Researchers Pose as Fake Crypto Startup to Hire Suspected North Korean IT Workers
Security researchers created a fictitious cryptocurrency startup and hired three individuals they believe were North Korean IT operatives, as part of an…
Tag: cyber espionage
Chrome Remote Desktop: Remote Access Tool Used by Operatives
Chrome Remote Desktop is a remote access tool that allows users to control computers remotely. A suspected North Korean operative installed it…
2fa.cn: Two-Factor Authentication Bypass Tool
2fa.cn is a tool used for passing two-factor authentication codes between operators. It was observed in the undercover operation, replacing previously used…
Kimsuky Builds Offline AI Stack to Boost Phishing and Malware Operations
North Korea's Kimsuky hacking group, operating under the Reconnaissance General Bureau, has been assembling an offline artificial intelligence (AI) stack on its…
NullReceiver: New Ethereum-Based C2 Technique Hides IP in Recipient Addresses
Cybersecurity researchers have uncovered a new evolution of the EtherHiding blockchain-based command-and-control (C2) technique, dubbed NullReceiver, which conceals the C2 server IP…
Hijacked Hotel Wi-Fi Serves Fake Updates to Deploy CornFlake RAT in CaptiveCrunch Campaign
Microsoft has disclosed a cyber espionage campaign, tracked as CaptiveCrunch, that abuses hijacked hotel Wi-Fi captive portals to deliver a remote access…
Russian Hackers Exploit Microsoft OWA Flaw to Maintain Mailbox Access After Credential Rotation
Russian threat actors linked to the exploitation of a Zimbra vulnerability have been observed exploiting CVE-2026-42897, a cross-site scripting (XSS) flaw in…
Nimbus Manticore Deploys NightLedger Backdoor and WebSocket Tunnelers in Multi-Region Espionage Campaign
Iranian state-backed hacking group Nimbus Manticore (also known as GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549) has been linked to…
Nimbus Manticore: Iranian State-Backed Cyber Espionage Group
Nimbus Manticore, also tracked as GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail, and UNC1549, is an Iranian state-backed hacking group known for…
Fake Notepad++ Plugin Delivers MATCHBOIL.V2 in UAC-0099 Attacks
The Computer Emergency Response Team of Ukraine (CERT-UA) has warned of a new campaign involving a malicious program disguised as a Notepad++…