ALL POSTS

Key Findings North Korea-linked Lazarus Group registered legitimate US LLC to distribute malware targeting blockchain developers Hackers created fake company "Blocmerce" in Florida with fabricated CEO and official state filings using real residential addresses GraphAlgo campaign evolved from npm package distribution to hiding malware in GitHub release artifacts Remote Access Trojan (RAT) deployed after developers run test tasks, giving attackers full machine control Campaign

Key Findings * TeamPCP cybercriminal group suspected behind supply chain attack * 47 npm packages compromised across multiple scopes * Self-propagating CanisterWorm uses ICP blockchain canister as command-and-control infrastructure * Attack leverages npm package postinstall hooks to execute malware * Worm can automatically spread using stolen npm authentication tokens * Decentralized C2 infrastructure makes takedown efforts difficult Background The supply chain attack targets

Here's the article in the requested format: Key Findings * Malicious Windsurf IDE extension targeting software developers * Uses Solana blockchain to retrieve encrypted malware instructions * Selectively avoids targeting systems with Russian connections * Steals passwords and browser session cookies * Creates persistent hidden task for continued system access Background A new cybersecurity threat has emerged targeting software developers through a sophisticated malware campai

Key Findings: Aeternum is a C++ botnet loader that uses the Polygon blockchain as its command-and-control (C2) infrastructure. The botnet stores its instructions in smart contracts on the Polygon blockchain, making its C2 effectively permanent and resistant to traditional takedown methods. Infected machines poll public RPC endpoints, read the on-chain instructions, and execute them, allowing the botnet operators to manage multiple contracts and payloads simultaneously. Blockc

Key Findings Aeternum C2 is a new botnet that uses the Polygon blockchain to store encrypted command-and-control (C2) instructions. This approach makes Aeternum's C2 infrastructure effectively permanent and resistant to traditional takedown methods. The malware works by writing commands to be issued to infected hosts into smart contracts on the Polygon blockchain. The bots then read those commands by querying public remote procedure call (RPC) endpoints, with the commands man

Key Findings Blockchain-based lending firm Figure confirmed a data breach after an employee fell victim to a social engineering attack Hackers were able to access and steal a limited number of files, including personally identifiable information (PII) of Figure's customers The cybercrime group ShinyHunters claimed responsibility for the breach and released about 2.5GB of stolen data, which included names, addresses, birth dates, and phone numbers Figure has started notifying

Key Findings: The North Korean threat actor Konni has been observed using PowerShell malware generated using artificial intelligence (AI) tools to target developers and engineering teams in the blockchain sector. The phishing campaign has targeted Japan, Australia, and India, highlighting the adversary's expansion of the targeting scope beyond South Korea, Russia, Ukraine, and European nations. Konni, also tracked as Earth Imp, Opal Sleet, Osmium, TA406, and Vedalia, has been