grep -rl "north-korea" ./articles
The exchange's own account says attackers may have used a flaw in a third-party security product to obtain high-level internal credentials, then issued withdrawal commands its systems accepted. Mandiant and SlowMist are reported to date the access to 31 August, three and a half weeks before the transfers. Cold wallets were untouched and private keys were not taken.
Rapid7 found a Linux implant built into the HAProxy binaries of two South Korean organisations, intercepting traffic and erasing its own requests from the proxy's own logs. Every headline calls it an HAProxy backdoor. Installing it requires already owning the host, which makes patching HAProxy the one response that changes nothing.
One cluster ran 22 fabricated personas, submitted 60-plus applications a day across 10 platforms, and reached more than 1,100 companies. The advice — interview in person, check backgrounds — describes the hiring process that remote-first work removed.
arrayref has over 245 million downloads. On 20 August a malicious 0.3.7 appeared on crates.io with a dependency impersonating proc-macro2, whose build script fetched a second stage over TLS with certificate validation switched off. Wiz attributes it to a North Korean actor on infrastructure overlaps with two earlier campaigns.
Genians found the stack on infrastructure linked to the North Korean espionage unit. Running models offline means stolen documents never touch a provider, and no usage policy applies. That is the point.
Ballena Azul did not exist. The recruitment did. Three developers came through a referral chain, signed contracts, got VM access — and within minutes ran dxdiag and checked which country their connection appeared to come from.