grep -rl "apt" ./articles
QUIRSO traced exploitation of CVE-2026-59310 across 47 countries, with victims first contacting attacker infrastructure on 3 August. The persistence mechanism is a cron job running an open-source reverse SSH tool.
CERT-UA describes UAC-0145 posing as recruiters for a real consulting firm, running Zoom interviews, then handing over a WireGuard config that fails on purpose — so the candidate downloads 'SopraVPN' instead.
Genians found the stack on infrastructure linked to the North Korean espionage unit. Running models offline means stolen documents never touch a provider, and no usage policy applies. That is the point.