Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

APT28 wellnesscaremed[.]com multistage LNK campaign

Campaign
First reported
Last updated
Happening score
H score 36
1 unique sources, 1 articles

Summary

Hide ▲

An APT28-linked LNK/HTML delivery chain is being used for multistage payloads, indicating an ongoing phishing-style operation that can broaden exploitation paths. The infrastructure centers on wellnesscaremed[.]com and was associated with a malicious artifact uploaded on January 30, 2026. The technique can help bypass MotW and IE ESC, raising the risk of code execution outside the browser sandbox.

Related Happenings

Hugging Face shared-loader supply chain campaign

Campaign
H score79 First: 11.05.2026 10:05 Last: 11.05.2026 10:05 Sources 1

About this happening: A Hugging Face repository cluster appears to be part of a broader supply chain campaign that used shared loaders to push a stealer through open-source model downloads....

Open Happening

GlassWorm open-source supply-chain campaign targeting developers

Campaign
H score46 First: 14.03.2026 14:55 Last: 14.03.2026 14:55 Sources 1

About this happening: GlassWorm shifted from hidden Open VSX extension updates into a broader GitHub, npm, and VS Code/OpenVSX supply-chain campaign. Early reporting said seemingly...

Latest development: 17.03.2026 23:42

GlassWorm renewed its supply-chain campaign against GitHub, npm, and VSCode/OpenVSX, with researchers identifying 433 compromised components this month across 200 GitHub Python repositories, 151 GitHub JS/TS repositories, 72 VSCode/OpenVSX extensions, and 10 npm packages. The operators compromised GitHub accounts to force-push malicious commits, published obfuscated code using invisible Unicode characters, and used Solana blockchain transactions as C2 to deliver a Node.js runtime and a JavaScript-based information stealer that targets cryptocurrency wallet data, credentials, access tokens, SSH keys, and developer environment data.

Open Happening

Stryker hit by cyberattack

Incident
H score29 First: 12.03.2026 11:30 Last: 12.03.2026 11:30 Sources 1

About this happening: Stryker confirmed a cyberattack that caused global disruption to its Microsoft environment, interrupting access to business systems and applications. The company said...

Open Happening

SloppyLemming spear-phishing campaign targeting Pakistan and Bangladesh

Campaign
H score37 First: 03.03.2026 08:53 Last: 03.03.2026 08:53 Sources 1

About this happening: The SloppyLemming campaign is using spear-phishing, PDF lures, and macro-enabled Excel documents to target government entities and critical infrastructure operat...

Open Happening

APT28 Operation MacroMaze campaign targeting Western and Central Europe

Campaign
H score33 First: 23.02.2026 21:41 Last: 23.02.2026 21:41 Sources 1

About this happening: APT28 was attributed to Operation MacroMaze, a spear-phishing campaign against entities in Western and Central Europe that used basic tooling and webhook[.]s...

Open Happening

Timeline

  2. 02.03.2026 12:36 2 articles · 4mo ago

    Akamai ties CVE-2026-21513 exploitation to APT28

    Initial Disclosure

    Akamai linked possible exploitation of CVE-2026-21513 against victims opening malicious HTML or LNK files to APT28, while Microsoft said the MSHTML Framework security feature bypass had already been used as a zero-day and fixed it in February 2026 Patch Tuesday; the analysis described a crafted Windows Shortcut that can invoke ShellExecuteExW, bypass Mark-of-the-Web (MotW) and Internet Explorer Enhanced Security Configuration (IE ESC), and use wellnesscaremed[.]com for multistage payload delivery.

    Show sources
    Open in new tab