FlagThis - Latest Cybersecurity News

North Korean state-sponsored threat actors, notably the Lazarus Group, are transitioning from manual exploitation to AI-augmented cyber operations. This shift focuses on automating the attack lifecycle through the deployment of AI-powered transcription models to analyze stolen audio from intercepted meetings and LLM-generated phishing templates for high-fidelity social engineering. These tools significantly reduce "time-to-insight" during data exfiltration and facilitate rapid reconnaissance via automated profiling scripts. The integration of AI into DPRK cyber workflows enables the scaling of reconnaissance and increases the success rate of sophisticated financial heists and intelligence gathering against global corporate and diplomatic targets.

Bybit has filed a civil lawsuit in the U.S. District Court for the District of Columbia, invoking the Racketeer Influenced and Corrupt Organizations (RICO) Act against the Lazarus Group and the Democratic People's Republic of Korea (DPRK). The litigation follows a $1.5 billion breach involving sophisticated TTPs, including suspected API exploitation, social engineering, or zero-day vulnerabilities. Technical evidence suggests the use of custom malware and Command & Control (C2) infrastructure, with stolen assets laundered through cross-chain bridges and mixing protocols such as Tornado Cash and Sinbad. This case aims to categorize state-sponsored cyber operations as a continuous criminal enterprise to facilitate civil asset recovery and establish a legal precedent for cyber-warfare litigation.

North Korean (DPRK) threat actors, specifically linked to the FlexibleFerret malware family, are targeting macOS environments through fraudulent Zoom and Google Chrome installers. The campaign leverages a novel .NET-based downloader on macOS to facilitate the deployment of the Overlord Remote Access Trojan (RAT). By utilizing sophisticated social engineering, including deepfake-enhanced video calls, the actors bypass Gatekeeper and macOS security prompts to establish persistence via LaunchAgents and LaunchDaemons. Once installed, the Overlord RAT provides full remote command execution, credential harvesting, and systematic file exfiltration, demonstrating a strategic shift toward using cross-platform frameworks to compromise high-value Unix-based endpoints.

North Korean state-sponsored actors have deployed MacOS.Gaslight, a Rust-based information stealer and backdoor targeting macOS environments. The implant utilizes a novel evasion technique by embedding 38 adversarial prompt injection strings designed to manipulate LLM-based malware triage tools. By targeting the cognitive layer of analysis, the malware attempts to trigger AI safety guards or provide fabricated system context, inducing AI assistants to misclassify the payload as benign or refuse analysis. This strategy directly degrades the accuracy of AI-assisted SOC triage, increasing attacker dwell time by blinding automated security analysis pipelines.

North Korean state-sponsored actors are infiltrating Western corporate networks by posing as legitimate remote IT workers to generate illicit revenue. A critical vulnerability in their operational security has emerged: the actors themselves are being targeted by stealer malware. By analyzing the resulting stealer logs, which contain operator credentials and system metadata, researchers at Kudelski Security are reverse-mapping the regime's obfuscation infrastructure. This includes identifying specific proxy networks, IP ranges, and internal coordination tools used to mask the actors' true locations. This campaign directly facilitates the laundering of funds for the DPRK regime and provides critical financial support for Russian military procurement during the ongoing Ukraine conflict.

North Korean state-sponsored actors, associated with the PolinRider operation and Contagious Interview campaign, are executing a multi-vector supply chain offensive targeting the developer ecosystem. By compromising GitHub maintainer accounts and utilizing package impersonation, the actors injected malicious code into npm, Packagist, and Go ecosystems. The campaign specifically targets modern toolchains, including Claude Code and GitHub CLI, to deploy Windows Remote Access Trojans (RATs), Linux native C rootkits, and credential stealers aimed at SSH keys and developer tokens. With over 108 unique malicious packages and extensions identified, the operation seeks persistent high-level access to DevOps environments and AI-assisted coding workflows.

Gaslight (macOS.Gaslight) is a Rust-based backdoor attributed to North Korean (DPRK) state-sponsored actors, designed for browser credential harvesting from Chrome, Brave, Firefox, and Safari on macOS. The implant utilizes the Telegram Bot API for command-and-control (C2) communications. Its primary innovation is the integration of 38 adversarial prompt injection strings embedded within the binary. These strings are engineered to deceive Large Language Models (LLMs) used by SOC analysts during triage, inducing AI refusals or hallucinated benign classifications to bypass automated analysis and extend attacker dwell time. Detection was initially facilitated by an Apple XProtect update.