Company

AhnLab

South Korean cybersecurity company providing threat intelligence, malware analysis, and security software, including research on state-linked hacking groups.

Known aliases

AhnLab Security Emergency response Center
AhnLab Security Intelligence Center
AnhLab

Current stories

securityConfirmed17 publishers

South Korea suspects AI agents in bank breaches that leaked data on at least 25,000 Shinhan customers

President Lee Jae Myung says AI appears to have been used in hacks on South Korean banks that leaked data on at least 25,000 Shinhan customers. If his claim that AI removes the need for specialized skills holds up, banks should plan for many more attackers.

Publishers:bleepingcomputer.comcrowdstrike.comdev.toeconomictimes.indiatimes.comen.yna.co.krfastcompany.cominfosecurity-magazine.comlivemint.commezha.netqz.comruntimewire.comscworld.comsecurityaffairs.comthe-decoder.comthecyberexpress.comthehackernews.comtherecord.mediatomshardware.com

Perspective Coverage

18 publishers

Builder: Builder 32%
Operator: Operator 52%
Investor: Investor 16%

Reality

Evidence70
Adoption35
Hype gap+20
Incentives55
Confidence64

securityOne report1 publisher

Insider bank theft prompts North Korea to tighten controls on its hacking teams

Daily NK reports Pyongyang's elite are stunned by the scheme and that Reconnaissance General Bureau officials fear the blame reaching them. Tom Uren expects tighter controls on hacking teams, not fewer operations.

Publishers:news.risky.biz

Reality

Evidence34
Adoption31
Hype gap+17
Incentives48
Confidence43

securityOne report1 publisher

Kimsuky adds Chrome Remote Desktop to a toolkit it never retires

ASEC says the North Korean group now installs Chrome Remote Desktop after AppleSeed lands, while its older VNC and RDP Wrapper activity keeps turning up in logs.

Publishers:asec.ahnlab.com

Reality

Evidence62
Adoption44
Hype gap+8
Incentives55
Confidence58

securityOne report1 publisher

Kimsuky keeps picking RDP, which puts detection on configuration instead of files

AhnLab's latest writeup on the North Korean group shows the bespoke code doing account hiding and port forwarding while a shipped Windows feature carries the actual session.

Publishers:asec.ahnlab.com

Reality

Evidence62
Adoption45
Hype gap+8
Incentives60
Confidence58

securityConfirmed2 publishers

Gunra Goes Franchise: Conti's Leaked Code Now Ships With a Builder and an Affiliate Panel

A six-agency #StopRansomware advisory dated August 10, 2026 gives defenders named CVEs, tooling and file extensions for a group that took about nine months to turn a variant into a business.

Publishers:cyberscoop.comthecyberexpress.com

Reality

Evidence78
Adoption66
Hype gap+12
Incentives45
Confidence74