks using spear-phishing lures (fake interviews, collaboration requests) to deploy malware and exfiltrate data.

Recent activity also extends into the Middle East.

Handala breached PSK WIND Technologies, a firm tied to Israeli air defense C2 systems. Exfiltration includes sensitive data on command centers, communications, and infrastructure. This signals a significant supply-chain level compromise.

#TGITM @TheGhostITM

Handala hackers intrusion into PSK WIND Technologies, linked to integrated air defense command & control. Include full data exfiltration and transfer to external actors. Monitoring for indicators, validation, and potential downstream impact.

#TGITM @TheGhostITM

Handala group says it infiltrated PSK WIND Technologies, reportedly accessing classified air defense C2 data. This could represent a major breach of defense-related infrastructure networks.

#TGITM @TheGhostITM

Handala: 22 terabytes of data deleted from 14 Israeli companies / A cyber gift for Passover

On the occasion of Passover, this important holiday for our dear Israelis and beloved occupiers, we at Handala would like to extend our special congratulations.

As part of our ongoing commitment to support the oppressed and confront occupation and injustice, we have successfully carried out a large-scale and targeted cyber operation.

In this mission, data from 14 companies belonging to the Zionist regime was completely deleted. The total volume of data removed in this operation reached 22 terabytes, a small gift for Passover, as a reminder that occupation has a cost.

The targeted companies are as follows:

DanielBengioCPA
Fuse Stereo
Gavriel Weiss C.P.A
Hagai Namir
Kalus
Migvan 2002
Mouth or Foot Painting Artists Ltd
Opal Plastic
PoliPach
Rim Ishak Hagi
SITT
Toledano Architecture & Design
To-Mix
Yarok

We hereby declare that no database is beyond our reach and any continuation of occupation and crimes will face heavier costs.

Happy Passover, We hope the occupiers benefit from increased awareness in cybersecurity!

#Handala

Handala hackers infuriate into the companies designing the integrated command and control systems of Israeli air defense.

#TGITM @TheGhostITM

17% Growth of Ransomware in Japan in 2025

In 2025, ransomware attacks in Japan increased, reaching 134 cases. Among them, the "Qilin" ransomware was the most active and carried out a large portion of these attacks.

Cisco fixed two critical flaws that allow full system takeover without login.

CVSS 9.8 vulnerabilities let attackers reset admin passwords (IMC) or run commands as root (SSM On-Prem) using crafted requests.

No workaround is available. Patching is required.

Apple expanded iOS 18.7.7 security updates to more iPhones and iPads to fix DarkSword exploits.

The fixes were released in 2025, and now also protect devices that are not on iOS 26—so users can stay on iOS 18 & still get security updates.

🇺🇸 New attack chain hits Progress ShareFile: two critical bugs chained to achieve unauthenticated RCE and full server takeover.

Attackers bypass auth, access admin panel, then upload malicious files to execute code—risking complete data exposure.

CrystalRAT emerges as a new MaaS threat, offering full remote access, data exfiltration, keylogging, and clipboard hijacking.

Uses ChaCha20 encryption to protect payloads and leverages automated tooling for deployment.

Shares design traits with WebRAT, indicating evolving RAT-based MaaS ecosystems.

WhatsApp warns of a spyware campaign targeting iOS users, with ~200 victims—mostly in 🇮🇹 Italy—tricked into installing a fake app.

Malicious links led to a trojanized version capable of data theft.

Access has been revoked; users urged to install only from official sources. Legal action underway.

U.S. Rep. Randy Fine claims he was targeted by an cyberattack shortly after recent geopolitical escalations involving Iran.

The hacker group Handala released images and personal details of members of IranWire news agency.

The names of these individuals are as follows:
Maryam Dehghardi
Sina Ghanbari-Pour
Maziar Bahari
Mojtaba Hosseini
Solmaz Alakdar
Samaneh Ghadarkhani
Roghayeh Rezaei
Payam Younesi-Pour
Parisa Pourtaherian
Meysam Arshadi
Ebrahim Ramazani
Arezoo Karimi
Ali Roshanfar
Fereydoun Teymouri
Farzan Rouhi
Aylar Fatoorehchian
Aida Ghajeri
Sam Diba
Shima Shahrabi
Hamoun Mersan

#TGITM @TheGhostITM

Cyberattack hits the European Commission: Hacker group “TeamPCP” breached cloud infrastructure using a stolen API key, exposing data across dozens of EU entities.

Leaked emails and user data are now surfacing on the dark web via ShinyHunters.

TA416 is again targeting European governments, using OAuth redirect abuse and cloud-hosted malware to deliver PlugX.

Activity expanded to the Middle East in 2026, tied to conflict-driven intelligence gathering.