Ethan Andrews

The North Korean threat actor Andariel (APT45) conducts a blend of strategic cyber espionage and financially motivated ransomware attacks targeting defense, aerospace, nuclear, and healthcare sectors.

Security researcher Chaotic Eclipse released a Windows Zero-Day PoC, LegacyHive, which enables arbitrary registry hive loading for privilege escalation across all supported Windows versions.

The Pluto Hephaestus threat actor utilizes the AI-powered 'Hephaestus' framework to automate the full attack lifecycle against government and educational targets in Southeast Asia and South Korea.

The SMOKE#SCREEN campaign utilizes diverse social engineering lures and aggressive security-dismantling toolsets to deploy persistent ScreenConnect RMM agents on Windows and macOS systems.

Adversaries compromised maintainer accounts and CI/CD pipelines to distribute trojanized PyPI and npm packages targeting quantum computing researchers and Alibaba developers.

An 'evil twin' campaign on Open VSX used 77 counterfeit extensions to exfiltrate developer system info, Git repository metadata, and CI environment details to an attacker-controlled domain.

A state-sponsored threat group and Gunra ransomware actors exploited vulnerabilities in South Korean financial security software like AnySign4PC to deploy SIGNBT and COPPERHEDGE backdoors via watering holes.

Midnight Blizzard sub-cluster Storm-2945 is conducting the CaptiveCrunch campaign, leveraging traffic manipulation in hospitality networks to deliver custom Go and PowerShell malware and conduct device code phishing.

Attackers are using cloned greeting-card templates with globally rewritten anchors to deliver ScreenConnect remote-access installers targeting healthcare data-protection roles.

Adversaries abused a legitimate ServiceNow enterprise ticketing tenant to solicit sensitive financial and vendor verification data from a marine equipment manufacturer via reply-only phishing.