Triaging the Week 130
AI as Weapon and Target // Your Marketplace Is Your Perimeter // Ransomware & the Vanishing Patch Window // The Hiring Pipeline Is an Attack Vector // SaaS, Silicon, and Statecraft
Hello there 👋
Welcome back to the Kraven Security weekly newsletter, triaging the week. We round up the week's top news stories, highlight our featured article, give you some learning resources, and finish with a few personal notes about what’s happening at the company. Enjoy!
Top News Stories
Theme 1: AI Is Now Both the Weapon and the Target
Stories
🗞️ Massive “Slopsquatting” Campaign Hits NPM: Over 700 AI-Generated Malicious Packages Found — Attackers flooded NPM with 700+ AI-generated packages carrying NUL1DROPPER, targeting mobile SDK installs across Windows, macOS, and Linux. Typosquatting has industrialized into slopsquatting: AI mass-produces plausible package names to overwhelm registry defenses, and the dropper skips install scripts to stay evasive. 🔎 Threat Hunting Package
🗞️ CSS: The Silent Bomb Inside Your Inbox — PortSwigger showed how sanitiser/browser rendering gaps let CSS in webmail drive spoofed UI actions, prompt injection, and account takeover. <label> tags and :before/:after pseudo-elements let attackers show the user one thing while feeding the AI assistant something else entirely.
🗞️ Atlassian Rovo Exfiltrates Sensitive Data via Zero-Click Indirect Prompt Injection — PromptArmor found Rovo silently leaking Jira tickets and Confluence docs to external URLs with no user interaction. Disabling org-wide web search doesn’t help — the underlying URL-retrieval tool remains active, so hidden prompts hijack execution without an approval step and no UI trace.
🗞️ Critical Zero-Click RCE Vulnerability Discovered in Zoom via Autonomous AI — CVE-2026-53413, a memory-corruption flaw in Zoom’s annotation protocol, grants meeting participants full device control with zero interaction. The kicker is the discovery cost: nation-state-grade zero-click, found and weaponized in under 24 hours with fewer than 20 prompts on public models.
Recommendations
☑️ Treat AI agents as untrusted execution paths — audit connector permissions, disconnect unvetted third-party integrations, and assume any content an agent reads can instruct it.
☑️ Enforce egress controls and network monitoring on AI workloads to catch dynamic URL calls and anomalous outbound HTTP.
☑️ Don’t rely on HTML/CSS sanitization as a security boundary; back it with strict CSP to block CSS exfiltration and unauthorized external requests.
☑️ Pin dependencies with lockfiles and run SCA before deployment — manual review for any new unverified package, especially mobile SDKs.
☑️ Patch Zoom Workplace to 7.1.5 (7.0.6+ for E2EE configs) and sandbox collaboration clients so memory corruption doesn’t reach the host.
☑️ Build prompt-injection testing and output sanitization into your AI governance process before autonomous assistants touch internal repositories.
Theme 2: Your Marketplace Is Your Perimeter
Stories
🗞️ Are Your VS Code Extensions Stealing Your Crypto? Unpacking the “Solidity Pro” Malware Campaign — WhiteCobra is shipping malicious VS Code and Open VSX extensions posing as premium Web3 tooling, harvesting wallets, credentials, and API keys via Telegram bots. Decoy clean versions plus randomized multi-hour execution delays defeat scanners that only watch a package for minutes. 🔎 Threat Hunting Package
🗞️ Massive VPN Extension Hijack Exposed: Over 700 Chrome Add-ons Hijacking Browser — 737 Chrome VPN extensions impersonated legitimate brands to intercept browser sessions, aimed at Russian-speaking users evading censorship. They resolved malicious proxy domains over DNS-over-HTTPS via Cloudflare and Google, so the victim machine never emitted a plaintext DNS query to alert on. 🔎 Threat Hunting Package
🗞️ Poisoned API Response Hits BDThemes WordPress Ecosystem — Attackers compromised BDThemes’ API infrastructure to push backdoors straight into WordPress sites running plugins like Element Pack Pro. Poisoning the vendor’s central API response means no individual site credential ever needed to be compromised.
🗞️ AI Supply Chain Risk Exposed: 2,500+ Companies and 434k CI/CD Pipelines at Risk — CloudSEK found embedded credentials and API tokens leaking across AI development workflows, exposing hundreds of thousands of build pipelines. Hardcoded keys in AI config files and build scripts turn ML pipelines into first-class supply chain attack vectors.
Recommendations
☑️ Enforce allowlisting for browser and IDE extensions — approved publishers only, and treat inflated download counts as a red flag rather than a trust signal.
☑️ Audit WordPress estates running BDThemes plugins now for backdoors, rogue admin accounts, and unexpected file changes; add WAF rules and file integrity monitoring.
☑️ Scan every repo and CI/CD environment for exposed keys, then revoke and rotate — treat this as an incident, not hygiene.
☑️ Gate credentials at the door with secret scanning in pre-commit hooks and build gates, backed by a central vault (Vault, AWS Secrets Manager).
☑️ Restrict outbound server connections and stage vendor updates in isolated test environments before production.
☑️ Monitor for anomalous proxy connections, including traffic hiding behind DoH.
☑️ Never leave seed phrases or unencrypted wallet keys in a development workspace.
Theme 3: Ransomware and the Vanishing Patch Window
Stories
🗞️ Storm-1175 Shifts Tactics: New StormEncryptor Ransomware Hits N-central Servers — A China-based actor previously tied to Medusa is exploiting an auth bypass in self-hosted N-central RMM to deploy a new C++ locker, with a three-day ransom clock. Microsoft warns the group is moving from initial access to exfiltration and encryption within days, not weeks.
🗞️ FBI & South Korea Issue Urgent Warning on Gunra Ransomware Targeting Critical Infrastructure — Gunra, a RaaS operation linked to Lazarus, is breaching critical infrastructure through unpatched Fortinet firewalls and demanding $10M+ while harassing victim management directly. Defenders have a rare win here: a flaw in the Linux variant lets responders reconstruct encryption keys from file timestamps and recover without paying. 🔎 Threat Hunting Package
🗞️ A New Rust-Based Ransomware Leveraging Decentralized Infrastructure — DeadLock pairs double extortion with a decentralized recovery ecosystem, hitting IT, mining, logistics, manufacturing, and hospitality across Europe. Running negotiation and leak infrastructure over the Session messaging network and blockchain services keeps them online through takedown attempts. 🔎 Threat Hunting Package
🗞️ Critical SharePoint Auth Bypass Exploited Post-PoC Release — CVE-2026-55040 lets unauthenticated attackers impersonate users and admins on internet-facing on-prem SharePoint. Exploitation started almost immediately after the public PoC dropped, and chaining with CVE-2026-63520 gets you full unauthenticated RCE.
Recommendations
☑️ Patch the named entry points now: N-able hotfix 2026.3 HF1 (CVE-2026-18577), Fortinet CVE-2024-55591 and CVE-2025-24472, and July/August 2026 SharePoint updates.
☑️ Get RMM consoles, SharePoint Central Administration, and firewall management off the public internet — front them with a reverse proxy or VPN requiring pre-auth.
☑️ Hunt for the specific artifacts: rogue svchost.exe in Documents folders, an unexpected “Cloudflared” service, and anomalous child processes spawned by w3wp.exe.
☑️ Tune EDR to block event log clearing, batch-script UAC bypasses, and termination of security services; enable AMSI across SharePoint web apps.
☑️ Hold immutable, offline backups — DeadLock kills VSS and empties the recycle bin before encrypting.
☑️ Restrict admin rights and privileged token use (SeDebugPrivilege, SeTakeOwnershipPrivilege) to limit encryption blast radius, and monitor for LOLBin abuse of AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz.
☑️ Before paying anything for a Gunra Linux infection, engage CISA or a specialist IR team on timestamp-based key reconstruction.
Theme 4: The Hiring Pipeline Is an Attack Vector
Stories
🗞️ How North Korean Hackers Infiltrate Western Companies — Researchers stood up a fake DeFi startup, hired DPRK operatives, and documented the infiltration playbook from the inside. Forged IDs carry AI watermarks like SynthID, and off-screen live translation tools carry the operative through video interviews. 🔎 Threat Hunting Package
🗞️ Sandworm Targets IT Professionals with Weaponized VPN Clients — UAC-0145/APT44 poses as tech employers on job boards, running fake interviews that end with a trojanised VPN “assessment tool”. The trust is built across channels — Zoom and Telegram interviews first, spoofed follow-up email with the payload second. 🔎 Threat Hunting Package
🗞️ The “Payroll Pirates” Are Evolving: New AiTM Phishing Campaign Bypasses Microsoft 365 MFA — Storm-2755 uses voicemail lures and residential proxies to intercept M365 session tokens and redirect payroll. They aren’t defeating MFA — they’re proxying the real Microsoft auth flow and stealing the session after it succeeds, then blending into consumer traffic via rotating proxies. 🔎 Threat Hunting Package
🗞️ Surge in Account Hijacking for Non-Consensual Explicit Content Leaks — FBI IC3 warns of credential stuffing and phishing against social and cloud accounts to steal and sell intimate content. The effective technique is fake “your account is locked” support texts that manipulate victims into forwarding genuine password-reset codes.
Recommendations
☑️ Deploy phishing-resistant MFA (FIDO2, Windows Hello for Business) — it binds auth to the real service and neutralizes AiTM session relay outright.
☑️ Layer Conditional Access for managed devices only, plus Continuous Access Evaluation so anomalous sessions get revoked fast.
☑️ On suspected compromise, revoke all sessions, rotate credentials, re-register MFA, and audit ADP/Workday for unauthorized direct deposit changes.
☑️ Harden onboarding: forensic ID checks for AI manipulation and metadata inconsistencies, plus canary tokens or tracking links to verify candidate geography.
☑️ Verify recruiters and interview invites independently through official corporate channels, and run any interview-supplied software in a VM or sandbox.
☑️ Enforce least privilege across repos and critical systems, and monitor remote workers for proxy connections and unauthorized remote access tooling.
☑️ Never share a verification code with “support”, and keep sensitive media off internet-accessible cloud storage — report NCII via ncii.ic3.gov.
Theme 5: The Blind Spots — SaaS, Silicon, and Statecraft
Stories
🗞️ Stealthy ‘City-Forum’ Campaign Targets Salesforce and ServiceNow via Custom Toolset — Reco tracked a campaign exfiltrating data from exposed Salesforce Experience Cloud and ServiceNow portals through unauthenticated guest access. Rather than reuse public scanners, the actor built bespoke Go tooling against undocumented surfaces — the UI-API/GraphQL layer on Salesforce LWR sites and a hidden ServiceNow search endpoint. 🔎 Threat Hunting Package
🗞️ Malicious SIM Cards Can Hijack Cellular IoT Modems — Birmingham and Fuzzware researchers showed a rogue SIM can execute arbitrary code and take over modems in EV chargers, industrial routers, and telematics units. There’s no software vulnerability to patch — it abuses standards-compliant SIM Toolkit functionality to issue system commands and force 5G-to-2G downgrades.
🗞️ New Multi-Functional Linux Botnet ‘Evooo1Bot’ Targets Cloud and IoT Infrastructure — Fortinet found a modular Linux botnet combining DDoS, reverse shells, and arbitrary script execution against servers, cloud instances, and edge devices. Bundling flooding with remote admin execution lets operators pivot from access to disruption in a single toolset. 🔎 Threat Hunting Package
🗞️ Jewelbug APT Blends State Espionage with Crypto Fraud — A China-based hackers-for-hire crew runs government espionage across the Middle East and Asia alongside a crypto fraud business, both from one shared control panel. Their “XG-Web” framework and fake PDF Viewer extension break browser sandboxing to run native Windows commands and hijack sessions in near real time. 🔎 Threat Hunting Package
🗞️ US Authorizes Private Sector ‘Hack-Back’ Operations — A national security memorandum lets vetted private firms run offensive operations against transnational cybercriminals under US government authority. Participation is gated: vetting, strict legal procedure, a $1M compliance bond, and a hard stop if US persons or systems are touched.
Recommendations
☑️ Hunt City-Forum in Salesforce Event Monitoring and ServiceNow transaction logs for IP 158.220.87.79 and User-Agent Go-http-client/1.1.
☑️ Audit guest user permissions on every public portal — kill over-permissive sharing rules, guest file access, and unnecessary self-registration.
☑️ Hunt Jewelbug via the com.microsoft.runedge native messaging host registry key, block typosquatted C2 domains, and watch for Microsoft Graph API abuse hiding C2 traffic.
☑️ Physically secure SIM slots on field-deployed IoT with enclosures, tamper seals, or chassis intrusion sensors, and work with carriers to restrict proactive SIM Toolkit commands.
☑️ Alert on unexpected modem command execution and forced 2G/3G fallbacks.
☑️ Harden public-facing Linux: disable root SSH, enforce key-based auth, close non-essential ports, patch known RCEs, and deploy Linux-native EDR with ZTNA.
☑️ Assume the hack-back policy changes nothing about your defensive obligations — it’s limited to firms under DOJ/DHS agreements, so brief leadership on it as context, not coverage.
Feature Video
Most write-ups of the North Korean IT worker threat stop at the front door.
They explain how these operatives get hired. That’s worth knowing, but it’s only Act 1.
Nobody briefs you on Act 2.
So I built the profile I wanted to read. Here’s what’s in it:
🧑💼 The organization. Not a hacking unit. A state-run staffing agency under the Reconnaissance General Bureau, Department 53 (same parent as Lazarus). Around 8,400 operatives embedded globally.
💵 The money. $250–600M a year by UN estimates, closer to $800M in a single fiscal year by Treasury’s count. Up to 90% clawed back to the department that buys ballistic missile components.
🗓️ The timeline. Five phases from 2011 to now, including the one global accident that made the whole model viable.
⚙️ The hiring pipeline. Identity harvesting, a sub-industry of account laundering run over Discord, and fabricated GitHub histories going back a decade, compiled last year.
💬 The interview. Three stacked layers of deception, and a fourth participant on the call you never see.
📰 The Christina Chapman case. 309 companies. 68 burned identities. $17.1M. Eight and a half years.
🌐 The infrastructure. Why your EDR is structurally blind to how these operatives connect — not misconfigured, blind.
☠️ The extortion. What Secureworks tracks as Nickel Tapestry, and why firing one of these people is the most dangerous moment of the whole engagement.
📖 The playbook. Seven concrete detection opportunities, each mapped to where it lives in the kill chain.
Feature Course
What Will You Learn?
How to set up your own MISP instance to gather and organize cyber threat intelligence.
Configuring your MISP instance to suit your specific use case.
Automatically ingesting threat data into your MISP instance using open-source threat intelligence feeds.
How to search and filter data in your MISP instance.
Using the MISP API to streamline your workflow.
Extracting Indicators of Compromise (IOCs) from your MISP instance to use with other security tools.
Learning Resources
Cyber Training
Zero-Point Security: Advanced training in red team operations, adversary simulation, and offensive development.
TCM Academy: A comprehensive suite of courses with a hands-on, practical approach to training that equips students with the real-world skills needed to succeed in cyber.
Blue Cape Security: A specialist in Digital Forensics and Incident Response (DFIR) training, offering courses to take you from complete beginner to expert.
Tools
Octoparse: A no-code solution that will save you time, energy, and money. Let me show you how to use it to build your own custom cyber threat intelligence web-scraping tool!