State cyber operations

Assessment

Anthropic's Sept 11 threat report describes GTG-20006, an actor whose attribution is consistent with Russia's Midnight Blizzard, automating phishing, malware development and detection evasion in a machine-speed loop against more than 20 organisations, mostly Ukrainian government, military and diplomatic entities, and hijacking DNS records at three hotel Wi-Fi providers to stage malware on guests' devices. Turkish officials said on Sept 9 that at least three ministers' phones were examined and replaced after Apple mercenary-spyware notifications sent on Aug 13, with no attribution offered. The China-aligned APT31 first deployed the BlueMoon exploit kit, chaining Windows and Chrome vulnerabilities, on Aug 28, and other suspected China-nexus clusters adopted it within days, while Iranian-affiliated actors widened targeting of internet-exposed control systems at US water, energy and telecommunications providers into early September under a CISA advisory first published Apr 7. Salt Typhoon's telecom compromise remains unresolved and no new state-attributed operation was disclosed on Sept 14 or Sept 15, ahead of the Sept 18-20 Duma vote and the Nov 3 US midterms.