Ink Dragon European government relay-node campaign
Campaign
Summary
Hide ▲
Show ▼
A China-linked group is turning misconfigured European government servers into relay nodes to hide cyber-espionage, expanding the operational footprint and making detection harder. The campaign targets Microsoft IIS and SharePoint systems, then steals credentials and moves laterally with Remote Desktop. It also installs backdoors and long-term access tools to preserve control and repurpose compromised networks. The reuse of victim infrastructure to forward commands and data means affected organizations can become part of a wider attack mesh.
Related Happenings
ShinyHunters-linked Salesforce intrusion campaign
Campaign
H score45
First: 14.07.2026 09:19
Last: 14.07.2026 09:19
Sources 1
About this happening:
A ShinyHunters-linked campaign is abusing Salesforce trust relationships to access CRM data across retail, education, and manufacturing tenants. The operation combines...
ShinyHunters-linked Salesforce intrusion campaign
CampaignAbout this happening: A ShinyHunters-linked campaign is abusing Salesforce trust relationships to access CRM data across retail, education, and manufacturing tenants. The operation combines...
Cavern Manticore campaign targeting Israeli government and IT organizations
Campaign
H score70
First: 06.07.2026 19:00
Last: 06.07.2026 19:00
Sources 1
About this happening:
The Cavern Manticore campaign is targeting Israeli government and IT organizations since early 2026, increasing the risk of unauthorized access and data theft...
Cavern Manticore campaign targeting Israeli government and IT organizations
CampaignAbout this happening: The Cavern Manticore campaign is targeting Israeli government and IT organizations since early 2026, increasing the risk of unauthorized access and data theft...
Mistic backdoor attack activity targeting enterprise sectors since April
Malware Activity
H score33
First: 24.06.2026 13:41
Last: 24.06.2026 13:41
Sources 1
About this happening:
The Mistic backdoor is being used in financially motivated attacks against insurance, education, IT, and professional services organizations, giving operators a stealt...
Mistic backdoor attack activity targeting enterprise sectors since April
Malware ActivityAbout this happening: The Mistic backdoor is being used in financially motivated attacks against insurance, education, IT, and professional services organizations, giving operators a stealt...
Backdoor.Turn Microsoft Teams TURN relay malware activity
Malware Activity
H score29
First: 16.06.2026 13:18
Last: 16.06.2026 13:18
Sources 1
About this happening:
Backdoor.Turn is a Go-based RAT tied to DragonForce ransomware operators that hid command-and-control traffic through Microsoft Teams TURN relay infrastructure dur...
Backdoor.Turn Microsoft Teams TURN relay malware activity
Malware ActivityAbout this happening: Backdoor.Turn is a Go-based RAT tied to DragonForce ransomware operators that hid command-and-control traffic through Microsoft Teams TURN relay infrastructure dur...
Major U.S. services company hit by ransomware attack linked to DragonForce
Incident
H score38
First: 16.06.2026 13:18
Last: 16.06.2026 13:18
Sources 1
About this happening:
A DragonForce ransomware incident hit a major U.S. services firm in December 2025, with attackers maintaining access for one to two months and hiding command-and...
Major U.S. services company hit by ransomware attack linked to DragonForce
IncidentAbout this happening: A DragonForce ransomware incident hit a major U.S. services firm in December 2025, with attackers maintaining access for one to two months and hiding command-and...
Timeline
-
17.12.2025 11:30 2 articles · 7mo ago
Ink Dragon relay-node campaign across European government networks
Campaign Scope UpdateCheck Point says Ink Dragon is using misconfigured public-facing servers in European government networks as relay nodes to conceal cyber-espionage activity, after probing Microsoft IIS, SharePoint and other servers for configuration weaknesses. The group is described as stealing credentials, identifying active administrator sessions, reusing shared or replicated service accounts, moving laterally with Remote Desktop, and then mapping the environment, controlling policy settings, and deploying long-term access tools on high-value systems. Check Point also says the group is installing a backdoor and a customized IIS-based module to turn compromised servers into quiet relay points, while a new version of the FinalDraft backdoor is being used for long-term access and to blend into Microsoft cloud activity. The same report says RudePanda entered some of the same European government networks and exploited the same exposed server vulnerability, showing that a single unpatched weakness can support multiple separate campaigns inside the same organization.
Show sources
- Chinese Ink Dragon Group Hides in European Government Networks — www.infosecurity-magazine.com — 17.12.2025 11:30
- Chinese Ink Dragon Group Hides in European Government Networks — www.infosecurity-magazine.com — 17.12.2025 11:30