X-Industry

Our friends at SentinelLABS have analyzed a Rust macOS implant that embeds a 3.5 KB prompt-injection payload containing 38 fabricated “system” messages, designed to steer an LLM-assisted triage pipeline into aborting or refusing analysis.  Command-and-control runs over a Telegram Bot API polling loop, with AES-GCM payloads over certificate-pinned TLS.

The implant self-redacts its Telegram bot token in its own runtime output, denying it to anyone who captures logs or crash artifacts.  Analysts ha

The US Federal Bureau of Investigation (FBI) has issued a recent advisory, dated 8 January 2026, warning about an emerging and sophisticated cyber threat: North Korean state-sponsored actors, notably the group Kimsuky, are employing malicious QR codes in spear-phishing campaigns.  The FBI's flash alert highlights that, as of 2025, Kimsuky actors, also known by aliases such as APT43, have consistently targeted organizations by embedding malicious QR codes.

These attacks, termed "quishing," are de

Amazon has prevented more than 1,800 suspected North Korean operatives from securing employment since April 2024, as the Pyongyang regime continues efforts to place IT workers in remote roles at Western companies to generate revenue for the regime.  Amazon's Senior Vice President and Chief Security Officer, Stephen Schmidt, revealed the figures in a LinkedIn post, noting a 27% quarter-on-quarter increase in the number of detected DPRK-affiliated applications this year. The aim, he said, is for o

In April 2025, Huntabil.IT observed a targeted attack on a Web3 startup, attributing the incident to a DPRK threat actor group.  Several reports on social media at the time described similar incidents at other Web3 and Crypto organizations.  Analysis revealed an attack chain consisting of an eclectic mix of scripts and binaries written in AppleScript, C++, and Nim.  Although the early stages of the attack follow a familiar DPRK pattern using social engineering, lure scripts, and fake updates, th

In recent news, the cloud-based IT management service JumpCloud publicly shared details gathered from the investigation into an intrusion on their network. Alongside the updated details, the organization shared a list of associated indicators of compromise (IOCs), noting attribution to an unnamed “sophisticated nation-state sponsored threat actor.”  Reviewing the newly released indicators of compromise, we associate the cluster of threat activity to a North Korean state sponsored APT.[1]  The IO