Threadlinqs IntelligenceStart free

Threat actorSerbiaTracked since 2026-07

Night Tsunami

Also known as:NSO Group tooling

As of 2026-10-19, Night Tsunami is a Serbia-nexus threat actor tracked by Threadlinqs Intelligence across 4 threats spanning malware, threat intel. Also known as NSO Group tooling. ATT&CK coverage spans 33 techniques across 12 tactics in 4 of 4 tracked threats. Most-observed techniques: T1660 (Phishing), T1664 (Exploitation for Initial Access), T1409 (Stored Application Data).

Tracked threats
42 high · 1 medium
First seen
2026-07-28
Last seen
2026-10-19
ATT&CK techniques
33across 4 of 4 threats
Related CVEs
4Referenced by its activity
Attribution
SerbiaNation or origin
Nation: Serbia · 4 tracked threat(s) · Categories: MALWARE, THREAT_INTEL

Activity timeline

Night Tsunami appears in 4 tracked threats between and ; the busiest month was 2026-10 with 3 reports.

ATT&CK techniques observed

33 techniques observed across 4 of 4 tracked threats · Collection (Mobile) (11), Discovery (Mobile) (6), Initial Access (Mobile) (4), Resource Development (3), Persistence (Mobile) (2), Command and Control (1)
  • T1660 Phishing — Initial Access (Mobile)observed in 3 of 4 tracked threats
  • T1664 Exploitation for Initial Access — Initial Access (Mobile)observed in 3 of 4 tracked threats
  • T1409 Stored Application Data — Collection (Mobile)observed in 2 of 4 tracked threats
  • T1429 Audio Capture — Collection (Mobile)observed in 2 of 4 tracked threats
  • T1512 Video Capture — Collection (Mobile)observed in 2 of 4 tracked threats
  • T1636 Protected User Data — Collection (Mobile)observed in 2 of 4 tracked threats
  • T1646 Exfiltration Over C2 Channel — Exfiltration (Mobile)observed in 2 of 4 tracked threats
  • T1658 Exploitation for Client Execution — Execution (Mobile)observed in 2 of 4 tracked threats
  • T1090.003 Multi-hop Proxy — Command and Controlobserved in 1 of 4 tracked threats
  • T1204.001 Malicious Link — Executionobserved in 1 of 4 tracked threats
  • T1404 Exploitation for Privilege Escalation — Privilege Escalation (Mobile)observed in 1 of 4 tracked threats
  • T1418 Software Discovery — Discovery (Mobile)observed in 1 of 4 tracked threats
  • T1421 System Network Connections Discovery — Discovery (Mobile)observed in 1 of 4 tracked threats
  • T1422 System Network Configuration Discovery — Discovery (Mobile)observed in 1 of 4 tracked threats
  • T1422.001 Internet Connection Discovery — Discovery (Mobile)observed in 1 of 4 tracked threats

Tracked threats

Related CVEs

4 CVEs referenced by tracked Night Tsunami activity