Kudelski Security and Sekoia analyze how North Korea organizes cyber operations across state agencies, threat clusters and overseas IT workers, using them for espionage, revenue generation and sanctions evasion.
Kudelski Security researchers link stealer-log evidence, gambling operations and infrastructure to DPRK-related actors, and assess that a fake IT worker manager used IPs associated with Emotet delivery. Several attribution and location findings remain uncertain.
Kudelski Security uses public data and stealer logs to map changes in DPRK fake IT worker infrastructure, identify VPN exit nodes and internal network clusters, and assess possible organizational links with varying levels of confidence.
Kudelski researchers describe how DPRK-linked operators use fake developer interviews and a trojanized GitHub project to install a backdoor that collects system data, exposes environment secrets, and enables remote commands.
An advisory reports that attackers compromised Klue’s backend, stole customer integration OAuth tokens, and used them to extract CRM and other business data from connected SaaS services, including systems used by Huntress.
A reported global campaign targets internet-facing Fortinet devices using reused credentials and brute force. Researchers say tens of thousands of devices may be affected; links to recently patched vulnerabilities remain unconfirmed.
Kaspersky reports that trojanized DAEMON Tools versions 12.5.0.2421–12.5.0.2434 have distributed malware since April 8, 2026. The active campaign uses compromised installers to deliver targeted payloads and communicate with env-check[.]daemontools[.]cc.
Kudelski Security reports that the TeamPCP-attributed Mini Shai Hulud campaign compromised npm and PyPI packages to steal developer and CI/CD credentials, with propagation through maintainer accounts and automated workflows.
An incident response case describes INC operators exploiting weak FortiGate access and stale, over-privileged accounts to move laterally, exfiltrate about 410 GB, and encrypt systems lacking EDR.
BlueHammer is a publicly disclosed Windows Defender zero-day with a public proof of concept that can let a local low-privilege user escalate access. The article says no official patch is available.
SlowMist reported that a compromised Apifox CDN script ran automatically in the Electron desktop client, stealing credentials and system data and enabling remote code execution. The reported exposure window was March 4–22, 2026.
StepSecurity reported that two compromised Axios npm releases installed a malicious dependency whose postinstall script deployed a RAT on macOS, Windows, and Linux. The article recommends downgrading, checking for compromise, and rotating credentials.