The Good | Authorities Arrest 34 in Black Axe Cyber Fraud Crackdown

Spanish police have arrested 34 suspects tied to a cyber fraud network allegedly linked to the Black Axe group, following a joint operation with Europol. After raids across four cities, authorities seized €66,400 in cash, vehicles, devices, and froze €119,350 held in bank accounts.

Investigators say the Nigeria-led ring ran man-in-the-middle (MitM) and business email compromise (BEC) scams, causing over $6 million in losses total. So far, four suspected leaders of the network have been jailed pre-trial as the probe continues into Europe-wide money mule networks.

In other news this week, the latest iteration of BreachForums has suffered another data breach after a MyBB users database was leaked online. This occurred after a site named after the ShinyHunters extortion gang released a 7Zip archive exposing over 323,000 user records and the forum’s PGP private key. While most IP addresses mapped to local loopback values, more than 70,000 resolved to public addresses valuable to cybersecurity researchers and law enforcement.

In Amsterdam, the nation’s Court of Appeal has sentenced a Dutch national to seven years for computer hacking and attempted extortion with evidence stemming from Sky ECC, an end-to-end encrypted chat service that Europol dismantled in 2021. Though one cocaine import charge was dropped, judges upheld the convictions tied to hacking port logistics systems in Rotterdam, Barendrecht, and Antwerp.

The individual was found using malware-laced USB sticks, which then enabled covert drug imports, data theft, and malware re-sale between 2020 and 2021.

The Bad | Researchers Expose ‘Reprompt’ Attack That Could Hijack Microsoft Copilot Sessions

Security researchers have disclosed a novel attack technique dubbed ‘Reprompt’ that could enable attackers to silently hijack a user’s Microsoft Copilot session and exfiltrate sensitive data with a single click. The method abuses how Copilot processes URL parameters, enabling malicious prompts to be injected directly through a legitimate Copilot link.

Reprompt works by embedding hidden instructions in the “q” parameter of a Copilot URL. Should a victim click the link, Copilot automatically executes the malicious prompt within the user’s authenticated session. That session remains active even after the Copilot tab is closed, meaning attackers could continue issuing follow-up commands without further user interaction. Since no plugins, malware, or visible prompts are required, the activity is effectively invisible.

To bypass Copilot’s safeguards, the researchers combined three techniques: parameter-to-prompt (P2) injection, a double-request trick that exploits guardrails applying only to the initial request, and a chain-request model where Copilot dynamically fetches new instructions from an attacker-controlled server.

Combined, these techniques could enable continuous, stealthy data exfiltration, while client-side, legacy security tools would be unable to determine what information was being stolen.

Reprompt only impacts Copilot Personal; those using Microsoft 365 Copilot are not impacted due to additional controls such as auditing, DLP, and administrative restrictions. Varonis disclosed the issue to Microsoft on August 31, 2025 and the vulnerability was addressed in this month’s Patch Tuesday. Currently, there are no reports of in-the-wild exploitation.

The findings, however, are indicative of the risks posed by LLMs and AI assistants. They underscore the need for security teams to understand the attack surface these tools present as their use in enterprise environments continues to proliferate.

The Ugly | Charity-Themed ‘PluggyApe’ Malware Targets Ukrainian Defense Forces

Ukraine’s CERT-UA has reported a charity-themed cyber espionage campaign targeting officials within the country’s Defense Forces between October and December 2025. The activity is attributed with medium confidence to a Russian-aligned threat group tracked as Laundry Bear (aka Void Blizzard or UAC‑0190), a cluster previously linked to the 2024 breach of Dutch police systems.

These attacks have been observed relying heavily on tailored social engineering tactics delivered via Signal and WhatsApp. Targets receive instant messages, often from compromised or spoofed Ukrainian phone numbers, directing them to fake charity websites where they are urged to download password-protected archives.

These archives contain malicious executables disguised as documents, including PIF files built with PyInstaller, which ultimately deploys a Python-based backdoor called ‘PluggyApe’. Once installed, PluggyApe profiles the infected system, assigns a unique victim identifier, and establishes persistence through Windows Registry changes. The malware supports remote command execution and data exfiltration, communicating over WebSocket or MQTT.

Later versions of PluggyApe, observed from December 2025 onward, introduced stronger obfuscation, additional anti-analysis checks, and more resilient command-and-control (C2) mechanisms. Instead of hardcoding C2 infrastructure, the malware dynamically retrieves server addresses from public paste services such as rentry[.]co and pastebin[.com], encoded in Base64, allowing operators to rapidly rotate infrastructure.

CERT-UA emphasized that mobile devices and messaging platforms have become primary attack vectors due to weaker monitoring and widespread trust. Compounding this is the attackers’ demonstrated knowledge of their targets and use of the Ukrainian language, audio, and video communication to increase credibility.

Alongside this campaign, CERT-UA also reports additional activity from other threat clusters targeting Ukrainian defense forces, local governments, and educational institutions using phishing, stealer malware, and open-source backdoors – all pointing to sustained and evolving cyber pressure facing Ukraine’s public sector.

The Good | U.K. Government Resets Public-Sector Cybersecurity With £210M Action Plan

The United Kingdom has unveiled a sweeping reset of its public-sector cybersecurity strategy, committing more than £210 million ($283 million) to shore up defenses across government departments and essential services. This investment is part of the new Government Cyber Action Plan, which marks a clear departure from years of fragmented oversight and outdated, legacy technology.

The new Government Cyber Action Plan sets a clear path to strengthen cyber security and boost resilience across the public sector.

Read more below https://t.co/HCswSOGuhP

— NCSC UK (@NCSC) January 6, 2026

The core of the plan is a centralized Government Cyber Unit, tasked with coordinating risk management, setting mandatory security standards, and leading incident response. Digital Government Minister Ian Murray framed the shift as urgent, warning that cyberattacks can take critical public services offline within minutes. Recent incidents like ransomware-driven NHS disruptions and the compromise of Ministry of Defence payroll systems all show that these risks are recurring realities rather than theoretical threats.

The action plan introduces stricter accountability for senior leaders, enhanced visibility into cyber risks, and more robust, centrally coordinated incident response exercises. Strategic government suppliers will also face tougher contractual cybersecurity requirements as concerns over supply chain vulnerabilities grow.

In tandem with the plan, the government is advancing the Cyber Security and Resilience Bill, which builds on the 2018 Network and Information System (NIS) Regulations. Separately, public bodies and critical infrastructure operators are set to be banned from paying ransomware demands, while telecom providers have pledged to curb phone-number spoofing.

While challenges still remain, this new strategy signals a long-overdue cultural and structural shift. If matched with sustained investment and accountability, it could finally place the U.K. public sector on a more resilient and security-first footing in the face of accelerating cyber threats.

The Bad | China-Linked UAT-7290 Expands Linux-Based Espionage Beyond South Asian Telcos

UAT-7290, a China-linked threat actor, has expanded its cyber espionage operations beyond its focus on South Asian telecommunications firms to include organizations across Southeastern Europe. Active since at least 2022, the group is known for its extensive reconnaissance, network penetration techniques, and heavy reliance on Linux-based malware to compromise public-facing infrastructure.

Cyber researchers assess that UAT-7290 conducts extensive technical profiling of targets before exploiting exposed edge network devices. The actor primarily leverages one-day exploits and targeted SSH brute force attacks, often relying on publicly available proof of concept (PoC) exploit code rather than developing their own. Once initial access is achieved, the group escalates privileges and deploys a modular malware ecosystem tailored for persistence and lateral movement.

UAT-7290’s core tooling centers on Linux implants, beginning with the RushDrop (ChronosRAT) initial dropper, which initiates the infection chain and deploys additional components such as DriveSwitch and the SilentRaid (MystRodX) backdoor. SilentRaid enables long-term access through a plugin-based architecture that supports remote shell access, port forwarding, file operations, and credential-related data collection. While Linux remains the primary focus, the group has occasionally deployed Windows malware – tools commonly shared among China-aligned threat actors.

UAT-7290 is also known for playing a secondary role as an initial access provider. It converts compromised devices into Operational Relay Boxes (ORBs), infrastructure that can later be reused by other Chinese espionage groups, using the Bulbature backdoor.

The tooling and infrastructure overlaps with clusters such as APT10 and Moshen Dragon, reinforcing assessments that UAT-7290 is both an espionage operator and a strategic enabler within the broader Chinese cyber ecosystem.

The Ugly | Researchers Reveal Critical n8n Vulnerabilities Enabling Remote Code Execution

A series of critical vulnerabilities were recently disclosed in the open-source workflow automation platform n8n, allowing unauthenticated attackers to achieve remote code execution (RCE), perform arbitrary commands, and execute untrusted code leading to full compromise.

Beginning with CVE-2025-68668 dubbed ‘N8scape’, this critical flaw (CVSS 9.9) involves a sandbox bypass in the Python Code Node using Pyodide. It works by affecting n8n versions prior to 2.0.0 and allows users with workflow permissions to execute arbitrary OS commands with the same privileges as the n8n service. With version 2.0.0, a task runner-based native Python implementation that improves security isolation was made default thus addressing the issue.

Shortly afterward, n8n disclosed an even more severe issue tracked as CVE-2026-21877, a CVSS 10.0 vulnerability enabling authenticated remote code execution under certain conditions. Affecting both self-hosted and n8n cloud deployments, the flaw could allow untrusted code execution, eventually leading to compromise of the entire instance. Although the critical flaw is patched in version 1.121.3, administrators are advised to apply the updates quickly, especially given a growing pattern of critical RCE-class vulnerabilities in the platform.

The third and latest disclosure this week, codenamed ‘Ni8mare’ and tracked as CVE-2026-21858 (CVSS 10.0), is a critical flaw that allows complete takeover of affected instances. Exploiting a content-type confusion issue in n8n’s webhook and form handling, attackers can read arbitrary files, extract credentials and encryption keys, forge admin sessions, and ultimately achieve RCE. Researchers noted that a compromised n8n instance becomes a single point of failure due to centralized storage of API keys, OAuth tokens, and infrastructure credentials, making it a veritable data trove for threat actors.

At the time of writing, reports from attack surface management vendors are observing over 26,000 exposed n8n instances online, emphasizing the need for timely patching, controlled exposure, and strict access management.

The Good | Authorities Crackdown on BlackCat and Coinbase Malicious Insiders & Malware Operators

Two former employees from Sygnia and DigitalMint have pleaded guilty for participating in ransomware attacks linking them to the BlackCat (ALPHV, AlphaVM) operation. Ryan Goldberg and Kevin Martin admitted to conspiring to extort U.S. organizations, abusing the same security expertise they once used to defend cyber victims. Working with a third accomplice, they breached multiple companies nationwide and shared roughly 20% of ransom proceeds for access to BlackCat’s infrastructure. Prosecutors say they demanded between $300,000 and $10 million per victim.

Alternative to insider risk at the highest technical levels, similar threats are emerging from much lower in the access chain, too. Indian authorities arrested a former customer support agent for aiding threat actors in the May data breach at Coinbase, a popular cryptoexchange with more arrests are expected. The incident exposed data from roughly 69,500 users after bribed staff at outsourcing partner, TaskUs, enabled access. This news follows charges against Ronald Spektor, accused of stealing $16 million by impersonating Coinbase, highlighting ongoing insider and social engineering risks.

We have zero tolerance for bad behavior and will continue to work with law enforcement to bring bad actors to justice.

Thanks to the Hyderabad Police in India, an ex-Coinbase customer service agent was just arrested. Another one down and more still to come.

— Brian Armstrong (@brian_armstrong) December 26, 2025

Beyond insider abuse, attackers are also exploiting everyday user behavior to siphon funds at massive scale. A Lithuanian national was arrested for allegedly infecting 2.8 million systems with clipboard-stealing malware disguised as KMSAuto, an illegal Windows and Office software activator. The suspect used clipper malware to swap cryptocurrency addresses and divert funds to attacker-controlled ones. Korean National Police Agency says the campaign ran from 2020 to 2023, with a total of KRW 1.7 billion ($1.2M) stolen across thousands of transactions. Authorities warn that pirated software is often a key component in how attackers spread malware.

The Bad | Chinese-Based Attackers Deploy Stealthy Kernel‑Mode ‘ToneShell’ Backdoor

Security researchers have uncovered a significantly more stealthy variant of the ToneShell backdoor, a tool long associated with Chinese state-sponsored cyberespionage activity, now delivered via a kernel‑mode loader for the first time. New analysis links the campaign to G0129 (aka Bronze President, TEMP.Hex, Hive0154), a threat actor known for targeting government agencies, NGOs, and think tanks.

The activity, observed since at least February, primarily targets government organizations across Asia, particularly in Myanmar and Thailand. Investigators have found evidence that some victims had previously been compromised by earlier ToneShell variants, PlugX malware, or the ToneDisk USB worm, indicating long‑term persistence across multiple intrusion waves.

What sets this campaign apart is its use of a malicious kernel‑mode mini‑filter driver, ProjectConfiguration.sys, signed with a stolen or leaked digital certificate originally issued to Guangzhou Kingteller Technology Co., Ltd and valid between 2012 to 2015. Operating deep within the Windows kernel, the driver acts as a rootkit: evading static analysis by resolving kernel APIs at runtime, blocking file deletion and registry access, protecting injected processes, and deliberately interfering with Microsoft Defender by manipulating the WdFilter driver’s load order.

The driver ultimately injects two user‑mode payloads, including the updated ToneShell backdoor, which now features enhanced stealth capabilities. Changes also include a simplified host‑ID scheme, network traffic obfuscation using fake TLS headers, and remote administration capabilities such as file transfer and interactive shell access. Communication occurs over TCP port 443 to an attacker‑controlled infrastructure.

Researchers note this marks a clear evolution in G0129’s tactics, prioritizing kernel‑level persistence and evasion. As the payload operates almost entirely in memory, memory forensics becomes a critical detection method, alongside monitoring for indicators of compromise tied to the malicious driver and injected shellcode.

The Ugly | Hackers Steal $7M via Compromised Trust Wallet Chrome Extension

After a compromised update to the Trust Wallet Chrome extension went live over the holidays, approximately $7 million has been stolen from nearly 3,000 cryptocurrency wallets. The malicious version 2.68.0 contained a hidden JavaScript file called 4482.js that silently exfiltrated sensitive wallet data, including seed phrases, to an external server, api.metrics-trustwallet[.]com. Users immediately reported funds disappearing after simple wallet authorizations, prompting Trust Wallet to investigate and release a patched version 2.69. CEO Eowyn Chen confirmed the hack and assured users that the company would reimburse affected wallets.

Investigations indicate that attackers likely exploited a leaked Chrome Web Store API key to publish the malicious extension, bypassing Trust Wallet’s standard release procedures. In parallel, threat actors launched a phishing campaign using a Trust Wallet-branded site, fix-trustwallet[.]com, claiming to provide a “vulnerability fix”. Users who entered their seed phrases on the site immediately lost access to their wallets. WHOIS records suggest the phishing domain may be linked to the same actors behind the malicious extension.

Trust Wallet, a non-custodial cryptocurrency wallet acquired by Binance in 2018, emphasized that mobile-only users and other browser extension versions were not affected. The company has begun reimbursing victims after verifying wallet ownership, transaction hashes, and affected addresses, while warning users not to share private keys or seed phrases.

Security researchers noted the incident highlights significant risks in browser-based wallets and supply chain attacks, as malicious updates can gain privileged access to funds. Trust Wallet has suspended compromised API keys, reported the malicious domains to registrars, and continues monitoring for scams. Users are strongly advised to immediately update to version 2.69, only use official channels, and verify all communications to protect their crypto assets.

It’s that time of year where we re-visit the wins and challenges from 2025 in our special year-end edition of The Good, The Bad and the Ugly. Here are the biggest stories that defined the best, the worst, and the ugliest cybersecurity moments from this past year.

The Best

2025 has been a year of remarkable victories for law enforcement agencies worldwide, highlighting the power of cross-border coordination. From high-profile arrests to major asset seizures, authorities have steadily dismantled the infrastructure supporting criminal and state-aligned cyber actors.

In the last two weeks, Eurojust led a takedown of Ukrainian call centers defrauding Europeans of €10M and law enforcement seizing servers from E-Note crypto exchange laundering $70M through ransomware and account takeovers. Similarly, the arrest of Ukrainian national Victoria Dubranova for aiding Russian state-backed hacktivists, alongside Spanish authorities capturing a 19-year-old selling 64M stolen records, underscores the growing international effort to hold cybercriminals accountable.

Significant infrastructure disruptions further amplify these successes. Convictions of cybercriminals targeting sensitive systems, such as the prison sentence for the “evil twin” WiFi hacker and seizure of the Cryptomixer crypto mixer with €1.3B laundered since 2016, are tangible results in stopping large-scale fraud. Law enforcement groups also took on multifaceted approaches, combining legal action, sanctions, and operational disruption to arrest Russian and DPRK-related cybercriminals and place sanctions on bulletproof hosting providers and foreign actors.

Our joint guidance on bulletproof hosting providers highlights best practices to mitigate potential cybercriminal activity, including recommended actions that ISPs can implement to decrease the usefulness of BPH infrastructure. Learn more https://t.co/cGQpuLpBPP pic.twitter.com/tM55acfuQv

— CISA Cyber (@CISACyber) November 19, 2025

International coordination has also been key this year. Interpol’s massive operations across Africa, including Operation Serengeti 2.0 and Operation Red Card, led to the arrests of thousands of suspects and the seizure of tens of millions in stolen assets. Europol dismantled SIMCARTEL, a global SIM-box fraud network, seizing servers, SIM cards, crypto, and luxury vehicles, while coordinated actions targeted Diskstation ransomware gangs and hacktivist infrastructures. In parallel, DOJ and CISA-led operations disrupted high-value schemes, including Prince Group’s $15B romance scam and multiple ransomware networks, while releasing decryptors for Phobos and 8Base victims to provide tangible relief. Law enforcement also extended their reach to regulatory and infrastructure initiatives as well, introducing the Cyber Trust Mark certification for IoT devices and HIPAA encryption and MFA updates to ensure cyber safety from the top down.

On the cybersecurity innovation front, CISA’s launch of Thorium, an open-source platform to help government agencies automate forensic investigations, and AI-enabled threat detection systems have allowed authorities to act on incidents more rapidly, from ransomware affiliate seizures to monitoring AI misuse.

The Worst

State-sponsored crime, supply chain abuse, and emerging malware strains have collectively challenged defenders worldwide.

North Korea’s DPRK-linked hackers were prolific throughout 2025, stealing over $2B in cryptocurrency, blending traditional heists with espionage campaigns like Operation Contagious Interview targeting remote workers. Similarly, Iranian-linked UNK_SmudgedSerpent and China-linked TA415 campaigns leveraged phishing, fake platforms, and developer tooling to compromise high-value targets, from policy experts to enterprise networks.

2025 saw developer platforms, open-source ecosystems, and smart contracts become prime targets for threat actors. VS Code extensions like Bitcoin Black and Codo AI exfiltrated credentials from crypto wallets, while NPM packages such as XORIndex and os-info-checker-es6 delivered multi-stage payloads. Novel malware families including SleepyDuck RAT and Betruger backdoors emerged, masquerading as popular extensions on the Open VSX open-source registry and supporting ransomware campaigns, respectively. Even AI-powered attacks emerged, with AkiraBot, Gamma AI phishing, and social engineering campaigns bypassing CAPTCHAs and traditional defenses to exploit SMBs and enterprise targets.

This year, financial and operational impacts were particularly severe. Holiday banking fraud alone netted $262M via account takeovers exploiting phishing, MFA bypasses, and impersonation. YouTube trading bot scams, cloud identity theft campaigns, and multi-stage ransomware attacks like EncryptHub and Katz Stealer drained millions, targeting both enterprise systems and individuals. Exploits in misconfigured cloud resources and abandoned subdomains further amplified these risks, showing how minor misconfigurations can fuel sophisticated attacks.

State-aligned and nation-state threat actors also pursued espionage alongside financial crime. Fake job schemes and AI/crypto talent lures enabled targeted malware deployment, while advanced persistent threats like UNC3886 delivered stealthy backdoors to corporate and diplomatic networks. Malicious actors increasingly weaponized cloud services, messaging platforms, and developer tools, blurring the line between operational convenience and attack vectors.

The Ugliest

The “Ugly” dimension of 2025 was defined by AI-assisted attacks, zero-day exploitation, and ransomware industrialization, which amplified the scale and complexity of cybercrime. Large ransomware operations like CyberVolk resurfaced with AI-driven VolkLocker, automating negotiation, phishing, and multilingual attacks while leveraging Telegram for orchestration. AI also enhanced the capabilities of smaller, fragmented ransomware crews, allowing rapid targeting and payload deployment, though operational flaws sometimes limited effectiveness.

Zero-day vulnerabilities were actively exploited across critical infrastructure and enterprise platforms. React2Shell in React/Next.js, Triofox (CVE-2025-12480), Oracle E-Business Suite (CVE-2025-61884), and ToolShell in SharePoint permitted full system compromise, highlighting that popular frameworks and business-critical software remain high-value targets. Cloud and AI services were similarly exploited; EchoLeak and Google Gemini LLM prompt injections enabled exfiltration of sensitive information without user interaction. Attackers in all these cases demonstrated a capacity to combine stealth, automation, and sophisticated payloads for maximum disruption.

Update: See newly added info to our #ToolShell Alert. We’ve included info on ransomware deployment, new webshells involved in exploitation, & detection guidance https://t.co/Y37FHSeAL0 pic.twitter.com/C5aMXNOmAU

— CISA Cyber (@CISACyber) July 24, 2025

2025 also saw cyber espionage intertwined with physical and geopolitical threats. Iranian-backed Crimson Sandstorm leveraged cyber reconnaissance to support missile strikes, while Chinese and DPRK actors continue to target aid operations, humanitarian NGOs, and government infrastructure, often exploiting IoT, industrial control systems, or open-source software to do so. In cross-border campaigns, long-dwell malware like BRICKSTORM and protocol-level exploits such as MadeYouReset created cascading impacts across critical networks and infrastructure.

The risk factor in many attacks this year were amplified by third-party risks. Breaches of Discord vendors, Mixpanel, and GitHub Actions exposed vast quantities of PII and credentials, enabling subsequent ransomware, phishing, or espionage campaigns. The combination of AI, automation, and high-impact vulnerabilities exemplifies a cybercrime industrial complex, where opportunistic and state-aligned actors scale operations with unprecedented speed and sophistication.

Conclusion

As 2025 draws to a close, one thing is clear: Cybersecurity has become more interconnected, more consequential, and more dependent on collective responsibility than ever before. From supply chain fragility and identity-based intrusion to the continued convergence of cybercrime and geopolitics, the challenges ahead demand deeper collaboration, stronger accountability, and a more deliberate approach to trust across the digital ecosystem.

The Good | Authorities Dismantle Global Fraud Ring and Crypto Laundering Network

Eurojust officials have dismantled a transnational fraud ring running call centers in Ukraine that scammed European victims out of more than €10 million.

In collaboration with authorities from the Czech Republic, Latvia, Lithuania, and Ukraine, police arrested 12 suspects and conducted 72 searches across three Ukrainian cities, seizing vehicles, weapons, cash, computers, a polygraph machine, and forged IDs.

The network operated multiple call centers employing around 100 people and targeted more than 400 known victims. Scammers impersonated bank employees and police, claimed accounts were compromised, and coerced victims into transferring funds to “safe” accounts. Others used remote access software to steal credentials or collect cash in person.

Further seizures this week targeted the E-Note cryptocurrency exchange, dismantling its servers and domains after determining the service was used to launder more than $70 million in illicit funds. According to the DoJ, the proceeds stemmed largely from ransomware operations and account takeover attacks, routed through a global network of money mules.

The takedown was led by the FBI with support from German and Finnish authorities and Michigan State Police, with investigators confiscating multiple domains, mobile applications, backend servers, and customer databases containing transaction records.

Prosecutors have also unsealed an indictment against alleged operator Mykhalio Petrovich Chudnovets and are charging him with money laundering conspiracy. While no arrests have been made, Chudnovets faces up to 20 years in prison. Authorities say seized records may support further identifications and follow-on enforcement actions.

The Bad | North Korean Hackers Drive Record $2B Crypto Theft Surge in 2025

DPRK-linked threat actors drove a record surge in global cryptocurrency theft this year, claiming at least $2.02 billion of the $3.4 billion+ stolen worldwide between January and early December.

A new report delves into the 51% year-over-year increase, which marks the most severe year on record for DPRK-linked crypto crime while accounting for roughly 76% of all service compromises. Cumulatively, North Korean actors are now estimated to have stolen at least $6.75 billion in cryptocurrency.

A single incident, attributed to the TraderTraitor cluster, dominated the year: the February breach of Bybit that resulted in losses of approximately $1.5 billion. Beyond Bybit, DPRK-linked actors are also suspected in the theft of $36 million from South Korea’s most popular cryptocurrency exchange, Upbit.

These operations roll up into what is widely referred to as the Lazarus Group, a long-running threat actor tied to Pyongyang’s Reconnaissance General Bureau (RBG), which has historically blended large-scale crypto heists with espionage campaigns such as Contagious Interview, a campaign using fake recruitment-themed lures to deliver malware and harvest job applicant’s data.

In recent years, these state-backed actors have expanded tactics to include covert IT worker infiltration, sometimes via front companies, to gain privileged access at exchanges and Web3 firms – all to fund the regime despite international sanctions.

The growing scale of DPRK-linked crypto theft shows the profitability of high-value, state-backed operations, also incentivizing other actors to adopt similar tactics, including advanced laundering schemes, affiliate-based attacks, and cross-border exploitation.

For the broader ecosystem, North Korean threat operations continue to both normalize large-scale crypto heists and accelerate the professionalization of illicit networks, complicating attribution and straining global law enforcement resources.

The Ugly | Threat Actors Upscaling Abilities with Widespread Adoption of LLMs

Ransomware operations are undergoing a rapid, dangerous transformation not through novel “super-hacks” but via the industrialized efficiency of Large Language Models (LLMs). A new report by SentinelLABS assesses that LLMs have become a critical operational accelerator, compressing the ransomware lifecycle and dramatically lowering the barrier to entry for novice cybercriminals.

The researchers say that threat actors are now automating reconnaissance, generating localized phishing lures, and triaging massive datasets across language barriers with unprecedented speed and accuracy with the help of LLMs. Ransomware-as-a-Service operators are already claiming to offer AI-assisted tools to affiliates to increase attack productivity.

SentinelLABS says attackers are successfully evading commercial guardrails through “prompt smuggling”, a process by which malicious requests are broken down into innocent-looking pieces across multiple chats. The outputs are then stitched together offline to build working attack tools.

The researchers predict that top-tier actors will go further, likely migrating to self-hosted, open-source models like Ollama to entirely avoid provider guardrails. This evolution would allow criminals to operate without telemetry or censorship, effectively weaponizing unrestricted AI.

Real-world campaigns already illustrate this escalation. Anthropic has reported on tools like Claude Code being used to automate entire extortion chains, from technical reconnaissance to calculating optimal ransom demands. In other instances, malware such as QUIETVAULT has been seen hijacking a victim’s own locally installed LLMs to intelligently hunt for crypto-wallets and sensitive files.

While the report adds to the general industry concern around the use of AI by threat actors, it also debunks one of the wider myths in common circulation. The risk from today’s LLMs, the researchers say, isn’t superintelligent malware or novel attack vectors, it’s the more mundane industrialization of extortion with smarter target selection, tailored demands, and faster operational tempo, factors that increasingly complicate attribution and challenge defenders to adapt to a significantly higher-volume threat landscape.

The Good | U.S. & Spanish Officials Crack Down on Hacktivist & Identity Theft Activities

U.S. officials have charged Ukrainian national Victoria Dubranova for allegedly supporting Russian state-backed hacktivist groups in global critical infrastructure attacks. Extradited earlier this year, Dubranova faces trials in February and April 2026 tied to her suspected involvement in NoName057(16) and CyberArmyofRussia_Reborn (CARR), respectively.

GOT HER: A pro-Russian UKR hacker, Victoria Dubranova, has been arrested in a MASSIVE 99-count indictment for GRU-backed attacks on US water systems and food plants. She’s been extradited — and now there’s a $10M bounty on her GRU bosses! https://t.co/i31z4aXPMF pic.twitter.com/AAKeGQWx0K

— Chuck Pfarrer | Indications & Warnings | (@ChuckPfarrer) December 12, 2025

The indictment states that NoName057(16) operated as a state-sanctioned effort involving multiple threat actors and a government-created IT center. Their tooling includes a custom DDoS called ‘DDoSia’ used to launch attacks against government and financial agencies as well as critical transportation.

Prosecutors say Russia’s military intelligence service funded and directed CARR, a hacktivist group with over 75,000 Telegram followers and a long record of attacks. Damage to U.S. water systems, an ammonia leak at a Los Angeles facility, and targeting of nuclear and election infrastructure are all attributed to CARR. Dubranova faces up to 27 years on CARR-related charges and 5 years on NoName charges. Multi-million dollar rewards are in place for information on either threat group.

In Spain, authorities have arrested a 19-year-old hacker for the alleged theft and sale of 64 million records stolen from nine organizations. The suspect faces charges including cybercrime, unauthorized access, and privacy violations.

The investigation first started in June after breaches at the unnamed firms were reported. Police later confirmed that the suspect possessed millions of stolen records containing full names, addresses, emails, phone numbers, DNI numbers, and IBAN codes. He reportedly tried to sell the data on multiple forums using six accounts and five pseudonyms.

While officers have seized cryptocurrency wallets containing proceeds from the alleged sales, the total number of individuals affected remains unclear. Given the scale of the crime, Spanish authorities emphasize the seriousness of attempting to monetize stolen personal information.

The Bad | Malicious VS Code Extensions Deploy Stealthy Infostealer Malware

Two malicious Visual Studio Code extensions, Bitcoin Black and Codo AI, were recently discovered on Microsoft’s VS Code Marketplace, infecting developers with information-stealing malware. Each disguised as a harmless color theme and an AI coding assistant, the extensions were published under the alias ‘BigBlack’. While download counts are still low at the time of this writing, both packages point to a clear intent to compromise developer environments.

Researchers note that earlier versions of Bitcoin Black used a PowerShell script to fetch a password-protected payload, briefly flashing a visible window that could alert users. The latest version now has a hidden batch script that quietly downloads a DLL and executable via curl, significantly reducing detection risk. Meanwhile, Codo AI delivers legitimate code-completion via ChatGPT or DeepSeek but embeds a malicious payload alongside these features.

Both extensions deploy the Lightshot screenshot tool paired with a malicious DLL that uses DLL hijacking to load an infostealer called runtime.exe. Once executed, the malware creates a directory under %APPDATA%\Local\ and begins exfiltrating sensitive data from system details and clipboard content to WiFi passwords, screenshots, installed software lists, and running processes. Finally, it launches Chrome and Edge in headless mode to extract cookies and hijack active sessions, targeting several crypto wallets including Phantom, MetaMask, and Exodus.

Microsoft has since removed both extensions from the Marketplace and the malicious DLL is already flagged by 29 of 72 antivirus engines on VirusTotal. Developers are advised to install extensions only from trusted publishers and stay alert to atypical extension behavior.

The Ugly | CyberVolk Resurfaces With New Telegram-Powered RaaS ‘VolkLocker’

CyberVolk, a pro-Russia hacktivist persona first identified in late 2024, resurfaced this August with a revamped ransomware-as-a-service (RaaS) offering known as VolkLocker (CyberVolk 2.x). SentinelLABS reported this week that the group has pivoted to using Telegram for both automation and customer interaction; however, operations are being undercut by payloads that retain artifacts, allowing victims to recover their files.

VolkLocker is written in Golang and supports both Windows and Linux. Payloads are distributed largely unprotected, with RaaS operators instructed to use UPX for packing. Builders must supply key configuration values including a Bitcoin address, Telegram bot token ID, encryption deadline, file extension, and more.

On execution, the ransomware attempts privilege escalation via the “ms-settings” UAC bypass, performs system and VM checks, and enumerates drives for encryption. A dynamic HTML ransom note then displays a 48-hour countdown, while a separate enforcement timer corrupts the system if deadlines or decryption attempts fail.

Telegram serves as the backbone of the RaaS, offering operators an administrative panel, victim enumeration, broadcast messaging, and optional extensions such as RAT and keylogger control. Recent ads show CyberVolk expanding into standalone tooling with tiered pricing models.

The encryption routine uses AES-256 in GCM mode with a hardcoded master key. Crucially, the key is written in plaintext to a file in %TEMP%, alongside the victim’s unique identifier and the attacker’s Bitcoin address – an apparent leftover test artifact that allows victims to decrypt their own files.

Despite repeated account bans on Telegram, CyberVolk continues to evolve its services. The plaintext key flaw, however, reveals quality-control issues that limit the real-world impact of VolkLocker as-is. SentinelOne’s Singularity Platform detects and blocks behaviors and payloads linked to CyberVolk.

The Good | Authorities Jail WiFi Hacker, Seize €1.3B Crypto Mixer & Charge Two Malicious Insiders

An Australian national has received just over seven years in prison for running “evil twin” WiFi networks on various flights and airports to steal travelers’ data. Using a ‘WiFi Pineapple’ device as an access point, he cloned legitimate airport SSIDs. Users were then redirected to phishing sites where he harvested their credentials, which were exploited to access women’s accounts and obtain intimate content. Investigators found thousands of images, stolen credentials, and fraudulent WiFi pages. The individual has since pleaded guilty to multiple cybercrime, theft, and evidence-destruction charges.

In Europe, Swiss and German authorities have dismantled the Cryptomixer service, which allegedly laundered over €1.3 billion in Bitcoin since 2016. As part of Operation Olympia, officials seized three servers, 12 TB of data, Tor .onion domains, and €24 million in Bitcoin, with support from Europol and Eurojust. Cryptomixer, accessible on both the clear and dark web as a hybrid mixing service, obscured blockchain transactions for ransomware operators, dark markets, and a variety of criminal groups.

U.S. prosecutors have charged Virginia twin brothers for allegedly conspiring to steal sensitive government data and destroy databases after being fired as federal contractors. Previously sentenced in 2015 for unauthorized access to State Department systems, they returned to contracting roles before facing these latest indictments for fraud, identity theft, and record destruction. The Justice Department says one brother deleted 96 government databases in February 2025, stole IRS and EEOC data, and abused AI for guidance on how to hide evidence. Both men now face lengthy federal penalties if convicted.

The Bad | Investigation Exposes Contagious Interview Remote Worker & Identity Theft Scheme

In a collaborative investigation, researchers have exposed a persistent North Korean infiltration scheme linked to Operation Contagious Interview (aka UNC5267). The researchers observed in real time adversary operators using sandboxed laptops, revealing tactics designed to embed North Korean IT workers in Western companies, especially those within STEM and finance industries.

Livestreaming from a #Lazarus laptop farm.

For the first time ever, we recorded DPRK’s Famous Chollima full attack cycle: interviews, internal chats, every tool they use and every single click they made. Get ready for tons of raw footage.

Full article via ANYRUN. pic.twitter.com/2fyTn3zLI6

— Mauro Eldritch (@MauroEldritch) December 4, 2025

The operation began when a researcher posed as a U.S. developer targeted by a Contagious Interview recruiter. The attacker attempted to hire the fake developer, requesting full access to their SSN, ID, Gmail, LinkedIn, and 24/7 laptop availability. Virtual machines mimicking real developer laptops where deployed, allowing the researchers to monitor every action without alerting the operators.

The sandbox sessions showed a lightweight but effective toolkit focused on identity theft and remote access rather than malware deployment. Operators were also seen using AI-driven job tools to auto-fill applications and generate interview answers, browser-based OTP generators to bypass MFA, and Google Remote Desktop for persistent control. Reconnaissance commands validated the environment, while connections routed through Astrill VPN matched known Contagious Interview infrastructure. In one session, an operator explicitly requested ID, SSN, and banking details, confirming the goal of full identity and workstation takeover.

The investigation highlights remote hiring as a quiet yet reliable entry point for identity-based attacks. Once inside, attackers can access sensitive dashboards, critical business data, and manager-level accounts. Companies can reduce risk by raising internal awareness and providing safe channels for employees to report suspicious requests, helping prevent infiltration before it escalates into internal compromise.

The Ugly | Researchers Warn of Critical React2Shell RCE Vulnerability in React and Next.js

A critical remote code execution (RCE) vulnerability, dubbed ‘React2Shell’, affecting React Server Components (RSC) and Next.js, is allowing unauthenticated attackers to perform server-side code via malicious HTTP requests.

Discovered by Lachlan Davidson, the flaw stems from insecure deserialization in the RSC ‘Flight’ protocol and impacts packages including react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack. Versions affected include React 19.0 to 19.2.0 and Next.js experimental canary releases 14.3.0 to 16.x below patched versions. Exploitation is highly reliable, even in default deployments, and a single request can compromise the full Node.js process.

The flaw is being tracked as CVE-2025-55182. The technically correct CVE-2025-66478 has now been marked as a duplicate.

The vulnerability exists because RSC payloads are deserialized without proper validation, exposing server functions to attacker-controlled inputs. Modern frameworks often enable RSC by default, leaving developers unknowingly exposed. Fixes are available in React React 19.0, 19.1.0, 19.1.1, and 19.2.0, and Next.js 15.0.5–16.0.7. Administrators are urged to audit environments and update affected packages immediately.

Security researchers warn that cloud environments and server-side applications using default React or Next.js builds are particularly at risk. Exploitation could allow attackers to gain full control over servers, access sensitive data, and compromise application functionality. Reports have already emerged of China-nexus threat groups “racing to weaponize” the flaw.

China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182)
December 4, 2025, Amazon Web Services
aws.amazon.com/blogs/securi…
@awscloud.bsky.social

[image or embed]

— 780th Military Intelligence Brigade (Cyber) (@780thmibdecyber.bsky.social) 5 December 2025 at 11:32

Companies are advised to review deployments, restrict unnecessary server-side exposure, and monitor logs for anomalous RSC requests. Securing default configurations, validating deserialized input, and maintaining a regular patch management schedule can prevent attackers from exploiting framework-level vulnerabilities in production applications. SentinelOne’s blog post on the React2Shell RCE flaw can be found here.

The Good | Poland Detains Russian Hacker Amid Rising Moscow-Linked Sabotage

Poland’s Central Bureau for Combating Cybercrime (CBZC) has arrested a Russian national in Kraków on suspicion of breaching the IT systems of local companies, marking the latest incident tied to what Warsaw describes as Russia’s expanding sabotage and espionage campaign across Europe. According to Polish Interior Minister Marcin Kierwiński, the suspect allegedly compromised corporate-level security defenses to access and manipulate company databases in ways that could have disrupted operations and endangered customers.

Investigators say the man illegally entered Poland in 2022 and later obtained refugee status. He was detained on November 16 by Polish authorities and has since been interrogated, charged, and placed in three months of pre-trial custody. Authorities also believe he may be connected to additional cyberattacks affecting firms in Poland and other EU states, and they are still determining the full scope of the damage.

The arrest comes amid heightened concern over Russian hybrid warfare since Moscow’s invasion of Ukraine in 2022. Poland has linked recent incidents, including sabotage of a railway line and a fire at a major shopping mall, to Russian intelligence activities. The country has shut down all Russian consulates following the events.

EU officials warn that cyberattacks against regional companies and institutions have surged, with many attributed to GRU-backed actors. Other recent disruptions have included payment service outages and leaks of customer data from Polish firms. In response, Polish Digital Affairs Minister Krzysztof Gawkowski plans to invest a record €930 million on bolstering the county’s cybersecurity, underscoring what authorities describe as the urgent need for stronger corporate defenses and deeper international cooperation against increasingly aggressive cyber threats.

The Bad | FBI Warns of Banking Fraud & Account Takeover Schemes Ahead of Holidays

The FBI has issued a PSA about a sharp rise in account takeover (ATO) fraud, with cybercriminals impersonating financial institutions to steal more than $262 million since January 2025. The agency’s Internet Crime Complaint Center (IC3) has received over 5,100 reports this year from victims across individuals, businesses, and organizations across every sector.

The schemes start off with deceiving victims through texts, calls, and emails, posing as bank staff or customer support. They trick targets into revealing their login credentials, multi-factor authentication (MFA) codes, or one-time passcodes (OTPs). Criminals have also been luring victims onto phishing websites engineered to mimic legitimate banking or payroll sites, sometimes boosted through SEO poisoning to appear at the top of search results.

Once inside the victim’s account, fraudsters reset passwords, lock out the rightful owners, and quickly transfer funds into crypto-linked accounts, which makes recovery extremely difficult. Some victims report being manipulated with fabricated claims of fraudulent purchases, or even firearm transactions to incite panic, before being redirected to a second scammer impersonating law enforcement.

As we enter the holiday season, the FBI urges consumers and organizations to monitor their accounts closely, use strong unique passwords, enable MFA, verify URLs, and avoid visiting personal banking sites through search engine results. Victims should immediately contact their financial institutions to request recalls and provide indemnification documents, and then file detailed reports with IC3.

Officials and security experts stress that most ATO cases stem from compromised credentials. Stronger identity verification such as passwordless authentication and enabling manual verification steps remain basic security hygiene necessary for reducing these types of attacks.

The Ugly | OpenAI Alerts API Users After Mixpanel Breach Exposes Limited Data

OpenAI is alerting some ChatGPT API customers that limited personally identifiable information (PII) was exposed after its third-party analytics provider, Mixpanel, was breached. The compromise, stemming from an smishing campaign detected on November 8, affected “limited analytics data related to some users of the API”, but did not compromise ChatGPT or other OpenAI products.

While OpenAI confirmed that sensitive information such as credentials, API keys, requests, and usage data, payment and chat details, or government IDs remained secure, the exposed data may include usernames, email addresses, approximate user location, browser and operating system details, referring websites, and account or organization IDs.

OpenAI said users do not need to reset passwords or regenerate API keys. Some users have reported that CoinTracker, a cryptocurrency tracking platform, may also have been affected, with limited device metadata and transaction counts exposed.

Has @mixpanel not disclosed this breach? Sent from @CoinTracker. pic.twitter.com/xk9nmGVmfm

— Daniel Harrison (@danielh9277) November 27, 2025

OpenAI has begun an investigation, removed Mixpanel from production services, and is notifying affected users directly. The company warns that the leaked data could be used for phishing or social engineering attacks and advises users to verify any messages claiming to relate to the incident, enable MFA, and to never share account credentials via email, text, or chat.

Mixpanel, in turn, has responded to the incident by securing accounts, revoking active sessions, rotating compromised credentials, blocking the threat actor’s IPs, resetting employee passwords, and implementing new controls to prevent future incidents. The analytics firm also reached out to all impacted customers directly.

The incident highlights the risks posed by third-party service providers and the importance of awareness against phishing, even when no core systems or highly sensitive information are directly compromised.

The Good | Courts Prosecute DPRK Fraud, Ransomware Hosting & Crypto Mixer Ops

Five people have pleaded guilty to helping the DPRK run illicit revenue schemes involving remote IT worker fraud and cryptocurrency theft. The group enabled North Korean operatives to obtain U.S. jobs using false or stolen identities, generating over $2.2 million while impacting 136 companies. The DOJ is also seeking forfeiture of $15 million tied to APT38 cyber-heists. The defendants, Oleksandr Didenko, Erick Prince, Audricus Phagnasay, Jason Salazar, and Alexander Travis, admitted to stealing U.S. identities for overseas workers and laundering stolen funds.

In the U.S., U.K., and Australia, authorities have issued a coordinated sanction against Russian bulletproof hosting (BPH) providers that enable ransomware groups by leasing servers to support malware delivery, phishing attacks, and illicit content hosting. To help cybercriminals evade capture, BPH services ignore abuse reports and law enforcement takedowns. OFAC has sanctioned Media Land, its sister companies, and three executives all tied to LockBit, BlackSuit, Play, and other threat groups. Five Eyes agencies also released guidance to help ISPs detect and block malicious infrastructure used by BPH services.

Our joint guidance on bulletproof hosting providers highlights best practices to mitigate potential cybercriminal activity, including recommended actions that ISPs can implement to decrease the usefulness of BPH infrastructure. Learn more https://t.co/cGQpuLpBPP pic.twitter.com/tM55acfuQv

— CISA Cyber (@CISACyber) November 19, 2025

The founders of Samourai Wallet, a cryptocurrency mixing service, have been sentenced to prison for laundering over $237 million. Operating since 2015, Samourai used its ‘Whirlpool’ mixing system and ‘Ricochet’ multi-hop transactions to obscure Bitcoin flows. These features made tracing more difficult and enabled criminals involved in darknet markets, drug trafficking, and cybercrime to launder more than $2 billion. Authorities seized the platform, including its servers, domains, and mobile app, while the founders agreed to forfeit all traceable proceeds. CEO Keonne Rodriguez has received five years, while CTO William Lonergan Hill received four along with supervised release. The pair were ordered to pay fines of $250,000 each.

The Bad | DPRK Actors Build Fake Job Platform to Lure AI Talent & Push Malware

As part of their ongoing and evolving Contagious Interview campaign, DPRK-based threat actors have created a fake job platform designed to compromise legitimate job seekers, particularly in the AI research, software development, and cryptocurrency verticals. While earlier fraudulent IT-worker schemes relied on targeting individuals through phishing on social media platforms, the latest tactic weaponizes a fully functional hiring pipeline.

Researchers discovered the latest lure – a Next.js-based job portal hosted at lenvny[.]com, complete with dozens of fabricated AI and crypto-industry job listings. The listings mimic branding from major tech companies and feature a polished UI and full recruitment workflow that mirrors modern hiring systems, encouraging applicants to submit resumes and professional links before prompting them to record a video introduction.

This final step triggers the DPRK-favored ClickFix technique: When applicants copy the fake interview instructions, a hidden clipboard hijacker swaps their text with a multi-stage malware command. When pasted into a terminal, it downloads and executes staged payloads under the guise of a “driver update”, ultimately launching a VBScript-based loader. This design blends seamlessly with typical remote-work interview processes and dramatically increases the likelihood of accidental execution.

The platform also performs strategic filtering, attracting AI and crypto professionals specifically as their skills, network access, and workstation devices tend to align with DPRK’s intelligence and financial priorities including model-training infrastructure to crypto exchange systems. The campaign reflects significant maturation in DPRK social engineering tradecraft, pairing high-fidelity UI design with covert malware delivery. Job seekers are advised to verify domains, avoid off-platform hiring systems, and execute any requested code only in sandboxed environments.

The Ugly | Iran-Backed Actors Weaponize Cyber Recon to Power Real-World Attacks

Iranian-linked threat actors are using cyber operations to support real-world military activity, a pattern described by researchers as “cyber-enabled kinetic targeting”.

In the past, conventional security models separated cyber and physical domains – delineations that are proving artificial in today’s socioeconomic and political climate. Now, these are not just cyber incidents that cause physical impact, but rather coordinated campaigns upon which digital operations are built to advance military objectives.

One example involves Crimson Sandstorm (aka Tortoiseshell and TA456), a group tied to Iran’s Islamic Revolutionary Guard Corps (IRGC). Between December 2021 and January 2024, the group probed a ship’s Automatic Identification System (AIS) before expanding their operations to other maritime platforms. On January 27, 2024, the group searched for AIS location data on one particular shipping vessel. Days later, that same ship was targeted in an unsuccessful missile strike by Iranian-backed Houthi forces, which have mounted repeated missile attacks on commercial shipping in the Red Sea amid the Israel–Hamas conflict.

A second case highlights Mango Sandstorm (aka Seedworm and TA450), a group affiliated with Iran’s Ministry of Intelligence and Security (MOIS). In May, the group set up infrastructure for cyber operations and gained access to compromised CCTV feeds in Jerusalem to gather real-time visual intelligence. Just a month later, the Israel National Cyber Directorate confirmed Iranian attempts to access cameras during large-scale attacks, reportedly to get feedback on where the missiles hit and improve precision. Both highlighted cases show the attackers’ reliance on routing traffic through anonymizing VPNs to prevent attribution.

The divide between digital intrusions and physical warfare continues to blur. With nation state groups leveraging cyber reconnaissance as a precursor for physical attacks, it is likely we will continue to see significant developments in this kind of hybrid warfare.

The Good | FBI and Europol Arrest Ransomware Broker and Dismantle Major Botnet

Russian national, Aleksey Olegovich Volkov, is set to plead guilty for acting as an initial access broker (IAB) for Yanluowang ransomware attacks targeting at least eight U.S. companies from July 2021 to November 2022.

Using aliases like “chubaka.kor” and “nets”, Volkov sold access to the ransomware group after breaching his victim’s corporate networks and demanding ransoms from $300,000 to $15 million in Bitcoin. FBI investigators traced Volkov through iCloud, cryptocurrency records, and social media, recovering chat logs, stolen credentials, and evidence of ransom negotiations, which all linked him to $1.5 million in collected payments.

His breaches affected companies across multiple states, including banks, engineering firms, and telecoms. Volkov faces up to 53 years in prison and over $9.1 million in restitution for charges including trafficking in access, identity theft, computer fraud, and money laundering.

Law enforcement agencies across several countries dismantled over 1000 servers linked to the Rhadamanthys infostealer, VenomRAT, and Elysium botnet as part of Operation Endgame, an international effort against cybercrime. Coordinated by Europol and Eurojust with support from private partners, the action consisted of searches at 11 locations in Germany, Greece, and the Netherlands, where officers seized 20 domains and arrested a key VenomRAT suspect.

The disrupted infrastructure involved hundreds of thousands of infected devices and millions of stolen credentials, including access to over 100,000 crypto wallets. Rhadamanthys, active since 2023, had seen rapid growth in late 2025, affecting thousands of IP addresses daily.

Authorities recommend checking systems for infection via politie.nl/checkyourhack and haveibeenpwned.com. Operation Endgame has previously disrupted numerous malware and ransomware networks, including Bumblebee, IcedID, Pikabot, Smokeloader, SystemBC, and Trickbot, highlighting ongoing international efforts to curb cybercrime.

The Bad | UNC6485 Exploits Triofox Vulnerability for Remote Code Execution

Threat actors have exploited a critical vulnerability in Gladinet’s Triofox file sharing and remote access platform, chaining it with the product’s built-in antivirus scanner to gain SYSTEM-level remote code execution (RCE).

The vulnerability, tracked as CVE-2025-12480, allows attackers to abuse an access control logic error that grants admin privileges when the request host equals ‘localhost’. By spoofing this value in the HTTP host header, an attacker can reach sensitive setup pages without credentials, especially on systems where the TrustedHostIp parameter was never configured.

Security researchers first discovered an intrusion in August targeting a Triofox instance running version 16.4.10317.56372. They later determined that the threat cluster UNC6485 used a malicious HTTP GET request containing a localhost header to access the AdminDatabase.aspx setup page.

Using this workflow, the attackers created a rogue administrator account called ‘Cluster Admin’, uploaded a malicious script, and configured Triofox to treat that script as the antivirus scanner path. Since the scanner inherits SYSTEM-level privileges from the parent process, this allowed the attackers to execute arbitrary code.

The payload then launches a PowerShell downloader to retrieve a Zoho UEMS installer, which subsequently deploys Zoho Assist and AnyDesk on the compromised host for remote access and lateral movement. The attackers were also observed using Plink and PuTTY to establish SSH tunnels and forward traffic to the compromised host’s RDP port.

Gladinet has since fixed CVE-2025-12480 in Triofox version 16.7.10368.56560, and administrators are urged to update to the latest release (16.10.10408.56683), review admin accounts, and ensure the antivirus engine is not configured to run unauthorized binaries.

The Ugly | Attackers Exploit Zero-Day to Steal Washington Post Employee Data

The Washington Post, one of the vendors impacted by a breach targeting Oracle software, is notifying nearly 10,000 current and former employees and contractors that their personal and financial information has been exposed in the data theft campaign.

The Post, one of the largest U.S. newspapers with 2.5 million digital subscribers, confirmed that attackers accessed parts of its network between July 10 and August 22 by exploiting a previously unknown zero-day vulnerability in Oracle E-Business Suite, the organization’s internal enterprise resource planning (ERP) system. The vulnerability is tracked as CVE-2025-61884.

According to the letter sent to affected individuals, the Post learned of the intrusion after a threat actor contacted the company on September 29 claiming access to its Oracle applications. Post-breach investigations identified the widespread flaw that allowed the attackers to access many Oracle customers’ applications. The attackers used this flaw to steal sensitive data and later attempted to extort the Post and other organizations breached in the same campaign.

Although the Post did not name the group responsible, the Cl0p ransomware operation is suspected to be behind the attacks. Other high-profile victims of the same Oracle zero-day include Harvard University, Envoy Air, and GlobalLogic, with additional impacted organizations listed on Cl0p’s leak site.

The Post’s investigation has determined that data belonging to 9,720 individuals was compromised. Exposed information includes full names, Social Security numbers, tax and ID numbers, and bank account and routing numbers. Impacted individuals have been offered 12 months of free identity protection through IDX and advised to place credit freezes on their accounts and fraud alerts for additional protection.

The Good | Authorities Crack Down on Ransomware, Crypto Fraud & DPRK Laundering Ops

Three ex-employees of cybersecurity firms DigitalMint and Sygnia have been indicted for participating in BlackCat (aka ALPHV) ransomware attacks on five U.S. companies between May and November 2023.

The defendants allegedly acted as BlackCat affiliates, breaching networks, stealing data, deploying encryption malware, and demanding cryptocurrency ransoms. Victims included medical, pharmaceutical, and engineering firms. Prosecutors say the ransom demands ranged from $300,000 to $10 million, with one company paying out $1.27 million. The trio faces up to 50 years each in prison if convicted.

Also this week, the U.S. Treasury sanctioned two North Korean financial institutions and eight individuals for laundering cryptocurrency stolen via fraudulent IT worker schemes. The designated include Ryujong Credit Bank and Korea Mangyongdae Computer Technology Company (KMCTC), along with executives and bankers responsible for managing funds linked to ransomware attacks and UN sanctions violations.

OFAC says that over the last 3 years DPRK-affiliated cybercriminals have stolen more than $3 billion in cryptocurrency using malware and social engineering. The sanctions freeze U.S. assets and warn that transactions with these entities risk secondary penalties.

In Europe, authorities have arrested nine suspects involved in a cryptocurrency fraud network responsible for stealing over €600 million ($689 million) across multiple countries. The criminals allegedly created fake crypto investment platforms that promised high returns and recruited victims through social media, cold calls, and fake endorsements from celebrity investors. Victims lost their funds while the suspects laundered the stolen assets using blockchain tools. In operations coordinated by Eurojust in Cyprus, Spain, and Germany, law enforcement seized cash, crypto, and bank accounts.

The Bad | SleepyDuck Trojan Exploits Ethereum Smart Contracts to Evade Takedown

A new remote access trojan (RAT) dubbed ‘SleepyDuck’ has been masquerading as a well-used Solidity extension on the Open VSX open-source registry, researchers say. The malware uses Ethereum smart contracts to manage its command and control (C2) communications, helping it to maintain persistence even if its main server is taken down.

Initially benign when published on October 31, the infected extension, juan-bianco.solidity-vlang, became malicious after an update made the following day, by which time it had already been downloaded 14,000 times. For now, the extension remains available on Open VSX with a public warning. In total, it has been downloaded over 53,000 times.

Security researchers report that SleepyDuck activates when the code editor starts, a Solidity file opens, or when a compile command runs. It disguises its malicious activity through a fake webpack.init() function from extension.js, while secretly executing payloads that collect system information such as hostnames, usernames, MAC addresses, and timezones.

After it is triggered, the trojan queries the Ethereum blockchain to find the fastest RPC provider, read its C2 details, and enter a polling loop for new instructions. This blockchain-based C2 redundancy means that even if the main C2 domain (sleepyduck[.]xyz) is disabled, the malware can still fetch updated addresses or commands from the blockchain, making takedown efforts much more difficult.

In response, Open VSX has introduced new security measures, including shorter token lifetimes, automated scans, revoking any leaked credentials, and working in coordination with VS Code to block emerging threats. Best practices for developers include verifying extension publishers and installing software only from trusted repositories to avoid supply-chain compromises.

The Ugly | Iran-Based Actors Target U.S. Policy Experts in New Espionage Campaign

Between June and August, a newly identified threat cluster dubbed ‘UNK_SmudgedSerpent’ launched a series of targeted cyberattacks against U.S.-based academics and foreign policy experts focused on the Middle East. The campaign, coinciding with rising Iran-Israel tensions, uses politically-themed lures related to Iranian domestic affairs and the militarization of the Islamic Revolutionary Guard Corps (IRGC).

Researchers say the threat actors behind the campaign initiated attacks with benign email exchanges before introducing phishing links impersonating prominent U.S. foreign policy figures and think tank institutions like the Brookings Institution and Washington Institute.

The targeted victims, over 20 U.S.-based experts on Iran-related policy, were enticed to open malicious meeting documents and login pages designed to harvest their Microsoft account credentials. In some attacks, the attackers sent URLs leading to fake MS Teams login pages but pivoted to spoofed OnlyOffice sites if the victim grew suspicious.

Clicking the links led to the download of malicious MSI installers disguised as Microsoft Teams, which then deployed legitimate remote monitoring and management (RMM) software like PDQ Connect. Subsequent activity suggests attackers manually installed additional tools such as ISL Online, indicating possible hands-on-keyboard intrusion.

Researchers note that the operation’s tactics mirror those of known Iranian cyberespionage groups such as TA455 (aka UNC1549, Smoke Sandstorm), TA453 (aka TunnelVision, APT 35, UNC788), and TA450 (aka TEMP.Zagros).

The researchers believe UNK_SmudgedSerpent’s campaigns are part of a broader collection effort by Iranian intelligence aimed at gathering insights from Western experts on regional policy, academic analyses, and strategic technologies.

The Good | Former GM of DoD Contractor Pleads Guilty to Selling U.S. Cyber Secrets

Peter Williams, a former general manager at U.S. defense contractor L3Harris Trenchant, has pleaded guilty in U.S. federal court to two counts of stealing and selling classified cybersecurity tools and trade secrets to a Russian exploit broker.

Between 2022 and 2025, Williams stole at least eight restricted cyber-exploit components that were developed for the U.S. government and select allied partners. The DoJ stated that these tools, valued at $35 million, were part of Trenchant’s sensitive research and were never intended for foreign sale. Williams sold them for at least $1.3 million in cryptocurrency, signing formal contracts with the Russian intermediary for the initial sale of the components as well as a promise to provide follow-on technical support. Williams used the illicit proceeds to purchase luxury items, according to court filings.

Trenchant, L3Harris Technologies’ cyber capabilities arm, develops advanced offensive and defensive tools used by government agencies within the Five Eyes intelligence alliance. According to the DoJ, Williams abused his privileged access at Trenchant Systems to siphon the data, giving various customers of the broker, including the Russian government and other foreign cyber threat actors, an edge in targeting U.S. citizens, businesses, and critical infrastructure.

While the court reports did not name the broker, prior reporting suggests it may be Operation Zero, a Russian platform known for buying and reselling zero-day exploits, often rewarding developers with large cryptocurrency payouts.

Williams now faces up to 10 years in prison and fines of $250,000 or twice the profit gained. As international cyber brokers expand in their roles as international arms dealers, law enforcement officials reaffirm their hard stance against malicious insiders abusing their positions of trust.

The Bad | New “Brash” Flaw Crashes Chromium Browsers with Timed Attacks

Security researcher Jose Pino has disclosed a severe vulnerability in Chromium’s Blink rendering engine that allows attackers to crash Chromium-based browsers within seconds. Pino has named the vulnerability “Brash” and attributes it to an architectural oversight that fails to rate-limit updates to the document.title API. Without the rate-limiting, an attacker can generate millions of document object model (DOM) mutations per second by repeatedly changing the page title, overwhelming the browser, and consuming CPU resources until the UI thread becomes unresponsive.

The Brash exploit occurs in three phases. First, the attacker prepares a hash seed by loading 100 unique 512-character hexadecimal strings into memory to vary title updates and maximize the impact of the attack. Then, the attacker launches burst injections that perform three consecutive document.title updates in a row, which in default test settings inject roughly 24 million updates per second using a burst size of 8,000 and a 1 ms interval. Lastly, the sustained stream of updates saturates the browser’s main thread, forcing both the tab and the browser to hang or crash and requiring forced termination.

Brash can be scheduled to run at precise moments, enabling a logic-bomb style attack that remains dormant until a timed trigger activates. This increases the danger since attackers can control when the large-scale disruption will occur. Hypothetically, a single click on a specially crafted URL can detonate the attack with millisecond accuracy and little initial indication.

The vulnerability affects Google Chrome and all Chromium-based browsers, including Microsoft Edge, Brave, Opera, Vivaldi, Arc, Dia, OpenAI ChatGPT Atlas, and Perplexity Comet. WebKit-based browsers such as Mozilla Firefox and Apple Safari are not vulnerable to Brash as well as any iOS third-party browsers.

The Ugly | Hacktivists Manipulate Canadian Industrial Systems, Triggering Safety Risks

The Canadian Centre for Cyber Security has issued a warning that hacktivists have breached multiple critical infrastructure systems across Canada, altering industrial controls in ways that could have created dangerous conditions. The alert highlights rising malicious activity that targets internet-exposed Industrial Control Systems (ICS) and urges firms to shore up their security measures to prevent such attacks.

The bulletin cites three recent incidents. In the first, a water treatment facility experienced tampering with water pressure controls, degrading service for the local community. Following that, a Canadian oil and gas company had its Automated Tank Gauge (ATG) manipulated, triggering false alarms. In a third breach, a grain drying silo on a farm had temperature and humidity settings altered, creating potentially unsafe conditions if the changes had gone undetected.

Authorities believe these attacks were opportunistic rather than being technically sophisticated, and intended to attract media attention, underme public trust, and harm the reputation of Canadian authorities. Hacktivists have been known to collaborate with advanced persistent threat (APT) groups to amplify the reach of disruptive acts and cause public unrest.

Although none of the targeted facilities suffered damage, the incidents underline inherent risks in poorly protected ICS, including programmable logic controllers (PLCs), supervisory control and data acquisition (SCADA) systems, human-machine interfaces (HMIs), and industrial IoT devices.

The Cyber Centre recommends that organizations inventory and secure internet-accessible ICS devices, remove direct internet exposure where possible, implement VPNs with multi-factor authentication (MFA), maintain regular firmware updates, and conduct regular penetration testing. Resources like the Cyber Security Readiness Goals (CRGs) can offer guidance for critical infrastructure firms and officials remind organizations that suspicious activity should be reported via My Cyber Portal or to local authorities to reduce risks of future compromise.

The Good | Europol Dismantles Global SIM-Box Fraud Network

Europol has dismantled a major cybercrime-as-a-service (CaaS) operation, codenamed SIMCARTEL, that powered over 3,200 fraud cases and caused at least €4.5 million in damages. The network operated 1,200 SIM-box devices containing some 40,000 SIM cards, enabling criminals to rent phone numbers registered to individuals in more than 80 countries. These were then used to create 49 million fraudulent online accounts for crimes including phishing, investment fraud, extortion, impersonation, and migrant smuggling.

The illegal service, run through gogetsms.com and apisim.com, worked by selling access to “fast and secure temporary” phone numbers marketed for anonymous communication and account verification. GoGetSMS also offered users a way to monetize their own SIM cards. However, reviews suggested it was a front for large-scale identity fraud, now exposed as one of Europe’s most extensive SIM-box schemes to date. Europol said the infrastructure was “technically highly sophisticated”, which allowed perpetrators worldwide to hide their identities while conducting telecom-based fraud.

After running coordinated raids across Austria, Estonia, Finland, and Latvia, police arrested seven suspects in total. They also seized five servers, the two websites, hundreds of thousands of SIM cards, €431,000 deposited in bank accounts, €266,000 in crypto, and four luxury vehicles. Both domains have been taken down and now display official law enforcement banners.

So far, authorities have linked the network to 1,700 fraud cases in Austria and 1,500 in Latvia, with combined losses adding up to nearly €5 million. Europol’s forensic analysis of the seized servers aims to identify customers of the illegal service.

The Bad | Jingle Thief Exploits Cloud Identities for Large-Scale Gift Card Fraud

A new report from security researchers details the activities of ‘Jingle Thief’, a financially motivated threat group that operates almost entirely in cloud environments to conduct large-scale gift card fraud. Active since at least 2021, the group targets retail and consumer services organizations through phishing and smishing campaigns designed to steal Microsoft 365 credentials.

Once inside, the attackers exploit cloud-based infrastructure to impersonate legitimate users, gain unauthorized access to sensitive data, and manipulate gift card issuance systems. With their campaigns focusing on mapping cloud networks, attackers can move laterally across accounts and avoid detection through stealthy tactics such as creating inbox rules, forwarding emails, and registering rogue authenticator apps to bypass MFA in M365.

Unlike traditional malware-driven attacks, Jingle Thief relies heavily on identity misuse, choosing to leverage stolen credentials instead of deploying custom payloads to blend in with normal user activity. This approach allows them to maintain access for many months while issuing or selling unauthorized gift cards for profit on gray markets.

Researchers also observed a major wave of Jingle Thief activity between April and May 2025, during which the group compromised more than 60 user accounts within a single organization. The attackers conducted extensive reconnaissance in SharePoint and OneDrive, searching for financial workflows, IT documentation, and virtual machine configurations, all tied to gift card systems.

Exploiting cloud identities rather than endpoints furthers the trend of cloud-based cybercrime, where phished credentials and identity abuse enable financially motivated actors to scale operations while remaining under the radar. Jungle Thief’s campaign is a reminder to prioritize identity-based monitoring and cloud-native security measures that provide full visibility and real-time detection.

The Ugly | PhantomCaptcha Spearphishing Targets Ukraine’s Relief Networks

SentinelLABS, together with the Digital Security Lab of Ukraine, have uncovered ‘PhantomCaptcha’, a single-day spearphishing campaign that targeted Ukrainian regional government administrations and humanitarian organizations such as the International Red Cross, UNICEF, the Norwegian Refugee Council, and other NGOs linked to war relief efforts.

Launched on October 8, 2025, the operation began with an impersonation of the Ukrainian President’s Office, distributing weaponized PDF attachments that redirected victims to a fake Zoom site (zoomconference[.]app). There, a fake Cloudflare CAPTCHA lured users into copying and pasting malicious PowerShell commands – a ClickFix technique designed to bypass traditional endpoint controls by tricking victims into executing the malware themselves.

Once running, the script deployed a multi-stage PowerShell payload leading to a WebSocket remote access trojan (RAT) hosted on Russian-owned infrastructure. The RAT enables arbitrary command execution, data exfiltration, and the potential deployment of further malware through encrypted WebSocket communications. Although investigations show that the attackers spent six months preparing the campaign, it remained active for only 24 hours, pointing to an infrastructure that demonstrates sophisticated operational security and planning.

SentinelLABS linked the campaign to an additional Android-based espionage effort hosted on princess-mens[.]click, which distributes spyware-laden APKs disguised as adult entertainment or cloud storage apps designed to harvest contacts, media files, and geolocation data.

While attribution remains unconfirmed, technical overlaps, including the ClickFix lure and Russian-hosted C2s, suggest possible ties to COLDRIVER (aka UNC4057 or Star Blizzard), a threat group linked to Russia’s Federal Security Service (FSB). PhantomCaptcha is an example of a highly organized and adaptive adversary, able to blend social engineering, short-lived but highly compartmentalized infrastructure, and cross-platform espionage to target Ukraine’s humanitarian and government sectors.

The Good | DOJ Seizes $15B in Crypto, Targets Global Scam Ring & PowerSchool Hacker

The U.S. Department of Justice has seized $15 billion in bitcoin from the Prince Group, a vast criminal syndicate behind cryptocurrency scams known as romance baiting. Led by fugitive Chen Zhi (aka Vincent), the group defrauded billions from victims through fake investment schemes disguised as romantic or business opportunities. Operating across 30+ countries, Prince Group forced trafficked workers into Cambodian compounds to run these scams under threat of violence.

The organization laundered illicit gains through complex crypto transfers before converting them into cash for luxury assets, including yachts, jets, and even a Picasso painting. In coordination with the U.K., the U.S. Treasury has sanctioned Zhi and 146 of his associates. Authorities, on the whole, estimate that Americans lost $16.6 billion to such scams last year, with Southeast Asian-based operations driving most of this increase. As global authorities intensify crackdowns on large-scale fraud and cybercrime operations, U.S. law enforcement continues to pursue domestic offenders exploiting digital platforms for profit.

Matthew D. Lane, a 19-year-old from Massachusetts, was sentenced to four years in prison and ordered to pay $14 million in restitution for orchestrating a severe cyberattack on PowerSchool, a leading K–12 software provider serving over 60 million students worldwide. Lane and his accomplices used stolen subcontractor credentials to breach PowerSchool’s systems, stealing data on 9.5 million teachers and 62.4 million students, including social security numbers and medical records. They demanded $2.85 million in Bitcoin under the alias “Shiny Hunters”.

Despite PowerSchool paying an undisclosed ransom to prevent a data leak, the group continued additional extortion attempts on several affected school districts. Lane pleaded guilty to multiple federal cybercrime charges in May.

The Bad | North Korean Hackers Deploy EtherHiding to Steal Cryptocurrency

North Korean state-sponsored hackers have begun using a novel malware-hosting method called “EtherHiding” to steal cryptocurrency, marking the first time a nation-state actor has employed this blockchain-based technique. Researchers attribute the activity to the DPRK-linked cluster UNC5342, which has been deploying EtherHiding since February 2025 as part of its ongoing “Contagious Interview” campaign. The group uses fake job offers to lure software developers, posing as recruiters from fake companies. During technical assessments, victims are tricked into running malicious code, initiating the multi-stage infection chains.

EtherHiding embeds malicious payloads within smart contracts on public blockchains, including Ethereum and Binance Smart Chain, allowing attackers to fetch the malware via read-only calls that leave no trace of the transaction. This method provides anonymity, is resilient to takedowns, and provides the flexibility to update payloads at minimal cost, an average of $1.37 USD per update. The payloads include JADESNOW, a JavaScript downloader, and InvisibleFerret, a backdoor for credential theft, remote control, and exfiltration of cryptocurrency wallet data and browser-stored passwords.

Researchers note that the threat actor’s use of multiple blockchains suggests operational compartmentalization and makes forensic analysis more difficult. The approach demonstrates a shift toward bulletproof hosting, using blockchain technology to create takedown-resistant, flexible malware distribution.

Users should exercise caution with job-related downloads and adopt best practices such as testing files in isolated environments, restricting executable file types, and enforcing strict browser policies to block script auto-execution.

The Ugly | Flaws in Microsoft Defender Could Lead to Theft of Data

Researchers have reported unpatched vulnerabilities in Microsoft Defender for Endpoint (DFE) that could enable attackers to bypass authentication, spoof data, exfiltrate sensitive information, and inject malicious files into forensic evidence collections used by security analysts.

Reported to Microsoft’s Security Response Center in July 2025, the issues were categorized as low severity, with no confirmed fixes as of this writing. Researchers tracking the flaws focused on how the agent communicated with cloud backends, using tools like Burp Suite and WinDbg memory patches to bypass certificate pinning in MsSense.exe and SenseIR.exe, allowing plaintext interception of HTTPS traffic, including Azure Blob uploads.

The core problem lies in DFE requests to endpoints such as /edr/commands/cnc and /senseir/v1/actions/, where Authorization tokens and headers are ignored. Low-privileged users can obtain machine and tenant IDs from the registry to impersonate the agent, intercept commands, or spoof responses such as faking an “already isolated” status while leaving devices exposed. Similarly, CloudLR tokens for Live Response and Automated Investigations are ignored, allowing payload manipulation and uploads to Azure Blob URIs.

In addition, attackers can access 8MB configuration dumps without credentials, revealing detection logic like RegistryMonitoringConfiguration and ASR rules, while investigation packages on disk can be tampered with, embedding malicious files disguised as legitimate artifacts.

Despite responsible disclosure by the researchers concerned, it remains unknown whether Microsoft will patch the flaws any time soon.

The Good | Teens Arrested in Nursery Doxing Case as OpenAI Disrupts Cybercrime Clusters

U.K. police have arrested two 17-year-olds in Hertfordshire for allegedly doxing children following a ransomware attack on London-based Kido nurseries. The Radiant Group claimed responsibility, saying they stole sensitive data and photos of over 8000 children and leaked some online to extort Kido. Later, the files were removed after the groups’ threats to both Kido and parents of the affected children failed to make headway. Kido, supporting over 15,000 families in the U.K, U.S, China, and India, confirmed the breached data was hosted by Famly, a nursery software platform, which said its systems were not compromised.

The UK’s NCSC called the attack on children “particularly egregious” and the Met Police emphasized their commitment to bringing the perpetrators to justice. The arrests reflect a wider trend of teenagers involved in major U.K. cyberattacks, with recent cases linked to Marks & Spencer, Co-op, Harrods, and Transport for London.

Also this week, OpenAI said it disrupted three malicious activity clusters abusing ChatGPT for cybercrime and influence operations. The first involved Russian-speaking actors using multiple accounts to develop components of remote access trojans (RATs), credential stealers, and data exfiltration tools. The second, tied to North Korean actors, used ChatGPT to assist in malware, phishing, and C2 development – using the chatbot to draft copy, perform experiments, and explore new techniques. The third was linked to Chinese threat group ‘UNK_DropPitch’, which leveraged the tool to create multilingual phishing content and automate hacking tasks.

Beyond these, OpenAI also blocked networks from Cambodia, Myanmar, Nigeria, Russia, and China for using AI in scams, propaganda, and surveillance, though all mentioned actors tried to mask signs of their abuse of the tool to further their operations.

The Bad | Crimson Collective Group Breach Cloud Systems to Steal Data & Extort Victims

A threat group called ‘Crimson Collective’ has launched a series of targeted attacks on AWS cloud environments, stealing sensitive data and extorting victims through multi-stage intrusions. The group just recently exfiltrated 570 GB of data from thousands of private GitLab repositories before joining forces with Scattered Lapsus$ Hunters to intensify its extortion efforts.

Researchers explain how Crimson Collective’s operations begin with harvesting exposed long-term access credentials using open-source tools like TruffleHog. Once inside, they create new privileged accounts and escalate privileges by assigning administrative policies, effectively gaining complete control over the compromised environment. Here, the attackers enumerate users, databases, and storage systems in preparation of large-scale data theft.

The group’s exfiltration process involves modifying database master passwords, creating snapshots of databases before exporting them to S3 for transfer through API calls. EBS (Elastic Block Store) volumes are then launched and attached under permissive security groups to move data more freely. Victims typically receive ransom demands via in-platform email systems and external addresses once exfiltration is complete.

Investigations found that the group employs many IP addresses, some reused across different incidents, which allowed partial tracking of its operations. While Crimson Collective’s size and infrastructure remain unclear, its extortion tactics indicate an expanding threat to organizations relying on cloud-based infrastructure. Using short-term, least-privileged credentials and enforcing IAM policies can help mitigate the chance of breaches.

Researchers warn that leaked credentials and lax privilege management continue to be major enablers for these attacks, and urge companies to tighten access controls, limit credential lifespan, and regularly audit for exposed secrets using open-source scanning tools.

The Ugly | Attackers Breach Discord Ticketing Support, Exposing Data of 5.5M Users

Threat actors claiming to have breached Discord’s customer support systems are now threatening to leak data allegedly stolen from millions of users after the company refused to pay ransom demands. This latest threat follows reports that the attackers first gained access to a third-party support provider in late September, exfiltrating sensitive user information such as names, emails, government IDs, and partial payment details.

Discord confirmed that the compromise affected a vendor system used for customer service, not its internal infrastructure, and said around 70,000 users had their government ID photos exposed – far fewer than the 2.1 million claimed by the attackers. The company stressed that inflated figures and ransom demands were part of an extortion campaign and that it will not reward illegal actions.

According to the threat actors, they accessed Discord’s support platform for 58 hours through a compromised account belonging to an outsourced support agent. During this window, the scope of their claim includes 1.6 terabytes of data, including 8.4 million support tickets affecting 5.5 million users, with roughly 580,000 containing partial payment information. The attackers also said integrations between the support system and Discord’s internal database allowed them to run millions of API queries for additional user data.

The actors initially demanded $5 million, later reducing it to $3.5 million before Discord ended negotiations and went public with the breach. The group has since threatened to release the stolen data, marking one of the largest extortion-driven data thefts to hit a major communication platform in 2025.

The Good | UK Convicts “Bitcoin Queen” in World’s Largest Cryptocurrency Seizure

This week, a court in the UK convicted Bitcoin fraudster Qian Zhimin (aka Zhang Yadi) of acquiring and possessing criminal property after a 7 year pursuit and the recovery of stolen crypto assets now worth $7.3 billion.

Qian, a 47 year old Chinese national, had profited from a multibillion dollar fraud scheme between 2014 and 2017, in which she convinced around 130,000 unwitting victims to invest in “digital gold” by promising returns of 100-300%.

Dubbed “the Bitcoin Queen”, Qian fled from China to the UK using a false passport after authorities began investigating her in 2017. She then attempted to launder her funds through an accomplice, Wen Jian, a 42 year old female who facilitated the purchase of property, jewellery and other high value assets on Qian’s behalf.

In 2018, authorities seized a number of digital devices from Qian and Wen’s London home, but it was not until 2021 that they realized the devices contained digital wallets holding 61,000 Bitcoin, worth at that time around a billion dollars. Wen was subsequently arrested in 2022 and convicted in 2024. Qian remained at large until her arrest in April 2024. Qian’s sentencing has been set for next month.

What happens to the seized funds remains the subject of some controversy since the value of the Bitcoin now far exceeds that of the funds invested by victims. Both the UK government and representatives of the Chinese victims are seeking restitution.

The Bad | Hackers Exploit Milesight Routers to Send Phishing SMS to Users

New research suggests that multiple threat actors may be leveraging an unpatched bug in Milesight cellular routers, targeting users in a number of different countries with SMS phishing messages (aka Smishing) since at least 2022. A patch for the flaw, CVE-2023-43261, was released in 2023, but analysis suggests many unpatched devices remain accessible from the public internet.

The researchers say that attackers have been exploiting the vulnerable routers to send large volumes of SMS messages mimicking government services, banks and delivery companies. Victims receive legitimate looking texts urging them to click malicious links, which redirect to mobile-optimized phishing pages.

The attack is made possible as the flaw allows anyone to access log messages on the exposed routers via API calls. The logs contain encrypted administrator credentials which attackers can decrypt using hardcoded AES keys found in the client-side JavaScript and then use these credentials to authenticate further API calls.

The researchers also believe other bugs may be in play as they noted evidence that many exposed devices were running outdated firmware with other known vulnerabilities.

Analysis of the targeted phone numbers indicates that Europe is the primary region affected by the smishing campaigns, with Belgium heavily targeted; however, vulnerable devices were also observed in Australia, Turkey, Singapore and even North America. In one of a number of campaigns, SMS lures using the domain disney[.]plus-billing[.]sbs and referencing a payment issue urged recipients to click a malicious link.

Phishing messages in several languages, including French, Italian and English, were observed. The researchers believe multiple campaigns have been in operation by different threat actor groups targeting the same vulnerable infrastructure.

Vulnerable cellular routers offer an attractive target to threat actors, affording them the ability to send messages at scale without being flagged as malicious. Individuals and businesses are reminded that, as with other forms of phishing, heightened awareness and scepticism towards unsolicited SMS messages, even when they appear to come from trusted sources, is a vital first line of defense.

The Ugly | Trio of Flaws in Google Gemini Turn AI Into Attack Vehicle

AI is in the spotlight again this week with news that several products within Google’s family of AI models were vulnerable to search injection attacks, prompt injection attacks and exfiltration of user data, leading researchers to dub the flaws the ‘Gemini Trifecta’.

The flaws were found in Google Cloud Platform’s Gemini Cloud Assist, Gemini Search Personalization, and Gemini Browsing Tool, and serve as a reminder of the risks that AI brings to enteprises as threat actors look to manipulate such tools in their attacks. The researchers say they discovered three distinct components in the Gemini suite that had issues:

• Gemini Cloud Assist — This prompt-injection vulnerability in Google Cloud’s Gemini Cloud Assist tool could have enabled attackers to exploit cloud-based services, potentially compromising cloud resources, and also could have allowed phishing attempts. This vulnerability represents a new attack class in the cloud and in general, where log injections can poison AI inputs with arbitrary prompt injections
• Gemini Search Personalization Model — This search-injection vulnerability gave attackers the ability to inject prompts, control Gemini’s behavior and potentially leak the user’s saved information and location data by manipulating their Chrome search history
• Gemini Browsing Tool — This flaw allowed attackers to exfiltrate a user’s saved information and location data by abusing the browsing tool, potentially putting user privacy at risk.

The vulnerabilities were reported to Google and have now been patched. However, it is important that enterprises view AI assistants not just as passive productivity tools but as active attack surfaces and treat them accordingly.

The Good | Law Enforcement Makes Swift Arrest After Attack on Airports

Authorities in the UK have been quick to arrest an individual in connection with the cyber attack on Collins Aerospace last Friday, which caused disruption at several European airports including Berlin, Brussels, Dublin, and Heathrow.

The attack on Collins’ MUSE (Multi User System Environment) software – responsible for processing activities like passenger check-in, boarding and bag drops – disrupted flight across the weekend, with carriers at Brussels airport being told to cancel some 140 of 276 scheduled flights for the following Monday.

Meanwhile, Heathrow is said to have had more than a thousand computers “corrupted”, indicating a likely ransomware attack.

In Berlin, airport authorities said that as of Wednesday morning check-in and boarding were still being handled manually and that passengers should expect delays and cancellations.

A spokesperson for Dublin airport said manual workarounds for check-in and bag drops were still in place as of Wednesday and there was as yet no timeline for when things would return to normal.

An unidentified male in his 40s was arrested in West Sussex, UK on Tuesday evening on suspicion of Computer Misuse Act offences. The UK’s National Crime Agency (NCA) says the investigation remains at an early stage and is ongoing. The man has been released on bail pending further enquiries.

The Bad | DPRK Threat Actor Groups Collaborate to Weaponize Developer Identities

Researchers at ESET have this week offered further evidence that distinct DPRK threat actor groups responsible for the Contagious Interview campaign and the DPRK Fraudulent IT Worker campaign are likely working in concert, using identities stolen from the former to feed the recruitment drive of the latter.

Detailing the activities of a threat actor they call DeceptiveDevelopment, broadly overlapping those of Contagious Interview, the researchers say they uncovered new links between the two campaigns. DeceptiveDevelopment operators use LinkedIn and other social media platforms to pose as recruiters, using fraudulent job offers to lure job seekers and compromise their computers.

Meanwhile, operators running IT worker scams use the information stolen by DeceptiveDevelopment operators to pose as job seekers with companies they wish to infiltrate. The researchers say the fake IT workers initially targeted jobs in the U.S. but have now shifted to European countries such as France, Poland, and Ukraine.

While DeceptiveDevelopment focuses on malware, OSINT shows ties to North Korean IT workers who use fake identities to secure remote jobs, thus surreptitiously funding North Korean state operations. 5/6

— ESET Research (@esetresearch.bsky.social) 25 September 2025 at 10:24

Through an analysis of OSINT data and other research, ESET says the fake IT workers are organized into teams with members working between 10-16 hours per day, pursuing job opportunities, completing tasks and undertaking studies in topics such as web programming, blockchain, AI and English language. The members also use prepared scripts to try and recruit proxies in target countries who would be willing to attend interviews or run laptop farms.

The scale of the DPRK’s activities to infect job seekers and their potential or current employers as well as to use stolen data to infiltrate companies as fraudulent workers has surprised security researchers. The threat presents a different challenge to simply detecting and preventing isolated campaigns and underscores the need for security teams and recruitment teams to develop workflows that can identify fraudulent applications. At the same time, enterprises are urged to ensure they lockdown their internal resources with a trusted security platform that can prevent both intrusions and insider threats.

The Ugly | China-Linked Threat Actor Drops Malware on Edge Devices That Sleeps for Over a Year

China-linked threat actors have been targeting U.S. firms in the tech and legal sectors with a stealthy backdoor known as BRICKSTORM, likely with the aim of infecting a broader range of downstream victims and feeding development of new zero days, Google’s Threat Intelligence Group (GTIG) has said this week.

Attributing the activity to UNC5221, GTIG said the threat cluster was distinct from the widely-reported activities of Silk Typhoon, named as responsible for a number of attacks on U.S. interests earlier this year. UNC5221’s activities are specifically focused on obtaining and maintaining long-term access via backdoors on appliances and network edge devices that typically cannot support endpoint security software due to limited processor power, memory and storage space.

The researchers said initial access was difficult to determine due to the lengthy dwell time between infection and attack, on average 393 days, which often exceeded log retention periods. However, in one case, it was determined that the intrusion leveraged a security flaw in Ivanti Connect Secure devices to obtain initial access.

Having gained a foothold, UNC5221 deploy a Linux/BSD malware known as BRICKSTORM, a Go-based backdoor, to a network appliance before pivoting to VMware vCenter and ESXi hosts, using valid credentials captured from the network appliance.

GTIG said a common theme across incidents was the threat actor’s interest in emails of key individuals within the victim organization, in particular those of developers and system administrators. The attackers used Microsoft’s Entra ID Enterprise Applications with mail.read and full_access_as_app scopes to gain access to every mailbox.

Hunting for BRICKSTORM creates challenges for defenders as the malware typically resides on devices that lack EDR telemetry. Google has released a scanner tool to help search for known samples, along with comprehensive advice for threat hunting and hardening of devices.

The Good | Federal Courts Crack Down on BreachForums & UNC3944 Cybercrime Operators

Conor Brian Fitzpatrick, the 22-year-old operator of the notorious BreachForums hacking site, has been resentenced to three years in prison after a federal appeals court overturned his earlier punishment of time served and supervised release. Known online as “Pompompurin”, Fitzpatrick launched BreachForums in 2022 after the FBI dismantled RaidForums, quickly attracting more than 330,000 members.

The site was a major hub for trading data stolen from telecom providers, healthcare companies, social networks, investment firms, and U.S. government agencies. Fitzpatrick was first arrested in March 2023 and pleaded guilty to being the site’s administrator. Prosecutors sought more than 15 years due to his violations of pretrial conditions, which included secretly using VPNs and unmonitored devices, but the court ultimately imposed a three-year prison term.

Meanwhile, U.K. authorities have advanced their fight against hacking collectives. Two teenagers, 18-year-old Owen Flowers of Walsall and 19-year-old Thalha Jubair of East London, were arrested in connection with the August 2024 cyberattack on Transport for London (TfL). Both are believed to be members of the UNC3944 collective, known most recently for targeting large organizations across multiple verticals.

Flowers faces additional charges for conspiring to breach U.S. healthcare providers, while Jubair has been charged in the U.S. with computer fraud, wire fraud, and money laundering tied to more than 120 global breaches that netted $115 million in ransom. The TfL attack disrupted internal operations, delayed refunds, and exposed customer data including names, addresses, and contact details. Previous arrests in July linked UNC3944 to cyberattacks on major UK retailers such as Harrods and Marks & Spencer.

The Bad | China-Linked TA415 Uses U.S.-China Trade Lures in Targeted Espionage Campaigns

A Chinese state-sponsored threat actor known as TA415 has been linked to a string of spearphishing attacks against U.S. government entities, think tanks, and academic institutions in July and August. The campaign tailored its lures by using U.S.-China economic and trade topics, even impersonating the U.S.-China Business Council and the Chair of the House Select Committee on Strategic Competition to target individuals focused on relations and policy between the two nations.

Emails appeared to invite recipients to closed-door briefings and were sent from uschina@zohomail[.]com, with links to archives hosted on Zoho WorkDrive, Dropbox, and OpenDrive. These archives contained a decoy PDF and a Windows shortcut (LNK) file, which executed a batch script that deployed WhirlCoil, an obfuscated Python loader. The malware was able to establish persistence via scheduled tasks and open Visual Studio Code Remote Tunnels to grant attackers backdoor access and enable arbitrary command execution.

The collected data, including system information and user files, was exfiltrated through request logging services in base64-encoded HTTP POST requests. While early variants downloaded WhirlCoil components from Pastebin and Python.org, the infection chain has remained largely consistent since its first noted use in 2024 against aerospace, insurance, and manufacturing firms.

The continued abuse of Visual Studio Code Remote Tunnels highlights the challenge for defenders: since the feature is legitimate, it blends into normal developer workflows, and is hard to detect without specific monitoring. Analysts note that TA415, which overlaps with APT41, has gradually refined this technique over the past year, ramping up activity in recent months as U.S.-China trade negotiations intensify.

The Ugly | Chaos Mesh Vulnerabilities Put Kubernetes at Risk of Full Cluster Takeovers

Researchers have revealed multiple critical flaws in Chaos Mesh, an open-source Chaos Engineering platform for Kubernetes designed to simulate, test, and identify potential weak spots in pods, networks, and other components. If exploited, the four vulnerabilities, collectively named Chaotic Deputy, could allow attackers to take over entire clusters.

The report warned that attackers need only minimal in-cluster network access to exploit the vulnerabilities, enabling them to run fault injections, shut down pods, disrupt communications, and even steal privileged tokens for further attacks.

CVE-2025-59358 (CVSS 7.5) exposes an unauthenticated GraphQL debugging server that lets attackers kill arbitrary processes in any Kubernetes pod, which could lead to cluster-wide denial-of-service. CVE-2025-59359, CVE-2025-59360, CVE-2025-59361 (all, categorized as CVSS 9.8) are command injection flaws in the Chaos Controller Manager’s GraphQL mutations (cleanTcs, killProcesses, and cleanIptables, respectively) that allow remote code execution (RCE).

Chaotic Deputy stems from insufficient authentication in the Chaos Controller Manager’s GraphQL server. An in-cluster attacker with initial access to a network could chain the four vulnerabilities to execute arbitrary commands on the Chaos Daemon, achieving full cluster compromise. The result could mean data theft, service disruption, and lateral movement across Kubernetes environments.

The flaws were responsibly disclosed in early May and patched in Chaos Mesh version 2.7.3, released August 21. Users are strongly urged to upgrade immediately, and if patching isn’t possible, mitigations include restricting network traffic to the Chaos Mesh daemon and API server as well as avoiding deployments in open or weakly secured environments.

Researchers stressed that while Chaos Engineering platforms offer the ability to test resilience, their deep cluster access and flexibility makes them a high-value target and vulnerabilities like Chaotic Deputy can be especially risky if left unpatched.

The Good | U.S. Charges Ransomware Operator, Sanctions $10B Scam Networks & Secures BlackDB Guilty Plea

Kosovo national Liridon Masurica (33), has pleaded guilty to operating BlackDB[.]cc, a cybercrime marketplace active online from 2018 to 2025. Arrested in December 2024 and extradited to the U.S. this May, Masurica has admitted to selling stolen credit cards, compromised accounts, server credentials, and personally identifiable information (PII), primarily from U.S. victims. Cybercriminals would purchase and use the data for identity theft, tax fraud, and financial crimes. Charged with six counts of fraud, Masurica faces up to 55 years in prison.

While Masurica’s conviction highlights the dangers of underground markets, U.S. authorities are also focusing on larger-scale fraud networks. The Department of the Treasury has sanctioned major cyber scam networks in Myanmar (formerly Burma) and Cambodia that stole over $10 billion from Americans in 2024, a 66% increase from 2023. These operations, often run with forced labor and human trafficking, engage in romance scams and fake crypto schemes. OFAC named 19 individuals and entities tied to the Karen National Army (KNA) and Cambodian crime groups. The sanctions freeze U.S. assets, cut access to international finance, and disrupt operations despite no arrests.

Building on these actions, the U.S. Department of Justice has charged Ukrainian national Volodymyr Tymoshchuk (aka deadforz, Boba, msfv, and farnetwork) for administering the LockerGoga, MegaCortex, and Nefilim ransomware operations. From 2019 to 2021, he and accomplices breached over 250 companies worldwide, stealing millions and disrupting critical services. Tymoshchuk allegedly managed Nefilim, granting affiliates access for a share of ransom payments. Already on FBI and EU most wanted lists, he faces multiple fraud and computer crime charges. The U.S. State Department is offering $10 million for information leading to his capture.

The Bad | ‘GhostAction’ Supply Chain Attack Exfiltrates Thousands of Secrets from GitHub

Cyber researchers have uncovered a large-scale software supply chain attack on GitHub dubbed “GhostAction”, which has exposed more than 3,300 secrets, including PyPI, npm, DockerHub, GitHub tokens, Cloudflare API keys, AWS access keys, and database credentials so far.

The campaign came to light after suspicious activity was detected in the FastUUID project on September 2. Attackers had compromised maintainer accounts and injected a malicious GitHub Actions workflow designed to trigger on code pushes or manual dispatch.

Once activated, the workflow harvested secrets from the environment and exfiltrated them via a curl POST request to an attacker-controlled server. In FastUUID’s case, its PyPI token was stolen, though no malicious package uploads were made prior to the breach being contained.

Further investigation revealed that the incident was far more widespread than just FastUUID. At least 817 repositories were found to contain similar malicious commits, all sending stolen secrets to the same endpoint. To maximize the theft, attackers enumerated secret names from legitimate workflows, then hardcoded them into their own scripts.

By September 5, researchers had notified GitHub, npm, and PyPI, while also filing issues across 573 impacted repositories. One hundred projects, at this point, had already detected and reverted the malicious commits. Soon after disclosure, the exfiltration endpoint was taken offline, but not before significant damage occurred.

The exposure affects at least nine npm and 15 PyPI packages, leaving open the possibility of malicious releases unless maintainers revoke compromised tokens. While the campaign shares similarities with the AI-powered ‘s1ngularity’ attack on over 2100 GitHub accounts from August, researchers believe GhostAction is altogether a separate operation.

The Ugly | House Panel Warns of Chinese Cyber Espionage Exploiting Political Communication

Highly targeted cyber espionage campaigns amidst tense trade negotiations between the U.S. and China have led the House Select Committee on China to issue an advisory warning. These campaigns, linked to the PRC, are focused on U.S. government agencies, business groups, law firms, and think tanks while the two economic powers continue talks on tariffs and diplomacy.

According to the committee, suspected threat actors based in China impersonated Republican Party Congressman John Robert Moolenaar (R-MI) in phishing emails sent out to trusted contacts. The emails, framed as requests for input on sanctions against China, carried attachments that deployed malware to steal sensitive data and establish persistence. So far, the actors are believed to be APT41, a prolific state-backed group known for global espionage campaigns.

Moolenaar, who is also the Chairman of the House Select Committee, stressed that these attacks aim to steal U.S. strategy and leverage it against Congress, the Administration, and the American people. Historically, the campaign aligns with tactics often used by state-sponsored threat actors, including abuse of cloud services and legitimate software to obscure activity and exploit personal or unofficial communication channels. The Chinese embassy has rejected the allegations, stating it “firmly opposes and combats all forms of cyber attacks and cyber crime” and opposes accusations without solid evidence.

Adversaries are increasingly exploiting the extension of modern political communication. Not all exchanges occur over official government accounts or devices, and attackers are capitalizing on trusted officials that engage with partners through personal or less-secure channels. By masquerading as familiar public figures and using the right lures, they can amplify authenticity and carry out their objectives while evading detection.

The Good | U.S. Puts $10m bounty on Heads of Three Russian FSB Threat Actors

The U.S. Department of State has announced a bounty of up to $10 million for information on three Russian Federal Security Service (FSB) officers accused of orchestrating cyberattacks against U.S. critical infrastructure. The officers, Marat Valeryevich Tyukov, Mikhail Mikhailovich Gavrilov, and Pavel Aleksandrovich Akulov, are thought to be linked to FSB’s Center 16 (aka Military Unit 71330).

The same trio was also charged in March 2022 for a long-running campaign (2012–2017) that targeted U.S. government agencies, including the Nuclear Regulatory Commission and various energy firms. One such firm, Wolf Creek Nuclear Operating Corporation, operates a nuclear power plant based in Burlington, Kansas. According to the State Department, Tyukov, Gavrilov, and Akulov’s operations extended to over 500 foreign energy companies in 135 other countries.

Just a few weeks ago, the FBI warned that the same actors had been exploiting CVE-2018-0171 in outdated Cisco networking devices over the past year. The vulnerability allows attackers to remotely execute code on unpatched systems, allowing them to breach multiple companies across U.S. critical infrastructure sectors. The networking firm has since released a patch for the flaw and urged network admins to update their devices.

The FSB-linked group has a long history of targeting U.S. state, local, tribal, and aviation entities. Tips can be submitted anonymously via the department’s Tor-based Rewards for Justice channel, with the possibility of relocation for informants.

The Bad | Ethereum Smart Contracts Drive New NPM Malware Delivery Campaign

Two newly uncovered malicious npm packages are using Ethereum smart contracts to conceal and deliver malware, highlighting evolving attacker tactics in software supply chain attacks. The packages, colortoolsv2 and mimelib2, were uploaded in July 2025 and later removed.

According to security researchers, the packages trigger code that fetches a second-stage payload from attacker-controlled servers once they are imported into a project. While the packages can be easily exposed for their malicious functionality, GitHub projects that imported them make them appear credible to unsuspecting users. What sets this operation apart is its use of Ethereum smart contracts to host the URLs for payload delivery, a method reminiscent of the EtherHiding technique. By leveraging decentralized blockchain infrastructure, attackers can better obscure their command and control (C2) mechanisms and avoid takedowns.

Further investigation has linked the npm packages to a wider campaign involving bogus GitHub repositories disguised as cryptocurrency trading tools, including solana-trading-bot-v2, ethereum-mev-bot-v2, and hyperliquid-trading-bot. These repositories all falsely advertised automated trading capabilities, targeting developers and crypto enthusiasts. The accounts tied to this activity were connected to a distribution-as-a-service (DaaS) cluster dubbed ‘Stargazers Ghost Network’, known for manipulating repository popularity through fake stars, forks, and commits.

These incidents point to a broader trend: crypto-related supply chain attacks are accelerating and growing more sophisticated. As threat actors weaponize blockchain technology to distribute malware, developers are being urged to go beyond surface metrics when evaluating libraries and to rigorously vet both open-source and third-party code for signs of tampering. Proactive scrutiny, including reviewing not just downloads and commit history but also the credibility of maintainers, remains the first line of defense against malware hidden in trusted repositories.

The Ugly | DPRK Threat Actors Leverage Cyber Threat Intel Tools to Manage Campaigns

SentinelLABS and Validin have revealed that North Korea-aligned threat actors behind the Contagious Interview campaign cluster actively monitor cyber threat intelligence (CTI) platforms to track exposure of their infrastructure and scout new assets. The actors operate in coordinated teams, communicating via common enterprise tools like Slack, while drawing on sources such as Validin, VirusTotal, and Maltrail to inform their operations.

Although they recognize their infrastructure is detectable, these actors make only limited modifications to conceal it. Instead, they focus on rapidly deploying new assets following service provider takedowns, maintaining high victim engagement over preserving older infrastructure. This approach reflects both resource constraints and internal incentives, as decentralized teams compete to protect individual assets rather than coordinate large-scale security updates.

Between January to March 2025, SentinelLABS identified more than 230 victims, most of them cryptocurrency professionals, though the actual number is likely higher. Targets are lured through fake job offers using the ClickFix social engineering technique, which manipulates candidates into running malicious commands under the guise of assessments or troubleshooting errors.

Accompanying reporting by Reuters highlights how these scams have become common in the crypto industry. Interviews with victims, including developers, consultants, and executives, confirmed the sophistication of the fraudulent offers as well as financial losses suffered. The reporting humanizes the impact and the breadth of the campaign, showing how Pyongyang-backed actors exploit trust and professional networks to steal digital assets.

Effective mitigation requires vigilance from job seekers, especially those in the cryptocurrency sector, alongside proactive disruption of malicious infrastructure by service providers. Close collaboration, intelligence-sharing, and media exposure are also essential in reducing the reach and impact of these campaigns.