APT_REPORT

APTREPORT collected by @blackorbird https://x.com/blackorbird Interesting apt report & sample & malware & technology & intellegence collection APT Group for country Threat Actor Groups Tracked by Palo Alto Networks Unit 42...

Telesquare TLR-2005KSH - Remote Command Execution

Telesquare Tlr-2005Ksh is a Sk Telecom Lte router from South Korea's Telesquare company.Telesquare TLR-2005Ksh versions 1.0.0 and 1.1.4 have an unauthorized remote command execution vulnerability. An attacker can exploit this vulnerability to execute system commands without authorization through...

Operation FlashHole: Lazarus breaks security, defies control

In January, we responded to the Lazarus Group's novel attack campaign against South Korea, which followed last year's Operation SyncHole. In this new operation, the group employed an updated malware chain that included both their old and new malware, which we disclosed in full, and used another...

EUVD-2026-106283

Vulnerability in the Oracle HRMS Republic of Korea product of Oracle E-Business Suite component: Korean Payroll. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS Republic...

CVE-2026-83360

Vulnerability in the Oracle HRMS Republic of Korea product of Oracle E-Business Suite component: Korean Payroll. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS Republic...

CVE-2026-83360

The Oracle HRMS (Republic of Korea) product, specifically the Korean Payroll component within Oracle E-Business Suite , is affected by a vulnerability in versions 12.2.3-12.2.15 . A low-privileged attacker with network access via HTTP can exploit this flaw to compromise the system, potentially le...

Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto

The North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices located in more than 100 countries and siphoned funds or account credentials from over 7,000 cryptocurrency wallets, according to a new joint cybersecurity advisory. The primary target...

North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales

Threat actors with ties to the Democratic People's Republic of Korea aka DPRK or North Korea have been observed seeking job opportunities beyond the information technology IT sector, with recent investigations identifying suspected workers employed in sales and marketing and the medical professio...

Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers

Security researchers invented a cryptocurrency startup, advertised developer jobs, and hired three people they believe were North Korean operatives. Every virtual machine the company issued was recording. The onboarding paperwork is the part hiring teams can use. The first hire claimed to live in...

Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development

North Korea's state hackers are no longer content to type prompts into public chatbots. One of the country's main espionage groups has begun running artificial intelligence AI offline on its own servers, connecting document-search tools to files in its possession, and collecting the software part...

Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain

Cybersecurity researchers have flagged an evolution of the EtherHiding blockchain-based command-and-control C2 technique that conceals the C2 server IP address inside a made-up destination address of a completely empty Ethereum transfer. The new dead drop resolver approach, observed in two...

Malicious code in ailaunchkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 998620f0a5d4d55fb3afccbaa210f7822a002db4b8ad09d5dae4954723264fb7 Package ailaunchkit version 0.1.2 on PyPI was scanned across 6 files with no static-rule matches and no traced behaviors indicating exfiltration,...

MAL-2026-11416 Malicious code in ailaunchkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 998620f0a5d4d55fb3afccbaa210f7822a002db4b8ad09d5dae4954723264fb7 Package ailaunchkit version 0.1.2 on PyPI was scanned across 6 files with no static-rule matches and no traced behaviors indicating exfiltration,...

Malicious code in catalogai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccb9ff2c71a85c2bac770a874ed3c811e963ba9b3da37417fb600678d8119991 catalogai 0.1.2 presents itself as a semantic-search / AI-catalog library but the shipped modules perform browser credential theft and...

DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware

Threat actors with ties to North Korea have been attributed to a sophisticated macOS malvertising campaign that involves redirecting users to fake web pages displaying a full-screen non-existent update sequence to deliver malware as part of a new iteration of the long-running Contagious Interview...

Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet

Amazon has tied the September 2025 hijack of the npm packages debug and chalk to North Korea. For ten months, the incident sat in the public record as crypto theft: a maintainer phished through a lookalike npm domain and a wallet-draining script pushed into at least 18 packages carrying more than...

EUVD-2026-47443

Vulnerability in the Oracle HRMS Republic of Korea product of Oracle E-Business Suite component: Korean Payroll. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HRMS Republi...

CVE-2026-61254

Vulnerability in the Oracle HRMS Republic of Korea product of Oracle E-Business Suite component: Korean Payroll. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HRMS Republi...

PT-2026-63120

Vulnerability in the Oracle HRMS Republic of Korea product of Oracle E-Business Suite component: Korean Payroll. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HRMS Republi...

CVE-2026-61254: URL Redirection to Untrusted Site

Vulnerability in the Oracle HRMS Republic of Korea product of Oracle E-Business Suite component: Korean Payroll. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HRMS Republi...