company
Cited as having first documented the MISTPEN downloader in 2024.
No evidence-backed relationships are recorded.
Compiling any project that resolved the poisoned crate on August 20 was enough to run a credential stealer. Wiz links the infrastructure to DPRK-attributed campaigns.
Reality
Mandiant's teardown of UNC3944 and UNC6040 puts one weak boundary at the center of both playbooks: a remote service desk that resets credentials for whoever sounds convincing.
Reality
Google Threat Intelligence Group says the crew behind BlackFile spread into Redact, Pink, Helix and Falcon while keeping the same vishing route into Microsoft 365 and Okta.
Reality
Ten months of production use, 12 assigned CVEs, and a two-day sweep of stolen repositories. Discovery has stopped being the bottleneck; human validation has become one.
Reality