Tag: north-korea

CISA KEV Updates, APT28 Campaign, and Agentic AI Security Challenges

CISA flagged three actively exploited vulnerabilities for immediate patching while APT28 continues surveillance operations against Ukrainian forces. Meanwhile, the cybersecurity community grapples with new attack vectors in AI agents and supply chain compromises.

Mar 10, 2026The Hacker News, Microsoft Security, SANS ISC, MSRC Security Updates

cisa-kevapt28agentic-ai

🇷🇺APT28

highVulnerabilities & Exploits

AI-Powered Malware Production Accelerates: Transparent Tribe, VOID#GEIST Campaign Analysis

Pakistan-aligned Transparent Tribe and the VOID#GEIST campaign demonstrate how threat actors are operationalizing AI to mass-produce malware and accelerate attack chains. Microsoft reports North Korean groups like Jasper Sleet are similarly adopting AI tradecraft to scale malicious operations.

Mar 7, 2026The Hacker News, Microsoft Security, SANS ISC, MSRC Security Updates

ai-malwaretransparent-tribevoid-geist

highIndustry & Policy

Nation-State Ops Escalate: AI-Enhanced Infiltration and Cyber-Kinetic Warfare Converge

North Korea and Iran are escalating cyber operations with AI-enhanced worker infiltration schemes and cyber-kinetic warfare tactics. Meanwhile, zero-day attacks on enterprise software reached record highs in 2025, with security appliances being primary targets.

Mar 7, 2026Dark Reading, Infosecurity Magazine

nation-stateai-threatszero-day

🇮🇷MuddyWater

🇺🇸Google

criticalVulnerabilities & Exploits

APT28 Exploits MSHTML Zero-Day; North Korean npm Campaign Evolves

Russian APT28 exploited CVE-2026-21513, an MSHTML zero-day vulnerability, before Microsoft's February patch. North Korean threat actors published 26 malicious npm packages using Pastebin for C2 infrastructure in their ongoing Contagious Interview campaign.

Mar 2, 2026The Hacker News, SANS ISC

apt28zero-daymshtml

🇷🇺APT28

highPrivacy & Surveillance

Privacy Surveillance Roundup: Iran's Digital Apartheid, Job Scam Malware, and $21B Identity Theft Costs

Iran's latest internet shutdown reveals a strategic shift toward permanent digital apartheid with "white SIM" privileges for loyalists, while North Korean actors exploit job seekers with malware-laden coding challenges. Meanwhile, congressional Democrats link data broker breaches to nearly $21 billion in identity theft losses.

Feb 27, 2026Schneier on Security, WIRED Security

iraninternet-shutdownsurveillance

🇺🇸Meta Platforms🇦🇪Telegram

criticalNation-State & APT

Nation-State Roundup: CISA KEV Updates, North Korean IT Infiltration, and Russian Hybrid Warfare Escalation

CISA adds exploited RoundCube flaws to KEV, Ukrainian sentenced for North Korean IT worker scheme, PayPal breach exposes data for six months, and Dutch intelligence warns of escalating Russian hybrid...

Feb 21, 2026Security Affairs, The Record

cisa-kevroundcubenorth-korea