North Korea-linked cyber-espionage group active since 2013, targeting government, defense, academic, media and diplomatic organizations to steal intelligence.
Hacktron AI chained a Discourse image-library flaw to a weakness in OpenAI's single sign-on and into the Codex environment in under 72 hours, after swapping Claude Opus 4.8 for Opus 5 to get a working exploit.
Perspective Coverage
4 publishersReality
Rapid7 says the ted backdoor is built into the victim's existing HAProxy 2.8.12 and hooks its filter API, so the load balancer keeps balancing normally while it logs cookies and injects scripts for selected clients.
Perspective Coverage
5 publishersReality
ConnectWise's stopgap is to switch off file transfers in ScreenConnect, and with CISA's exploited-flaw listing now carrying a three-day federal deadline, more than 1,000 exposed servers still run the unpatched build.
Reality
ConnectWise says the fix arrives later this week. Until it does, the only step it offers is a hand-edited per-role permission change that turns off file transfer inside support sessions, on cloud and on-premises alike.
Reality
ASEC says the North Korean group now installs Chrome Remote Desktop after AppleSeed lands, while its older VNC and RDP Wrapper activity keeps turning up in logs.
Reality
AhnLab's latest writeup on the North Korean group shows the bespoke code doing account hiding and port forwarding while a shipped Windows feature carries the actual session.
Reality