Threat Intelligence Center

Conceptual image of cybersecurity threats, highlighting North Korean hackers using coding tasks to breach digital security.

Security researchers have uncovered a coordinated campaign by North Korean threat actors using the Contagious Interview framework to distribute malicious VS Code extensions to cryptocurrency developers, finance professionals, and technology workers. The attack leverages fake coding interview tasks that inject malicious code through tasks.

Conceptual image illustrating cybersecurity measures against IronWorm malware in GitHub repos for data protection.

GitHub has disabled multiple Microsoft repositories that were actively distributing IronWorm, a password-stealing malware attributed to threat actors Miasma and Shai-Hulud. The campaign targeted developers and organizations in AI/ML and cloud computing sectors through compromised repository infrastructure.

Conceptual cybersecurity image illustrating vishing and physical intrusions as threat vectors in data protection efforts.

Threat researchers have identified UNC3753 conducting a coordinated data theft and extortion campaign against U.S. financial services, legal services, and professional service firms. The group combines vishing attacks with physical intrusions to gain initial access, then deploys remote access tools including AnyDesk, Bomgar, Zoho Assist, and SuperOps RMM to establish persistence.

Conceptual image of cybersecurity threats, highlighting account takeover and data protection in government messaging services.

The threat actor group ShinyHunters has successfully compromised a French government messaging service through account hijacking attacks. This breach of public sector communications infrastructure exposes the vulnerability of authentication mechanisms protecting sensitive government operations.

Conceptual cybersecurity image illustrating threat vectors bypassing NTLM for enhanced data protection and digital security.

Security researchers have identified an unpatched NTLM coercion vulnerability in Windows Search's URI handler that mirrors known attack patterns but remains unassigned and unfixed. Attackers can exploit this mechanism using tools like Responder to force authentication attempts and capture credentials.

Conceptual image illustrating cybersecurity threats, highlighting AgentPSD malware and data protection strategies.

Security researchers have identified a coordinated campaign by Chinese APT groups UNC5221, UNC6201, and VerdantBamboo deploying multiple malware families including AgentPSD, Brickstorm, Grimbolt, and Plenet to maintain long-term access to hacked networks.

Conceptual cybersecurity image illustrating threat vectors targeting US law firms with BAZARLOADER and LOCKBIT.BLACK.

A sustained and targeted campaign is actively compromising US law firms through coordinated efforts by multiple threat actors including Luna Moth, Chatty Spider, Silent Ransom Group, and UNC2686. The attackers deploy a sophisticated toolkit featuring BAZARLOADER, TRICKBOT, URSNIF, and LOCKBIT.

Threat Intelligence Center

North Korean Hackers Use Fake Coding Tasks to Steal Crypto

GitHub Disables Microsoft Repos Pushing IronWorm Password-Stealing Malware

UNC3753 Uses Vishing and Physical Intrusions in U.S. Data Theft Extortion Campaign

ShinyHunters Hijacks French Government Messaging Service in Account Takeover Attack

Windows Search URI Handler Coercion Bypasses NTLM Without CVE or Patch

Chinese APT Deploys AgentPSD Malware to Maintain Network Access

Luna Moth and Chatty Spider Target US Law Firms with BAZARLOADER and LOCKBIT.BLACK

More Articles …

About Us

Areas We Serve

Get the latest news!