Several nation-state threat actors have returned to action this week. They're back in familiar but upgraded forms.

North Korea's Lazarus Group is back, hitting financial institutions in Asia and Latin America. They're making improved use of backdoors. As usual with the Lazarus Group, the motive is financial (TrendLabs).

The Pterado backdoor campaign reported by Ukrainian authorities is now being attributed by observers to Russia, but that attribution remains preliminary and circumstantial. They associate Pterado with the Gamaredon threat group, widely believed to be a unit of Russia's FSB (Ars Technica).

Coincidentally or not, the newly reawakened Cozy Bear, also generally regarded as an FSB (or possibly SVR) unit, has deployed improved phishing techniques against US targets (WIRED).

And another Russian threat group, the Hades APT, is also back. Hades was responsible for the Olympic Destroyer wiper campaign that targeted the South Korean-hosted Winter Olympic Games. It's added anti-analysis and delayed execution as well as a single-stage dropper, which suggests that Hades is learning from and reacting to the measures used against it earlier n 2018 (Check Point).

Since November 12th, an unknown (but believed to be foreign) group has been attacking certified email accounts in Italy. Both the government and the private sector have been affected, with courts particularly disrupted (Reuters).

HackRead reports that both Facebook and Instagram are suffering widespread outages. This is the second significant outage in as many days: yesterday it was Messenger (Forbes). They're working on it: at this point the outages seem to be accidents.