<rss version="2.0"
    xmlns:dc="http://purl.org/dc/elements/1.1/"
    xmlns:content="http://purl.org/rss/1.0/modules/content/"
    xmlns:atom="http://www.w3.org/2005/Atom"
    xmlns:media="http://search.yahoo.com/mrss/">
    <channel><title>Business Insights Cybersecurity Blog by Bitdefender</title><description>Stay in touch with the latest business cybersecurity news and information provided by Bitdefender Enterprise. Tune up your security knowledge and read our blog!</description><link>https://www.bitdefender.com/en-us/blog/businessinsights/</link><image><url>https://download.bitdefender.com/resources/images/favicon/favicon-32x32.png</url><title>Business Insights Cybersecurity Blog by Bitdefender</title><link>https://www.bitdefender.com/en-us/blog/businessinsights/</link></image><generator>Bitdefender Blog</generator><lastBuildDate>Wed, 15 Apr 2026 15:34:56 GMT</lastBuildDate><atom:link href="https://www.bitdefender.com/nuxt/api/en-us/rss/businessinsights/advanced-persistent-threats/" rel="self" type="application/rss+xml"/><ttl>1800</ttl><item><title>Bitdefender Threat Debrief | March 2026</title><description><![CDATA[Ransomware Group AtomSilo Returns After 5 Year Absence 
 
]]></description><link>https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-threat-debrief-march-2026</link><guid isPermaLink="false">376910023903</guid><category><![CDATA[SMB Security]]></category><category><![CDATA[Enterprise Security]]></category><category><![CDATA[Ransomware]]></category><category><![CDATA[Advanced Persistent Threats]]></category><category><![CDATA[Bitdefender Threat Debrief]]></category><dc:creator>Jade Brown</dc:creator><pubDate>Wed, 11 Mar 2026 17:40:00 GMT</pubDate><media:content url="https://341979.fs1.hubspotusercontent-eu1.net/hubfs/341979/ransomware-threat-debrief.png" medium="image"/><content:encoded><![CDATA[Ransomware Group AtomSilo Returns After 5 Year Absence 
 
]]></content:encoded></item><item><title>APT36: A Nightmare of Vibeware</title><description><![CDATA[I'd like to thank my coauthors Adrian Schipor, Victor Vrabie, Marius Baciu, and Martin Zugec for their invaluable contributions to this research.  
]]></description><link>https://www.bitdefender.com/en-us/blog/businessinsights/apt36-nightmare-vibeware</link><guid isPermaLink="false">372255123693</guid><category><![CDATA[Enterprise Security]]></category><category><![CDATA[Threat Research]]></category><category><![CDATA[Advanced Persistent Threats]]></category><dc:creator>Radu Tudorica</dc:creator><pubDate>Thu, 05 Mar 2026 13:50:00 GMT</pubDate><media:content url="https://businessresources.bitdefender.com/hubfs/apt36-cat-climbing-code-tree.png" medium="image"/><content:encoded><![CDATA[I'd like to thank my coauthors Adrian Schipor, Victor Vrabie, Marius Baciu, and Martin Zugec for their invaluable contributions to this research.  
]]></content:encoded></item><item><title>The Korean Leaks – Analyzing the Hybrid Geopolitical Campaign Targeting South Korean Financial Services With Qilin RaaS</title><description><![CDATA[TL;DR - The "Korean Leaks" campaign showcases a sophisticated supply chain attack against South Korea's financial sector. This operation combined the capabilities of a major Ransomware-as-a-Service (RaaS) group, Qilin, with potential involvement from North Korean state-affiliated actors (Moonstone Sleet) leveraging Managed Service Provider (MSP) compromise as the initial access vector. 
]]></description><link>https://www.bitdefender.com/en-us/blog/businessinsights/korean-leaks-campaign-targets-south-korean-financial-services-qilin-ransomware</link><guid isPermaLink="false">304680614088</guid><category><![CDATA[Enterprise Security]]></category><category><![CDATA[Ransomware]]></category><category><![CDATA[Threat Research]]></category><category><![CDATA[Advanced Persistent Threats]]></category><category><![CDATA[Threat Intelligence]]></category><dc:creator>Bitdefender Enterprise</dc:creator><pubDate>Mon, 24 Nov 2025 10:50:00 GMT</pubDate><media:content url="https://341979.fs1.hubspotusercontent-eu1.net/hubfs/341979/south_korea.png" medium="image"/><content:encoded><![CDATA[TL;DR - The "Korean Leaks" campaign showcases a sophisticated supply chain attack against South Korea's financial sector. This operation combined the capabilities of a major Ransomware-as-a-Service (RaaS) group, Qilin, with potential involvement from North Korean state-affiliated actors (Moonstone Sleet) leveraging Managed Service Provider (MSP) compromise as the initial access vector. 
]]></content:encoded></item><item><title>Curly COMrades: Evasion and Persistence via Hidden Hyper-V Virtual Machines</title><description><![CDATA[I'd like to thank my coauthors Adrian Schipor and Martin Zugec for their invaluable contributions to this research. 
]]></description><link>https://www.bitdefender.com/en-us/blog/businessinsights/curly-comrades-evasion-persistence-hidden-hyper-v-virtual-machines</link><guid isPermaLink="false">295416147160</guid><category><![CDATA[SMB Security]]></category><category><![CDATA[Enterprise Security]]></category><category><![CDATA[Threat Research]]></category><category><![CDATA[Endpoint Detection and Response]]></category><category><![CDATA[Advanced Persistent Threats]]></category><category><![CDATA[Threat Intelligence]]></category><dc:creator>Victor Vrabie</dc:creator><pubDate>Tue, 04 Nov 2025 13:55:00 GMT</pubDate><media:content url="https://businessresources.bitdefender.com/hubfs/curly-comrades-target-virtual-machines.jpg" medium="image"/><content:encoded><![CDATA[I'd like to thank my coauthors Adrian Schipor and Martin Zugec for their invaluable contributions to this research. 
]]></content:encoded></item><item><title>EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company</title><description><![CDATA[I'd like to thank my coauthors, Victor Vrabie, Adrian Schipor, and Martin Zugec, for their invaluable contributions to this research.
TL;DR A Chinese APT group compromised a Philippine military company using a new, fileless malware framework called EggStreme. This multi-stage toolset achieves persistent, low-profile espionage by injecting malicious code directly into memory and leveraging DLL sideloading to execute payloads. The core component, EggStremeAgent, is a full-featured backdoor that enables extensive system reconnaissance, lateral movement, and data theft via an injected keylogger. 
]]></description><link>https://www.bitdefender.com/en-us/blog/businessinsights/eggstreme-fileless-malware-cyberattack-apac</link><guid isPermaLink="false">271740682472</guid><category><![CDATA[Enterprise Security]]></category><category><![CDATA[Threat Research]]></category><category><![CDATA[Advanced Persistent Threats]]></category><category><![CDATA[Threat Intelligence]]></category><dc:creator>Bogdan Zavadovschi</dc:creator><pubDate>Wed, 17 Sep 2025 19:11:34 GMT</pubDate><media:content url="https://341979.fs1.hubspotusercontent-eu1.net/hubfs/341979/eggstreme-keylogger-malware-with-flag.png" medium="image"/><content:encoded><![CDATA[I'd like to thank my coauthors, Victor Vrabie, Adrian Schipor, and Martin Zugec, for their invaluable contributions to this research.
TL;DR A Chinese APT group compromised a Philippine military company using a new, fileless malware framework called EggStreme. This multi-stage toolset achieves persistent, low-profile espionage by injecting malicious code directly into memory and leveraging DLL sideloading to execute payloads. The core component, EggStremeAgent, is a full-featured backdoor that enables extensive system reconnaissance, lateral movement, and data theft via an injected keylogger. 
]]></content:encoded></item><item><title>UAC-0063: Cyber Espionage Operation Expanding from Central Asia</title><description><![CDATA[Bitdefender Labs warns of an active cyber-espionage campaign targeting organizations in Central Asia and European countries. The group, tracked as UAC-0063, employs sophisticated tactics to infiltrate high-value targets, including government entities and diplomatic missions, expanding their operations into Europe.
]]></description><link>https://www.bitdefender.com/en-us/blog/businessinsights/uac-0063-cyber-espionage-operation-expanding-from-central-asia</link><guid isPermaLink="false">185295137424</guid><category><![CDATA[Threat Research]]></category><category><![CDATA[Advanced Persistent Threats]]></category><dc:creator>Martin Zugec</dc:creator><pubDate>Wed, 12 Feb 2025 14:24:38 GMT</pubDate><media:content url="https://businessresources.bitdefender.com/hubfs/BD_Russia_Digital_Flag_Blog%20.jpeg" medium="image"/><content:encoded><![CDATA[Bitdefender Labs warns of an active cyber-espionage campaign targeting organizations in Central Asia and European countries. The group, tracked as UAC-0063, employs sophisticated tactics to infiltrate high-value targets, including government entities and diplomatic missions, expanding their operations into Europe.
]]></content:encoded></item><item><title>ARM Support on Windows for Bitdefender Solutions</title><description><![CDATA[Windows on ARM (WoA) goes back a long way, it is a growing hardware and application ecosystem with 2022 seeing significant momentum across the Windows on ARM ecosystem. Whether it’s an increasing number of new applications, developer kits and tools, or devices, WoA is gathering pace and looks set to become a disruptive force in the global laptop market. 
]]></description><link>https://www.bitdefender.com/en-us/blog/businessinsights/arm-support-on-windows-for-bitdefender-solutions</link><guid isPermaLink="false">101101249208</guid><category><![CDATA[Ransomware]]></category><category><![CDATA[Endpoint Detection and Response]]></category><category><![CDATA[Advanced Persistent Threats]]></category><dc:creator>Bitdefender Enterprise</dc:creator><pubDate>Mon, 06 Feb 2023 09:44:59 GMT</pubDate><media:content url="https://businessresources.bitdefender.com/hubfs/ARM_CHIP_DAN.jpg" medium="image"/><content:encoded><![CDATA[Windows on ARM (WoA) goes back a long way, it is a growing hardware and application ecosystem with 2022 seeing significant momentum across the Windows on ARM ecosystem. Whether it’s an increasing number of new applications, developer kits and tools, or devices, WoA is gathering pace and looks set to become a disruptive force in the global laptop market. 
]]></content:encoded></item><item><title>GravityZone Excels in AV-Comparatives Business Security Test</title><description><![CDATA[Bitdefender Awarded Approved Business Product
AV-Comparatives has given their “Approved Business Product” award to Bitdefender GravityZone in their Business Security Test (August-November 2022). To achieve this award, products must score 90% or better in the Malware Protection Test while having zero false alarms, and 90% or higher in overall Real-World Protection Test, also with low false positives. This is the latest set of results from the ongoing Business Security Test which AV-Comparatives produces twice per year. 
]]></description><link>https://www.bitdefender.com/en-us/blog/businessinsights/gravityzone-excels-in-av-comparatives-business-security-test</link><guid isPermaLink="false">95505173111</guid><category><![CDATA[Ransomware]]></category><category><![CDATA[Advanced Persistent Threats]]></category><dc:creator>Bitdefender Enterprise</dc:creator><pubDate>Thu, 15 Dec 2022 19:56:25 GMT</pubDate><media:content url="https://businessresources.bitdefender.com/hubfs/AV_Comparatives%20-%20BizQ422.jpg" medium="image"/><content:encoded><![CDATA[Bitdefender Awarded Approved Business Product
AV-Comparatives has given their “Approved Business Product” award to Bitdefender GravityZone in their Business Security Test (August-November 2022). To achieve this award, products must score 90% or better in the Malware Protection Test while having zero false alarms, and 90% or higher in overall Real-World Protection Test, also with low false positives. This is the latest set of results from the ongoing Business Security Test which AV-Comparatives produces twice per year. 
]]></content:encoded></item><item><title>Deep Dive Into a BackdoorDiplomacy Attack – A Study of an Attacker’s Toolkit</title><description><![CDATA[A China-linked cyber espionage operation targeting multiple telecom providers in the Middle East was recently discovered by Bitdefender Labs. A wide range of tools were used for this operation, both open-source and custom-built. Download the full research paper: "Cyber-Espionage in the Middle East: Investigating a New BackdoorDiplomacy Threat Actor Campaign" if you want to dive deeper. We attribute this operation to BackdoorDiplomacy, a known advanced persistent threat group (APT). 
]]></description><link>https://www.bitdefender.com/en-us/blog/businessinsights/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit</link><guid isPermaLink="false">93307737896</guid><category><![CDATA[Threat Research]]></category><category><![CDATA[Advanced Persistent Threats]]></category><dc:creator>Martin Zugec</dc:creator><pubDate>Tue, 06 Dec 2022 14:00:28 GMT</pubDate><media:content url="https://businessresources.bitdefender.com/hubfs/BackDoor%20Attack_Martin.jpg" medium="image"/><content:encoded><![CDATA[A China-linked cyber espionage operation targeting multiple telecom providers in the Middle East was recently discovered by Bitdefender Labs. A wide range of tools were used for this operation, both open-source and custom-built. Download the full research paper: "Cyber-Espionage in the Middle East: Investigating a New BackdoorDiplomacy Threat Actor Campaign" if you want to dive deeper. We attribute this operation to BackdoorDiplomacy, a known advanced persistent threat group (APT). 
]]></content:encoded></item><item><title>Bitdefender Again Leads the AV-Comparatives Advanced Threat Protection Tests</title><description><![CDATA[In November of 2022, AV-Comparatives concluded their 2022 Advanced Threat Protection Test for enterprise cybersecurity.  The test simulates attack methods used by cybercriminals to gain control of an organization’s network. These advanced persistent threats (APTs) utilize fileless attacks that leverage popular scripting languages like JavaScript, PowerShell, Visual Basic, and more, to gain access to an organization’s internal computer systems. Fileless attacks are executed in memory by leveraging expected processes to avoid detection from traditional antivirus products.  These types of tactics are common in data extortion attacks perpetrated by cybercriminal organizations and state-sponsored cyber-espionage operations.  The tactics and techniques used in the test can be mapped to the MITRE ATT&CK framework.  
]]></description><link>https://www.bitdefender.com/en-us/blog/businessinsights/av-comparatives-crowns-bitdefender-strategic-leader-in-advanced-threat-protection-test</link><guid isPermaLink="false">92032918555</guid><category><![CDATA[Cybersecurity Awareness]]></category><category><![CDATA[Advanced Persistent Threats]]></category><dc:creator>Richard De La Torre</dc:creator><pubDate>Thu, 17 Nov 2022 16:59:50 GMT</pubDate><media:content url="https://businessresources.bitdefender.com/hubfs/AVComp%20APT_BD.jpg" medium="image"/><content:encoded><![CDATA[In November of 2022, AV-Comparatives concluded their 2022 Advanced Threat Protection Test for enterprise cybersecurity.  The test simulates attack methods used by cybercriminals to gain control of an organization’s network. These advanced persistent threats (APTs) utilize fileless attacks that leverage popular scripting languages like JavaScript, PowerShell, Visual Basic, and more, to gain access to an organization’s internal computer systems. Fileless attacks are executed in memory by leveraging expected processes to avoid detection from traditional antivirus products.  These types of tactics are common in data extortion attacks perpetrated by cybercriminal organizations and state-sponsored cyber-espionage operations.  The tactics and techniques used in the test can be mapped to the MITRE ATT&CK framework.  
]]></content:encoded></item><item><title>Effective Fraud Detection and Prevention with Threat Intelligence</title><description><![CDATA[Organizations have moved a considerable part of operations online to ease the purchase process for customers. It is much easier to have everything at hand online to make a purchase and have it delivered, instead of physically going somewhere, paying and picking it up. But this comes at a great security cost that many organizations still disregard.
]]></description><link>https://www.bitdefender.com/en-us/blog/businessinsights/effective-fraud-detection-and-prevention-with-threat-intelligence</link><guid isPermaLink="false">87529960106</guid><category><![CDATA[Advanced Persistent Threats]]></category><category><![CDATA[Threat Intelligence]]></category><dc:creator>Andrei Pisau</dc:creator><pubDate>Mon, 17 Oct 2022 09:18:46 GMT</pubDate><media:content url="https://businessresources.bitdefender.com/hubfs/Fraud%20Detection_Andrei-Pisau.jpg" medium="image"/><content:encoded><![CDATA[Organizations have moved a considerable part of operations online to ease the purchase process for customers. It is much easier to have everything at hand online to make a purchase and have it delivered, instead of physically going somewhere, paying and picking it up. But this comes at a great security cost that many organizations still disregard.
]]></content:encoded></item><item><title>How to Choose a Threat Intelligence Provider</title><description><![CDATA[Today’s cyber threats are causing more damage than ever. Cyberattacks inflicted the highest amount of monetary damage history last year, and the toll seems to be mounting this year as well. Enterprises around the world are falling victim to advanced attacks that specifically target vulnerabilities. As a result, companies implement numerous cybersecurity solutions to secure their networks.
]]></description><link>https://www.bitdefender.com/en-us/blog/businessinsights/how-to-choose-a-threat-intelligence-provider</link><guid isPermaLink="false">72776030809</guid><category><![CDATA[Cybersecurity Awareness]]></category><category><![CDATA[Advanced Persistent Threats]]></category><category><![CDATA[Threat Intelligence]]></category><dc:creator>Shanice Jones</dc:creator><pubDate>Tue, 24 May 2022 10:45:06 GMT</pubDate><media:content url="https://businessresources.bitdefender.com/hubfs/Threat%20Intelligence-4.jpg" medium="image"/><content:encoded><![CDATA[Today’s cyber threats are causing more damage than ever. Cyberattacks inflicted the highest amount of monetary damage history last year, and the toll seems to be mounting this year as well. Enterprises around the world are falling victim to advanced attacks that specifically target vulnerabilities. As a result, companies implement numerous cybersecurity solutions to secure their networks.
]]></content:encoded></item><item><title>EDR &amp; XDR – Security Solutions for Hybrid &amp; Remote SMB Ecosystems</title><description><![CDATA[Organizations, including small and midsized businesses (SMBs), should be on the lookout for any tools and techniques they can find to stop cyber criminals and other bad actors in their tracks. Endpoint detection and response (EDR) systems should be high on the list of possible solutions to consider.
]]></description><link>https://www.bitdefender.com/en-us/blog/businessinsights/edr-xdr-security-solutions-for-hybrid-remote-smb-ecosystems</link><guid isPermaLink="false">71322064569</guid><category><![CDATA[SMB Security]]></category><category><![CDATA[Endpoint Detection and Response]]></category><category><![CDATA[Advanced Persistent Threats]]></category><dc:creator>Bitdefender Enterprise</dc:creator><pubDate>Mon, 18 Apr 2022 13:12:21 GMT</pubDate><media:content url="https://businessresources.bitdefender.com/hubfs/XDR_Bob.jpg" medium="image"/><content:encoded><![CDATA[Organizations, including small and midsized businesses (SMBs), should be on the lookout for any tools and techniques they can find to stop cyber criminals and other bad actors in their tracks. Endpoint detection and response (EDR) systems should be high on the list of possible solutions to consider.
]]></content:encoded></item><item><title>How XDR can help protect against sophisticated threat actors</title><description><![CDATA[It’s not easy being a business these days. Organizations are under siege against automated attacks and more sophisticated attacks that specifically target their company and vulnerabilities. Malicious actors are using a mix of techniques that are making attacks more effective and harder to detect. They’re taking advantage of a more hostile environment that’s the result of organizational-wide shifts and a larger attack surface, putting organizations at risk.
]]></description><link>https://www.bitdefender.com/en-us/blog/businessinsights/how-xdr-can-help-protect-against-sophisticated-threat-actors</link><guid isPermaLink="false">66257160737</guid><category><![CDATA[Cybersecurity Awareness]]></category><category><![CDATA[Endpoint Detection and Response]]></category><category><![CDATA[Advanced Persistent Threats]]></category><dc:creator>Josue Ledesma</dc:creator><pubDate>Mon, 14 Mar 2022 09:54:29 GMT</pubDate><media:content url="https://businessresources.bitdefender.com/hubfs/XDR_Threat%20Actors_Josue.jpg" medium="image"/><content:encoded><![CDATA[It’s not easy being a business these days. Organizations are under siege against automated attacks and more sophisticated attacks that specifically target their company and vulnerabilities. Malicious actors are using a mix of techniques that are making attacks more effective and harder to detect. They’re taking advantage of a more hostile environment that’s the result of organizational-wide shifts and a larger attack surface, putting organizations at risk.
]]></content:encoded></item><item><title>Bitdefender Advanced Threat Intelligence Now Available Through the ThreatBlockr Platform</title><description><![CDATA[From technical specialists to team leaders and business architects, security experts today must cover many areas. These individuals need to monitor, research and analyze threats as they occur, protecting enterprise networks while helping them scale operationally as they achieve higher business goals. But most of all, security leaders need to be brilliant forecasters, constantly predicting shifts in a market that is growing in both complexity and vulnerability.
]]></description><link>https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-advanced-threat-intelligence-now-available-through-the-threatblockr-platform</link><guid isPermaLink="false">67198210649</guid><category><![CDATA[Enterprise Security]]></category><category><![CDATA[Advanced Persistent Threats]]></category><category><![CDATA[Threat Intelligence]]></category><dc:creator>Bitdefender Enterprise</dc:creator><pubDate>Mon, 07 Mar 2022 11:39:33 GMT</pubDate><media:content url="https://businessresources.bitdefender.com/hubfs/Threat%20Intelligence_2.png" medium="image"/><content:encoded><![CDATA[From technical specialists to team leaders and business architects, security experts today must cover many areas. These individuals need to monitor, research and analyze threats as they occur, protecting enterprise networks while helping them scale operationally as they achieve higher business goals. But most of all, security leaders need to be brilliant forecasters, constantly predicting shifts in a market that is growing in both complexity and vulnerability.
]]></content:encoded></item></channel>
        </rss>