lazarusholic

Everyday is lazarus.dayβ

BreakGlassIntelligence

@breakglassintel, https://intel.breakglass.tech

Reports

2026-04-21
BreakGlassIntelligence
A Third Vultr Seoul Box: 60+ Kimsuky Domains, 18 Months of DDNS Rotation, and a 5-Year Infrastructure Trail
#Kimsuky
2026-04-17
BreakGlassIntelligence
850 Hostnames, 6 Servers, 1 Kill Chain: Mapping Kimsuky's 2026 Korean Credential Harvesting Machine
#Kimsuky #Phishing
2026-04-11
BreakGlassIntelligence
We Dumped a Live Kimsuky C2 and Recovered Every Stage of the Kill Chain: CHM Dropper, VBScript Stager, PowerShell Keylogger
#CHM #Kimsuky
2026-04-05
BreakGlassIntelligence
Ten Operators, Nine Campaigns, and a Backend With No Password: How a Single Vercel URL Exposed a Two-Year Korean Phishing Syndicate
#Kimsuky #Phishing
2026-04-01
BreakGlassIntelligence
Two IOCs In, Five C2 Servers Out: Mapping DPRK's Contagious Interview Campaign From InvisibleFerret to a Kimsuky Crossover
#ClickFix #ContagiousInterview #InvisibleFerret #Kimsuky
2026-03-17
BreakGlassIntelligence
When Nation-States Become Ransomware Affiliates: Lazarus Group Deploys Medusa via a Custom IME-Based Loader
#Lazarus #Medusa #Ransomware
2026-03-16
BreakGlassIntelligence
Lazarus Group is Using the Solana Blockchain as a Dead-Drop C2 Channel -- and Nobody Noticed for 4 Months
#TraderTraitor
2026-03-12
BreakGlassIntelligence
Kimsuky's Five-Stage GrimResource Loader: When an MMC File Becomes a Shellcode Injector
#Kimsuky #GrimResource
2026-03-12
BreakGlassIntelligence
Lazarus Group Caught Running Medusa Ransomware: XOR-Decoded Config Exposes Tor C2, IME-Based Loader, and a 7-Month Intrusion Timeline
#Lazarus #Medusa #Ransomware