Defense & Aerospace threat landscape
Defense contractors and aerospace — persistent espionage pressure aimed at weapons programmes and IP.
Matched automatically by keyword — not by AI or analyst judgement. Rebuilt daily. Last rebuilt 2026-10-20.
- Threat actors
- 31
- Actively-attacked vulnerabilities (CISA KEV)
- 0
- Ransomware victims, last 90 days
- 78
- Ransomware victims, since 2026-06
- 120
Shared bucket: ransomware.live groups Government into “Government & Defense” — the ransomware figures on this page are the same victims shown on the Government page, not additional ones.
Threat actors
Actors whose feed descriptions reference this sector, ranked by graph connectivity. Showing 15 of 31.
| Actor | What the feeds say | Connections in our data |
|---|---|---|
| APT28 | APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub… | 283 |
| Sandworm Team | Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Ci… | 270 |
| Turla | Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range… | 246 |
| Leviathan | Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.(Citat… | 236 |
| Naikon | Naikon is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Un… | 226 |
| Sidewinder | Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily… | 224 |
| Threat Group-3390 | Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims. The group has been active since at least 2010 and has target… | 224 |
| APT17 | APT17 is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and no… | 209 |
| Andariel | Andariel is a North Korean state-sponsored threat group that has been active since at least 2009. Andariel has primarily focused its operations--which have in… | 195 |
| POLONIUM | POLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February… | 194 |
| HAFNIUM | HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets e… | 178 |
| Magic Hound | Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted… | 176 |
| APT1 | APT1 is a Chinese threat group that has been attributed to the 2nd Bureau of the People’s Liberation Army (PLA) General Staff Department’s (GSD) 3rd Department, commonly known by its Military Unit Co… | 174 |
| Tonto Team | Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded… | 168 |
| Axiom | Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of over… | 161 |
Campaigns
Campaigns and intel pulses mentioning this sector, most recent first. Showing 15 of 52.
| Campaign | Description | Linked actors | Seen |
|---|---|---|---|
| Quad7 Activity | Quad7 Activity, also known as CovertNetwork-1658 or the 7777 Botnet, is a network of compromised small office/home office (SOHO) routers. The botnet was initially composed p… | — | — |
| Operation Dream Job | Operation Dream Job was a cyber espionage operation likely conducted by Lazarus Group that targeted the defense, aerospace, government, and other sectors i… | Lazarus Group | — |
| C0011 | C0011 was a suspected cyber espionage campaign conducted by Transparent Tribe that targeted students at universities and colleges in India. Security resear… | Transparent Tribe | — |
| Cutting Edge | Cutting Edge was a campaign conducted by suspected China-nexus espionage actors, variously identified as UNC5221/UTA0178 and UNC5325, that began as early as December 2023 with the exploitation of… | — | — |
| Lazarus luring employees with trojanized coding challenges: The case of a Spanish aerospace company | ESET researchers uncovered a Lazarus attack against a Spanish aerospace company where attackers masqueraded as Meta recruiters on LinkedIn, sending trojanized coding challenges to employees. The campaign deployed multiple tools including Li… | — | 2026-10-18 |
| Hallucinating Credibility: China-Aligned TA419 Impersonates its Way into US AI Policy Circles | In July 2026, China-aligned threat actor TA419 conducted credential phishing campaigns impersonating prominent economists and AI policymakers, targeting AI experts at US think tanks, universities, and legal organizations. The group sent ben… | — | 2026-10-02 |
| A fake resume invoked China's defence-tech elite, then installed VShell | A Chinese-language executable disguised as a resume claiming to be from a Beijing Institute of Technology graduate student delivers SNOWLIGHT and VShell RAT. The infection chain uses a custom Go loader with sandbox detection, CPU checks, an… | — | 2026-09-27 |
| Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities | A suspected Chinese-speaking threat actor conducted targeted intrusions against Philippine nuclear research and defense organizations. On August 13, 2026, an open directory on a VPS exposed custom Python scripts exploiting CVE-2023-49105 in… | — | 2026-09-25 |
| Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit | A Chinese-speaking threat actor tracked as Red Heron rapidly weaponized CVE-2026-60004, a critical Gitea remote code execution vulnerability, within days of public disclosure in July 2026. The actor scanned 1,386 Gitea instances across seve… | — | 2026-09-15 |
| Inside a Ukrainian IP Camera Toolkit | Two open directories hosted on Russian bulletproof infrastructure revealed coordinated operations targeting Ukrainian IP cameras, routers, and government websites. The first server exposed tools exploiting SQL injection against a Ukrainian… | — | 2026-09-12 |
| Integrating AI into Attack Operations, From AI-Generated Decoy Documents to a Local LLM | The Kimsuky threat group has integrated artificial intelligence capabilities into its attack operations, establishing local large language model environments using Ollama, GPT4All, and Msty. Evidence indicates the group is accumulating tech… | — | 2026-09-09 |
| Inside The Gentlemen: Undisclosed TukTuk C2 Framework and EDR Neutralization Research | Analysis of server infrastructure revealed a complete TukTuk C2 framework (version 2.0) with cross-platform capabilities, including Windows and Linux agents, backend infrastructure, and management panel. The server contained eb.sys matching… | — | 2026-09-03 |
| Expands Toolset With New Backdoor, SSH Tunnel | An Iranian-linked cyber-espionage group known as Tortoiseshell has enhanced its malware arsenal with newly identified tools, including a reverse SSH tunneling utility and a C++ backdoor. The SSH tunnel, disguised as wtsapi32.dll, leverages… | — | 2026-08-26 |
| Distinct Clusters Target Individuals of Interest to Russia | Three distinct suspected Russian cyber espionage threat clusters—UNC6293, UNC7005, and UNC5976—are abusing legitimate authentication flows to target individuals in academia, aerospace, defense, governments, and think tanks across Europe and… | — | 2026-08-20 |
| Blend between Banking Malware & Spyware | A newly identified Android malware family named Manic combines banking malware and mobile spyware capabilities, targeting Ukrainian banks, government services, messaging applications, Russian and European financial institutions, and global… | — | 2026-08-20 |
ATT&CK techniques
Techniques used by the actors above — what to detect for, ranked by how many of them use it. Showing 15 of 300.
Known-exploited CVEs
CISA KEV entries whose vendor, product or description matches this sector — 0 total, latest below.
No known-exploited CVEs currently surfaced in the graph for this sector. That's the honest reading — we report what the feeds show, not what would fill a table.
High-severity CVEs
Vulnerabilities whose descriptions reference this sector, by CVSS.
| CVE | CVSS | Description | KEV |
|---|---|---|---|
| CVE-2026-27591 | 10.0 | ## Impact Affected versions of Winter CMS allowed authenticated backend users to escalate their accounts level of access to the system by modifying the roles / permissions assigned to their account through specially craf… | |
| CVE-2026-50564 | 9.9 | ### Summary Fission's `Environment` CRD exposes `spec.runtime.podSpec` and `spec.builder.podSpec`, which are merged into the Kubernetes pod specs for runtime and builder pods. The merge logic propagated `hostNetwork`, `… | |
| CVE-2026-71300 | 9.8 | Improper input validation vulnerability in Apache Camel Atmosphere Websocket component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-atm… | |
| CVE-2026-86863 | 9.8 | pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.get_user(… | |
| CVE-2026-78329 | 9.8 | Improper input validation vulnerability in Apache Camel Undertow component. This issue affects Apache Camel: from 4.11.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. UndertowEndpoint default… | |
| CVE-2026-99999 | 9.3 | In the Linux kernel, the following vulnerability has been resolved: ipv4: validate checksum_start before completing checksum If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrup… | |
| CVE-2026-66906 | 9.1 | Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-s… | |
| CVE-2026-33183 | 9.1 | ### Impact Users with MockResponse fixtures that use path traversal. ### Patches Upgrade to Saloon v4+ Upgrade guide: https://docs.saloon.dev/upgrade/upgrading-from-v3-to-v4 ### Description Fixture names were used to … | |
| CVE-2026-48713 | 9.1 | ### Impact `i18next-fs-backend` ≤ 2.6.5, when used to persist missing translation keys (e.g. via `i18next-http-middleware`'s `missingKeyHandler` exposed to untrusted input), is vulnerable to prototype pollution via craf… | |
| CVE-2026-83531 | 8.8 | Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel. This iss… | |
| CVE-2026-46612 | 8.8 | ### Summary The Fission `storagesvc` component registers archive CRUD handlers (`/v1/archive` GET / POST / DELETE and `/v1/archives` list) directly on its HTTP router without performing any authentication or authorizati… | |
| CVE-2026-78165 | 8.8 | Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1. RedisConfiguration.getSerializer lazily… | |
| CVE-2026-44850 | 8.5 | ## Summary Portainer offers an environment-level **Disable bind mounts for non-administrators** security setting that blocks regular users from binding host paths into containers they create through the Portainer-mediat… | |
| CVE-2026-78164 | 8.2 | Improper Neutralization of Special Elements Used in a Template Engine and Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP, Netty HTTP, Undertow and Vert.x HTTP components. … | |
| CVE-2024-26950 | 7.8 | In the Linux kernel, the following vulnerability has been resolved: wireguard: netlink: access device through ctx instead of peer The previous commit fixed a bug that led to a NULL peer->device being dereferenced. It's… |
Ransomware victims
Named leak-site victims classified into this sector (ransomware.live taxonomy: Government & Defense), latest 15 shown.
| Victim | Crew | Discovered |
|---|---|---|
| GardaWorld | qilin | 2026-10-19 |
| JJS Justice | thegentlemen | 2026-10-16 |
| Ecuadors National Police | thegentlemen | 2026-10-16 |
| Shield Wall Systems of Florida | qilin | 2026-10-15 |
| Commune Du Tampon | qilin | 2026-10-15 |
| Ecuador police headquarters | HYFLOCK | 2026-10-13 |
| CNESTEN | qilin | 2026-10-11 |
| Royal Thai Air Force | thegentlemen | 2026-10-10 |
| Secretaría de Modernización e Innovación del Municipio | qilin | 2026-10-10 |
| Anne Arundel County | rhysida | 2026-10-09 |
| Saskatoon Tribal Council | thegentlemen | 2026-10-09 |
| Mandurah State Emergency Service | thegentlemen | 2026-10-03 |
| FUNAP - Fundação "Prof. Dr. Manoel Pedro Pimentel" | Booba Project | 2026-10-01 |
| Defencebit | thegentlemen | 2026-09-30 |
| Juntadeandalucia | medusalocker | 2026-09-28 |
Most active crews · since 2026-06
watch this sector
Get a daily email when something new touches defense & aerospace — or your own vendors, products and suppliers. Deterministic graph matches, one email a day, one-click unsubscribe.