{"id":32984,"date":"2025-12-31T01:57:40","date_gmt":"2025-12-31T01:57:40","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=32984"},"modified":"2026-04-17T18:07:34","modified_gmt":"2026-04-17T18:07:34","slug":"nsfocus-monthly-apt-insights-november-2025","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/nsfocus-monthly-apt-insights-november-2025\/","title":{"rendered":"NSFOCUS Monthly APT Insights \u2013 November 2025"},"content":{"rendered":"<!DOCTYPE html PUBLIC \"-\/\/W3C\/\/DTD HTML 4.0 Transitional\/\/EN\" \"http:\/\/www.w3.org\/TR\/REC-html40\/loose.dtd\">\n<html><body><h2 class=\"wp-block-heading\">Regional APT Threat Situation<\/h2>\n\n\n\n<p>In November 2025, the global threat hunting system of Fuying Lab detected a total of 28 APT attack activities. These activities were primarily concentrated in regions including South Asia and East Asia, with a smaller portion also found in Eastern Europe and Middle East. Some organizations remain unattributed to known APT groups, as shown in the figure below.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><a href=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2025\/12\/aptnov1.png\"><img fetchpriority=\"high\" decoding=\"async\" src=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2025\/12\/aptnov1-1024x687.png\" alt=\"Red circular no entry sign with a white horizontal bar.\" class=\"wp-image-32985\" width=\"768\" height=\"515\"><\/a><\/figure>\n<\/div>\n\n\n<p>Regarding the activity levels of different groups, the most active APT groups in this month were Sidewinder and APT36 from South Asia, while other relatively active groups included Gamaredon from Eastern Europe, and MuddyWater from Middle East. Other active groups also include Kimsuky and Konni from East Asia.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><a href=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2025\/12\/aptnov2.png\"><img decoding=\"async\" src=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2025\/12\/aptnov2-1024x706.png\" alt=\"Red circular no entry sign with a white horizontal bar.\" class=\"wp-image-32987\" width=\"768\" height=\"530\"><\/a><\/figure>\n<\/div>\n\n\n<p>The most prevalent intrusion method in this month&#8217;s incidents was spear-phishing email attacks, accounting for 78% of all attack events. A small number of threat actors also utilized vulnerability exploitations (11%) for infiltration and watering hole attacks (7%).<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><a href=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2025\/12\/aptnov3.png\"><img decoding=\"async\" src=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2025\/12\/aptnov3-1024x540.png\" alt=\"Red circular no entry sign with a white horizontal bar.\" class=\"wp-image-32989\" width=\"768\" height=\"405\" srcset=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2025\/12\/aptnov3-1024x540.png 1024w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2025\/12\/aptnov3-300x158.png 300w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2025\/12\/aptnov3-768x405.png 768w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2025\/12\/aptnov3-1536x810.png 1536w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2025\/12\/aptnov3-600x316.png 600w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2025\/12\/aptnov3-150x79.png 150w, https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2025\/12\/aptnov3.png 1886w\" sizes=\"(max-width: 768px) 100vw, 768px\" \/><\/a><\/figure>\n<\/div>\n\n\n<p>In November 2025, the primary target industries for APT groups were government agencies, accounting for 32%, followed by military institutions accounting for 29%. Other attack targets included organizations or individuals, financial institutions, and research institutions.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large is-resized\"><a href=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2025\/12\/aptnov4.png\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2025\/12\/aptnov4-1024x647.png\" alt=\"Red circular no entry sign with a white horizontal bar.\" class=\"wp-image-32991\" width=\"768\" height=\"485\"><\/a><\/figure>\n<\/div>\n\n\n<p><strong>South Asia<\/strong><\/p>\n\n\n\n<p>In November 2025, APT activities in South Asia were primarily initiated by known APT groups, with victims including Indian government departments, Indian military institutions, Indian organizations or individuals, government departments and military institutions in Pakistan and Bangladesh, the Sri Lankan navy, and the Azerbaijani government. In terms of attack tactics, the APT activities in South Asia this month mainly relied on spear-phishing email attacks. A typical decoy involved a phishing email targeting the Indian Ministry of Defense.<\/p>\n\n\n\n<p class=\"has-luminous-vivid-amber-background-color has-background\"><strong><a href=\"https:\/\/nsfocusglobal.com\/company-overview\/contact-us\/\">Subscribe<\/a>&Acirc;&nbsp;NSFOCUS&Acirc;&nbsp;Threat&Acirc;&nbsp;Intelligence&Acirc;&nbsp;for&Acirc;&nbsp;full&Acirc;&nbsp;details&Acirc;&nbsp;of&Acirc;&nbsp;APT&Acirc;&nbsp;incident insights.<\/strong><\/p>\n\n\n\n<p><strong>East Asia<\/strong><\/p>\n\n\n\n<p>In November 2025, APT activities in East Asia were primarily initiated by known APT groups, with victims including South Korean government departments, financial institutions, and research institutions.<\/p>\n\n\n\n<p>In terms of attack tactics, APT activities in East Asia this month mainly relied on spear-phishing email attacks, with some groups also employing watering hole attacks. Regarding spear-phishing attacks, a typical decoy involved reports on specific financial transactions or related legal documents. Attackers sent phishing emails containing alerts about transaction anomalies, luring targets to click.<\/p>\n\n\n\n<p class=\"has-luminous-vivid-amber-background-color has-background\"><strong><a href=\"https:\/\/nsfocusglobal.com\/company-overview\/contact-us\/\">Subscribe<\/a>&Acirc;&nbsp;NSFOCUS&Acirc;&nbsp;Threat&Acirc;&nbsp;Intelligence&Acirc;&nbsp;for&Acirc;&nbsp;full&Acirc;&nbsp;details&Acirc;&nbsp;of&Acirc;&nbsp;APT&Acirc;&nbsp;incident insights.<\/strong><\/p>\n\n\n\n<p><strong>Eastern Europe<\/strong><\/p>\n\n\n\n<p>In November 2025, APT activities in Eastern Europe were primarily initiated by known APT groups, with victims including the Ukrainian State Anti-Corruption Bureau and Ukrainian military institutions. In terms of attack tactics, APT activities in Eastern Europe this month mainly relied on spear-phishing email attacks. A typical decoy involved Ukrainian government documents.<\/p>\n\n\n\n<p class=\"has-luminous-vivid-amber-background-color has-background\"><strong><a href=\"https:\/\/nsfocusglobal.com\/company-overview\/contact-us\/\">Subscribe<\/a>&Acirc;&nbsp;NSFOCUS&Acirc;&nbsp;Threat&Acirc;&nbsp;Intelligence&Acirc;&nbsp;for&Acirc;&nbsp;full&Acirc;&nbsp;details&Acirc;&nbsp;of&Acirc;&nbsp;APT&Acirc;&nbsp;incident insights.<\/strong><\/p>\n\n\n\n<p><strong>Middle East<\/strong><\/p>\n\n\n\n<p>In November 2025, APT activities in the Middle East were primarily initiated by known APT groups, with victims including Israeli organizations or individuals and Middle Eastern research institutions. In terms of attack tactics, APT activities in the Middle East this month mainly relied on spear-phishing email attacks.<\/p>\n\n\n\n<p class=\"has-luminous-vivid-amber-background-color has-background\"><strong><a href=\"https:\/\/nsfocusglobal.com\/company-overview\/contact-us\/\">Subscribe<\/a>&Acirc;&nbsp;NSFOCUS&Acirc;&nbsp;Threat&Acirc;&nbsp;Intelligence&Acirc;&nbsp;for&Acirc;&nbsp;full&Acirc;&nbsp;details&Acirc;&nbsp;of&Acirc;&nbsp;APT&Acirc;&nbsp;incident insights.<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Global Key APT Events<\/h2>\n\n\n\n<figure class=\"wp-block-table is-style-stripes\"><table><thead><tr><th><strong>Event Name<\/strong><\/th><th><strong>Related Groups<\/strong><\/th><\/tr><\/thead><tbody><tr><td>Network Attack Campaign by an Unknown APT Group Leveraging the OpenAI Interface<\/td><td>SesameOp<\/td><\/tr><tr><td>Indian APT Group Bitter&#8217;s Network Attack Campaign Utilizing the WinRAR Vulnerability CVE-2025-6218<\/td><td>BITTER<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"has-luminous-vivid-amber-background-color has-background\"><strong><a href=\"https:\/\/nsfocusglobal.com\/company-overview\/contact-us\/\">Subscribe<\/a>&Acirc;&nbsp;NSFOCUS&Acirc;&nbsp;Threat&Acirc;&nbsp;Intelligence&Acirc;&nbsp;for&Acirc;&nbsp;full&Acirc;&nbsp;details&Acirc;&nbsp;of&Acirc;&nbsp;APT&Acirc;&nbsp;incident insights.<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Interpretation of Key APT Events<\/h2>\n\n\n\n<p><strong>Unknown APT Group Leveraging OpenAI Interface in Cyber Attack Campaign<\/strong><\/p>\n\n\n\n<p>In July 2025, an unknown attack group planned and launched a deep penetration attack against a specific target environment. The new backdoor program disclosed in this incident was named &#8221; SesameOp &#8220;. The attackers used a special injection technique and a communication mode that exploited the OpenAI interface in this attack operation, with the main purpose of conducting long-term cyber espionage activities.<\/p>\n\n\n\n<p>The most notable feature of SesameOp in this incident is the abuse of the OpenAI Assistants API as its C2 channel. This method of using legitimate AI infrastructure for communication is extremely rare in previous attacks. This report will focus on analyzing the principle of how this backdoor injects through the XXX via the OpenAI API.<\/p>\n\n\n\n<p>The abuse of the OpenAI interface by XXX is essentially an attack technique that uses cloud services such as C2. This technology has been developed for many years, and APT groups or hacker groups have previously used cloud services such as Pastebin, OneDrive, Mega, and Dropbox to transmit C2 instructions. This kind of abuse of cloud services usually requires a key bound to the attacker&#8217;s account. After the Trojan program enters the personal space of the account through the key, it extracts the encrypted attack instructions from it. The operation of SesameOp this time also follows this process.<\/p>\n\n\n\n<p class=\"has-luminous-vivid-amber-background-color has-background\"><strong><a href=\"https:\/\/nsfocusglobal.com\/company-overview\/contact-us\/\">Subscribe<\/a>&Acirc;&nbsp;NSFOCUS&Acirc;&nbsp;Threat&Acirc;&nbsp;Intelligence&Acirc;&nbsp;for&Acirc;&nbsp;full&Acirc;&nbsp;details&Acirc;&nbsp;of&Acirc;&nbsp;APT&Acirc;&nbsp;incident insights.<\/strong><\/p>\n\n\n\n<p><strong>The Cyber-attack Operation by the Indian APT Group BITTER Exploiting the WinRAR Vulnerability CVE-2025-6218<\/strong><\/p>\n\n\n\n<p>The India-based APT group BITTER carried out a phishing campaign targeting Pakistan and the Kashmir region in November 2025. In this operation, it first employed the WinRAR zero-day vulnerability CVE-2025-6218, which emerged in June 2025, as the initial payload. This is the first known instance of an APT group using this vulnerability.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong>Group Name<\/strong><\/td><td>BITTER<\/td><\/tr><tr><td><strong>Appear Time<\/strong><\/td><td>2013<\/td><\/tr><tr><td><strong>Attack Target<\/strong><\/td><td>Bangladesh, China, India &acirc;&euro;&brvbar;&acirc;&euro;&brvbar;<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>CVE-2025-6218 is a WinRAR path traversal vulnerability. By constructing a relative path and using the &#8220;..\\&#8221; character along with a special construction method, it triggers path traversal, allowing files to be extracted to a specified path to achieve the effect of automatic execution.<\/p>\n\n\n\n<p class=\"has-luminous-vivid-amber-background-color has-background\"><strong><a href=\"https:\/\/nsfocusglobal.com\/company-overview\/contact-us\/\">Subscribe<\/a>&Acirc;&nbsp;NSFOCUS&Acirc;&nbsp;Threat&Acirc;&nbsp;Intelligence&Acirc;&nbsp;for&Acirc;&nbsp;full&Acirc;&nbsp;details&Acirc;&nbsp;of&Acirc;&nbsp;APT&Acirc;&nbsp;incident insights.<\/strong><\/p>\n<\/body><\/html>\n","protected":false},"excerpt":{"rendered":"<p>Regional APT Threat Situation In November 2025, the global threat hunting system of Fuying Lab detected a total of 28 APT attack activities. These activities were primarily concentrated in regions including South Asia and East Asia, with a smaller portion also found in Eastern Europe and Middle East. Some organizations remain unattributed to known APT [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":21929,"comment_status":"open","ping_status":"open","sticky":false,"template":"post-templates\/single-layout-8.php","format":"standard","meta":{"_acf_changed":false,"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","footnotes":""},"categories":[3],"tags":[93,94,693],"class_list":["post-32984","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-apt","tag-apt-group","tag-threat-intelligence"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>NSFOCUS Monthly APT Insights \u2013 November 2025 - NSFOCUS<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/nsfocusglobal.com\/nsfocus-monthly-apt-insights-november-2025\/\" \/>\n<meta property=\"og:locale\" content=\"pt_BR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"NSFOCUS Monthly APT Insights \u2013 November 2025 - NSFOCUS\" \/>\n<meta property=\"og:description\" content=\"Regional APT Threat Situation In November 2025, the global threat hunting system of Fuying Lab detected a total of 28 APT attack activities. These\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nsfocusglobal.com\/nsfocus-monthly-apt-insights-november-2025\/\" \/>\n<meta property=\"og:site_name\" content=\"NSFOCUS\" \/>\n<meta property=\"article:published_time\" content=\"2025-12-31T01:57:40+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-04-17T18:07:34+00:00\" \/>\n<meta name=\"author\" content=\"NSFOCUS\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:title\" content=\"NSFOCUS Monthly APT Insights \u2013 November 2025 - NSFOCUS\" \/>\n<meta name=\"twitter:description\" content=\"Regional APT Threat Situation In November 2025, the global threat hunting system of Fuying Lab detected a total of 28 APT attack activities. These\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"NSFOCUS\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. tempo de leitura\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/nsfocus-monthly-apt-insights-november-2025\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/nsfocus-monthly-apt-insights-november-2025\\\/\"},\"author\":{\"name\":\"NSFOCUS\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/person\\\/fd9ab61c9c77a81bbd870f725cc0c61d\"},\"headline\":\"NSFOCUS Monthly APT Insights \u2013 November 2025\",\"datePublished\":\"2025-12-31T01:57:40+00:00\",\"dateModified\":\"2026-04-17T18:07:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/nsfocus-monthly-apt-insights-november-2025\\\/\"},\"wordCount\":1036,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/nsfocus-monthly-apt-insights-november-2025\\\/#primaryimage\"},\"thumbnailUrl\":\"\",\"keywords\":[\"APT\",\"APT Group;\",\"threat intelligence\"],\"articleSection\":[\"Blog\"],\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/nsfocus-monthly-apt-insights-november-2025\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/nsfocus-monthly-apt-insights-november-2025\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/nsfocus-monthly-apt-insights-november-2025\\\/\",\"name\":\"NSFOCUS Monthly APT Insights \u2013 November 2025 - NSFOCUS\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/nsfocus-monthly-apt-insights-november-2025\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/nsfocus-monthly-apt-insights-november-2025\\\/#primaryimage\"},\"thumbnailUrl\":\"\",\"datePublished\":\"2025-12-31T01:57:40+00:00\",\"dateModified\":\"2026-04-17T18:07:34+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/nsfocus-monthly-apt-insights-november-2025\\\/#breadcrumb\"},\"inLanguage\":\"pt-BR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/nsfocusglobal.com\\\/nsfocus-monthly-apt-insights-november-2025\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/nsfocus-monthly-apt-insights-november-2025\\\/#primaryimage\",\"url\":\"\",\"contentUrl\":\"\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/nsfocus-monthly-apt-insights-november-2025\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/nsfocusglobal.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"NSFOCUS Monthly APT Insights \u2013 November 2025\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#website\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/\",\"name\":\"NSFOCUS\",\"description\":\"Security Made Smart and Simple\",\"publisher\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/nsfocusglobal.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"pt-BR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#organization\",\"name\":\"NSFOCUS\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"contentUrl\":\"https:\\\/\\\/nsfocusglobal.com\\\/wp-content\\\/uploads\\\/2024\\\/08\\\/logo-ns.png\",\"width\":248,\"height\":36,\"caption\":\"NSFOCUS\"},\"image\":{\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/nsfocusglobal.com\\\/#\\\/schema\\\/person\\\/fd9ab61c9c77a81bbd870f725cc0c61d\",\"name\":\"NSFOCUS\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pt-BR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g\",\"caption\":\"NSFOCUS\"},\"sameAs\":[\"https:\\\/\\\/nsfocusglobal.com\"],\"url\":\"https:\\\/\\\/nsfocusglobal.com\\\/pt-br\\\/author\\\/admin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"NSFOCUS Monthly APT Insights \u2013 November 2025 - NSFOCUS","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/nsfocusglobal.com\/nsfocus-monthly-apt-insights-november-2025\/","og_locale":"pt_BR","og_type":"article","og_title":"NSFOCUS Monthly APT Insights \u2013 November 2025 - NSFOCUS","og_description":"Regional APT Threat Situation In November 2025, the global threat hunting system of Fuying Lab detected a total of 28 APT attack activities. These","og_url":"https:\/\/nsfocusglobal.com\/nsfocus-monthly-apt-insights-november-2025\/","og_site_name":"NSFOCUS","article_published_time":"2025-12-31T01:57:40+00:00","article_modified_time":"2026-04-17T18:07:34+00:00","author":"NSFOCUS","twitter_card":"summary_large_image","twitter_title":"NSFOCUS Monthly APT Insights \u2013 November 2025 - NSFOCUS","twitter_description":"Regional APT Threat Situation In November 2025, the global threat hunting system of Fuying Lab detected a total of 28 APT attack activities. These","twitter_misc":{"Escrito por":"NSFOCUS","Est. tempo de leitura":"5 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/nsfocusglobal.com\/nsfocus-monthly-apt-insights-november-2025\/#article","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/nsfocus-monthly-apt-insights-november-2025\/"},"author":{"name":"NSFOCUS","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/person\/fd9ab61c9c77a81bbd870f725cc0c61d"},"headline":"NSFOCUS Monthly APT Insights \u2013 November 2025","datePublished":"2025-12-31T01:57:40+00:00","dateModified":"2026-04-17T18:07:34+00:00","mainEntityOfPage":{"@id":"https:\/\/nsfocusglobal.com\/nsfocus-monthly-apt-insights-november-2025\/"},"wordCount":1036,"commentCount":0,"publisher":{"@id":"https:\/\/nsfocusglobal.com\/#organization"},"image":{"@id":"https:\/\/nsfocusglobal.com\/nsfocus-monthly-apt-insights-november-2025\/#primaryimage"},"thumbnailUrl":"","keywords":["APT","APT Group;","threat intelligence"],"articleSection":["Blog"],"inLanguage":"pt-BR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/nsfocusglobal.com\/nsfocus-monthly-apt-insights-november-2025\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/nsfocusglobal.com\/nsfocus-monthly-apt-insights-november-2025\/","url":"https:\/\/nsfocusglobal.com\/nsfocus-monthly-apt-insights-november-2025\/","name":"NSFOCUS Monthly APT Insights \u2013 November 2025 - NSFOCUS","isPartOf":{"@id":"https:\/\/nsfocusglobal.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/nsfocusglobal.com\/nsfocus-monthly-apt-insights-november-2025\/#primaryimage"},"image":{"@id":"https:\/\/nsfocusglobal.com\/nsfocus-monthly-apt-insights-november-2025\/#primaryimage"},"thumbnailUrl":"","datePublished":"2025-12-31T01:57:40+00:00","dateModified":"2026-04-17T18:07:34+00:00","breadcrumb":{"@id":"https:\/\/nsfocusglobal.com\/nsfocus-monthly-apt-insights-november-2025\/#breadcrumb"},"inLanguage":"pt-BR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nsfocusglobal.com\/nsfocus-monthly-apt-insights-november-2025\/"]}]},{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/nsfocus-monthly-apt-insights-november-2025\/#primaryimage","url":"","contentUrl":""},{"@type":"BreadcrumbList","@id":"https:\/\/nsfocusglobal.com\/nsfocus-monthly-apt-insights-november-2025\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/nsfocusglobal.com\/"},{"@type":"ListItem","position":2,"name":"NSFOCUS Monthly APT Insights \u2013 November 2025"}]},{"@type":"WebSite","@id":"https:\/\/nsfocusglobal.com\/#website","url":"https:\/\/nsfocusglobal.com\/","name":"NSFOCUS","description":"Security Made Smart and Simple","publisher":{"@id":"https:\/\/nsfocusglobal.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nsfocusglobal.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"pt-BR"},{"@type":"Organization","@id":"https:\/\/nsfocusglobal.com\/#organization","name":"NSFOCUS","url":"https:\/\/nsfocusglobal.com\/","logo":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/logo\/image\/","url":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","contentUrl":"https:\/\/nsfocusglobal.com\/wp-content\/uploads\/2024\/08\/logo-ns.png","width":248,"height":36,"caption":"NSFOCUS"},"image":{"@id":"https:\/\/nsfocusglobal.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/nsfocusglobal.com\/#\/schema\/person\/fd9ab61c9c77a81bbd870f725cc0c61d","name":"NSFOCUS","image":{"@type":"ImageObject","inLanguage":"pt-BR","@id":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d3dc987908fc59791d261b1006d84eb931d15287261476b9384e690ed0c568de?s=96&d=mm&r=g","caption":"NSFOCUS"},"sameAs":["https:\/\/nsfocusglobal.com"],"url":"https:\/\/nsfocusglobal.com\/pt-br\/author\/admin\/"}]}},"_links":{"self":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/32984","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/comments?post=32984"}],"version-history":[{"count":1,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/32984\/revisions"}],"predecessor-version":[{"id":34920,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/posts\/32984\/revisions\/34920"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/"}],"wp:attachment":[{"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/media?parent=32984"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/categories?post=32984"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nsfocusglobal.com\/pt-br\/wp-json\/wp\/v2\/tags?post=32984"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}