797 reports
Rekt News describes a January 2025 compromise of Phemex hot wallets that drained roughly $73 million across more than a dozen blockchains. The attacker moved through wallets on Ethereum, Solana, XRP, Bitcoin, BSC, Sui, Base, Tron, Litecoin, Avalanche, Arb…
AhnLab reports that Andariel used malicious files and a CreateHiddenAccount-style tool to perform RID hijacking during Windows intrusions. The technique modifies SAM registry values so a low-privilege or newly created hidden account is treated as having t…
The Korean analysis attributes a tax-collection correction request-themed `.hwp.lnk` sample to Konni APT, a North Korean-linked group described as targeting government and organizational victims in South Korea and the United States. The LNK command search…
ESRC reports an active phishing campaign impersonating domestic portal customer-support notices, including takedown, account-change, and policy-violation themes. The emails contain buttons leading to attacker-controlled phishing pages that closely mimic l…
The FBI warned that North Korean IT workers have expanded beyond revenue generation into data theft and extortion against U.S. businesses. Recent cases include workers using unlawful network access to exfiltrate proprietary data and code, copy repositorie…
The U.S. Justice Department indicted two North Korean nationals and three alleged facilitators for a remote IT worker scheme that obtained jobs at at least 64 U.S. companies from 2018 to 2024. Prosecutors allege the defendants used forged and stolen ident…
Nisos traced a likely DPRK IT worker who appears to have used multiple personas to obtain remote software engineering and full stack developer roles with Japanese companies. The investigation pivoted from an email address cited in a UN sanctions report to…
Logpresso reports a Kimsuky-linked APT attack against prominent Korean law firms using a malicious Hangul document lure related to a defense industry digital innovation seminar. The document used password protection and OLE object execution to drop files …
S2W analyzed a January 2025 phishing email that used a defense industry digital innovation seminar lure to deliver a malicious HWP document linked to Kimsuky Babyshark activity. The attachment embedded an OLE object that dropped files for persistence and …
AhnLab reports that the Andariel threat group used RID Hijacking during intrusions to manipulate Windows account relative identifier values and elevate privileges. The technique can make a limited or guest account inherit administrator-like access, suppor…
| Cloudflare Sorry, you have been blocked You are unable to access s2w.inc Why have I been blocked? This website is using a security service to protect itself from online attacks. The action you just performed triggered the security solution. There are se…
FSI's JSAC 2025 talk explains how South Korean financial-sector defenders turn high-volume CTI into usable detection and hunting workflows. The speaker describes DPRK state-sponsored activity as a daily concern for Korean financial institutions and uses t…
KISA’s JSAC 2025 presentation describes North Korean hacking activity targeting centralized management solutions used to administer corporate devices. The speakers tie the investigation to Maui ransomware leads, attacker Google account activity, leased Ko…
A U.S. civil forfeiture complaint seeks approximately 942,462.845 USDT in connection with an investigation into identity theft, computer fraud, wire fraud, money laundering, and related conspiracies. The excerpt establishes the legal basis for seizing vir…
ANY.RUN analyzes InvisibleFerret, a Python malware used in North Korean job-interview campaigns known as Contagious Interview or DevPopper. The campaign targets developers in technology, finance, and cryptocurrency sectors by posing as hiring workflows an…