Loading story…
Finland’s National Cyber Security Centre reported that February saw a continued surge in fraud and social engineering, including bank- and authority-impersonation scam calls, robocalls, high-quality phishing, and investment/crypto scams. The agency also noted that Microsoft 365 (M365) account compromises increased further, warning that stolen user accounts can enable follow-on abuse such as invoice fraud, CEO fraud (BEC), and large-scale secondary phishing sent from trusted, compromised mailboxes; it also cited multiple critical vulnerabilities in widely used software/services during the month, though impacts in Finland were described as limited.
Separately, Finland’s Security and Intelligence Service (SUPO) assessed that Russia and China continue extensive cyber-espionage and influence operations targeting Finland’s technology sector, research institutions, and government, describing cyber-espionage as the country’s most significant digital threat with no expectation of abatement. SUPO said foreign intelligence activity combines cyber intrusions with traditional espionage and political influence to collect sensitive information and shape decision-making, and pointed to prior high-profile incidents (e.g., the Vastaamo psychotherapy data breach and related extortion cases) as illustrative of the broader risk environment.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
16 events from the most recent confirmed update back to the earliest known activity.
Finland's Security and Intelligence Service and Traficom's National Cyber Security Centre announced a joint operation that disrupted Russian cyber espionage activity. The authorities warned that Russia exploits poorly secured home routers and other network devices as part of its espionage operations.
The Finnish National Cyber Security Centre's February cyber weather report said scams impersonating banks and authorities continued to increase, alongside further growth in Microsoft 365 account takeovers. It also noted multiple critical vulnerabilities in widely used software and services, though impacts in Finland remained limited.
Finland's Security and Intelligence Service released a national security assessment stating that Russia and China continue extensive cyber espionage and influence operations against Finland's government, research institutions, and technology sector. SUPO said cyber espionage remains Finland's most significant digital threat and is expected to persist long term.
Finnish authorities formally attributed the earlier intrusion into parliament IT systems to China-linked APT31, marking a key attribution development in the case.
On 2026-03-02, Finland's National Cyber Security Centre warned of a recent increase in fraudulent phone calls made in the names of banks. The callers claimed suspicious transfers or account anomalies to trick victims into revealing online banking credentials and confirmation codes, and Traficom advised people to hang up, contact their bank via official channels, and report incidents to police if data had been disclosed.
On 2025-11-27, Finland's National Cyber Security Centre said reported Microsoft 365 account compromise cases had declined and stabilized to roughly pre-warning levels, with monthly counts falling to about 70 in November after peaking at 125 in October. Based on the trend, Traficom removed its earlier warning while stressing that phishing and account takeover threats remain ongoing.
On 2025-09-09, Finland's National Cyber Security Centre said it had received 330 notifications in 2025 related to Microsoft 365 account compromises or phishing, describing the activity as a continuation of the campaign it had warned about in autumn 2023. The advisory said attackers were using phishing, including AiTM techniques, and abusing SharePoint or OneNote links, mailbox rules, and stolen session cookies to access email and files and enable follow-on fraud.
On 2025-02-26, Finland's National Cyber Security Centre said it had received several recent reports of fraudulent phone calls in which callers posed as representatives of the Cyber Security Centre. The notice warned that scammers were conducting phone fraud in the agency's name.
In its February 2024 cyber weather report, published on 2024-03-14, Traficom said Finland's threat environment remained notably active, with Microsoft 365 account compromises continuing through February. The agency also reported that a large number of Finnish organizations were targeted by denial-of-service attacks at the beginning of the month, alongside sustained hacktivist DDoS activity.
On 2023-10-20, Traficom published a serious warning about a wave of Microsoft 365 account breaches driven by phishing emails themed as secure mail messages. The autumn campaign sent thousands of phishing emails and led to hundreds of compromised accounts, with some attacks using adversary-in-the-middle techniques to bypass multi-factor authentication.
On 2023-04-28, Finland's National Cyber Security Centre warned that multiple Finnish organizations had again suffered Microsoft 365 account compromises through phishing emails disguised as secure mail notifications. The agency said municipalities and public administration were prominent among reported cases, and that compromised accounts were being used to send more phishing emails and attempt invoice fraud.
On 2023-04-21, Traficom's National Cyber Security Centre said Finland's cyber threat level had remained elevated and that reports of incidents were rising year by year. The agency said recent months had brought more targeted attacks against government administration and critical supply-security organizations, alongside more targeted ransomware activity and increased hacktivism.
On 2023-03-01, Finland's National Cyber Security Centre warned that aggressive phishing campaigns had led to breaches of many organizations' Microsoft 365 email accounts. The advisory said attackers used fake login pages to steal credentials, noted that MFA would have prevented many reported takeovers, and warned that compromised accounts were being abused for further phishing, invoice fraud, data theft, and possible ransomware follow-on activity.
Finland's accession to NATO increased the country's intelligence significance, contributing to heightened interest from foreign intelligence services according to SUPO's later assessment.
Finland's parliament experienced an intrusion into its IT systems. The incident was later cited by SUPO as a significant example of foreign cyber espionage targeting Finnish institutions.
A major breach hit Finnish psychotherapy provider Vastaamo, exposing sensitive patient data and becoming one of the notable cyber incidents later cited by Finnish authorities in national security assessments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
20 references tracked. Mallory keeps watching after this page renders.
kyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcetherecord.media
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourcekyberturvallisuuskeskus.fi
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Latvia’s National Security Service (SAB) reported that **2025 saw a record high in registered cyber threats** targeting the country, with **Russia** assessed as the primary source of cyber risk amid Latvia’s support for Ukraine. SAB said most activity was linked to cybercrime and digital fraud, but the most serious cases included **intrusion attempts, malware distribution, equipment compromise, and DDoS attacks**, and it warned that **operational technology (OT)** in energy, water, and transport often lacks sufficient protections. The agency also noted that Russian-linked hacktivist activity has shown willingness and capability to target industrial control systems for short-term disruption and intimidation, and that DDoS activity against government and critical services often aligns with politically sensitive events. In the UK, senior national security figures warned Parliament that resilience alone may be insufficient against **cyber and hybrid threats** (including sabotage and disinformation), arguing the country needs an **offensive deterrence** component to impose costs on hostile states rather than “absorbing” attacks. Separately, Check Point Research data cited by Dark Reading indicated **Latin America and the Caribbean** experienced the highest average weekly attack volume globally (3,065 attacks per week; **+26% YoY**), with prevalent activity including **information disclosure**, attempts at **remote code execution** and **authentication bypass**, and a shift toward **data-leak extortion**, credential theft, and **edge-device exploitation**; the report also projected continued ransomware growth, particularly affecting healthcare and manufacturing.
Jun 29, 2026
Finland’s National Cyber Security Centre warned that phishing messages are impersonating **OmaKanta**, **Kanta**, and **Suomi.fi** services to steal victims’ online banking credentials and personal identity data. The fraudulent messages have been distributed through **SMS, email, and search-engine results**, often using fluent Finnish, spoofed sender details, and fake websites made to resemble legitimate public-service portals such as `kanta.fi`. Some lures claim recipients must update their information before a deadline, report a technical problem in the Suomi.fi mobile application, or state that an account has been locked. Authorities said the campaign has also included requests for victims to submit photos of identity documents such as passports, driver’s licenses, national ID cards, or residence permits. The Digital and Population Data Services Agency separately warned about scam traffic abusing the **Suomi.fi** brand, while officials stressed that these services do **not** request sensitive information by text message or email. People who clicked links or submitted banking details were urged to contact their bank immediately, file a police report, monitor accounts and bills for misuse, and notify the National Cyber Security Centre.
Jun 29, 2026
Multiple reports highlight active campaigns using *phishing* and *software supply-chain abuse* to steal credentials and establish persistence. eSentire described an espionage-focused operation targeting residents of India with emails impersonating the Income Tax Department, leading victims to a malicious archive that uses DLL side-loading with a legitimate signed Microsoft application, extensive anti-analysis checks, in-memory shellcode unpacking, UAC bypass, and process masquerading; the payload was identified as a **Blackmoon**-family variant that specifically attempts to disable **Avast Free Antivirus** by automating UI interactions to add exclusions. Separately, Aikido reported a malicious npm package (`ansi-universal-ui`) that deploys a multi-stage infostealer (“**G_Wagon**”) by abusing `postinstall` execution, downloading a Python runtime, running an obfuscated payload, and exfiltrating browser credentials, cloud credentials, Discord tokens, and data from 100+ cryptocurrency wallets to an Appwrite storage bucket; it also includes a Windows DLL used for browser-process injection via NT native APIs. In parallel, network-edge exploitation remains a key access vector: Risky Business reported a renewed wave of attacks against **Fortinet FortiGate** devices via a vulnerability Fortinet allegedly “patched” in December but which attackers can still exploit, enabling SSO authentication bypass (via crafted SAML), creation of new admin accounts, and theft of device configuration; mitigations include disabling the FortiCloud SSO feature (not enabled by default). Several other items are general awareness or roundup content rather than specific incident reporting: TechTarget and other blogs emphasized ongoing phishing/email risk (including relay spam abusing legitimate Zendesk instances) and password hygiene, while The Hacker News published a multi-story bulletin that includes (among other items) a spear-phishing campaign in Afghanistan delivering a FALSECUB backdoor via a GitHub-hosted ISO and LNK execution chain; Risky Business also covered Iran’s internet blackout and Starlink jamming/spoofing as a communications-control issue rather than an enterprise cyber incident.
Jun 29, 2026