Threat Source newsletter (May 20, 2021)
Summary: Cisco Talos reports that the Transparent Tribe APT, also known as APT36 and Mythic Leopard, continues registering fake domains mimicking legitimate military and defense organizations and is increasingly targeting diplomatic entities, defense contractors, research organizations and conference attendees. Talos also observed updated Lemon Duck cryptocurrency-mining botnet infrastructure targeting unpatched Microsoft Exchange Servers and attempting to download Cobalt Strike DNS beacon payloads, activity that followed zero-day Exchange vulnerabilities made public on March 2.
Bottom line: Lemon Duck actors have been generating fake domains on East Asian top-level domains to mask connections to their legitimate command-and-control domain since at least February 2020, so the infrastructure behind these campaigns is long-lived and built to survive takedowns. Transparent Tribe's move beyond military and defense personnel to diplomatic entities, contractors and conference attendees widens the pool of people whose credentials and inboxes are now in scope.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026