News

KP·GBGBHackers

A Kimsuky campaign that delivers Funhouse ransomware through a malicious Hangul document disguised as a resume. The operation combines embedded OLE objects, sequential scripts, a Python backdoor, and Quasar RAT, linking the September 2026 activity to earlier Endpoint ransomware deployments attributed to the group. The findings indicate continuity rather than an entirely new ransomware operation. […] The post Kimsuky Uses Quasar RAT to Deploy Funhouse Ransomware Through Multi-Stage Scripts appear

KP·GBGBHackers

DPRK-linked operators behind the Cross-Chain TxDataHiding (XCTDH) campaign have expanded their blockchain-backed command-and-control infrastructure with a new Ethereum-based recovery channel dubbed HashHiding. The technique stores an active C2 IP address and port inside the recipient address of ordinary Ethereum transfers, allowing infected systems to recover attacker infrastructure without relying on domains, smart contracts, or transaction […] The post DPRK-Linked Hackers Add HashHiding to Blo

KP·GBGBHackers

North Korea-linked threat actor Konni has launched a targeted cyberespionage operation against Ukraine-focused entities using malicious Windows shortcut files disguised as PDF documents. The campaign, tracked by SOCRadar Threat Research Unit as Operation Conflict Compass, deploys a modular PowerShell malware family dubbed VelvetCake to collect intelligence on the Russia-Ukraine war. The activity appears designed to […] The post Operation Conflict Compass Deploys VelvetCake PowerShell Malware Thr

KP·GBGBHackers

North Korean threat actors, known as WaterPlum (also referred to as Contagious Interview), have infected at least 30,000 devices in over 100 countries by luring software developers and IT professionals into malicious job interviews. This campaign specifically targets web developers, freelancers, blockchain specialists, and cryptocurrency professionals. The attackers use persuasive recruitment messages that mimic legitimate […] The post North Korean WaterPlum Hackers Target IT Professionals With

KP·GBGBHackers

North Korean state-backed threat actor Kimsuky is extending its established espionage playbook with locally hosted artificial intelligence tooling, according to new research into an activity cluster tracked as Operation GitPower. The campaign retains familiar phishing-led intrusion chains but shows the operators preparing AI-assisted capabilities for malware development, data analysis, social engineering, and operational automation. The […] The post Kimsuky Uses Local AI Development Environment