5 casos · pág. 1/1
Kaspersky's analysis of Operation FlashHole describes a Lazarus Group campaign against South Korea that follows Operation SyncHole. The earliest evidence dates to July 2025, and the campaign was observed in January. At least three organizations in the software, construction and wired communication equipment manufacturing sectors were affe…
Recorded Future's Insikt Group tracks the actor behind the October 2026 AI-assisted intrusions into South Korean financial institutions as TAG-217. The group was testing infrastructure and assembling attack tools as early as August 2026, weeks before the campaign became public. South Korea's Financial Services Commission (FSC) disclosed t…
Recorded Future's Insikt Group (report of October 16) tracks a suspected Chinese-speaking actor, TAG-217, linked to attacks on South Korean financial institutions. The actor used Claude Code, DeepSeek, Grok and Zhipu AI alongside ARTEX, an open-source Chinese-language AI penetration testing framework. Public reporting cited in the investi…
Sophos has disclosed Bronze Sandcastle, a previously undocumented China-aligned threat cluster active since mid-2025. Between August 2025 and August 2026 it compromised victims in the Philippines, Taiwan, Afghanistan, Namibia and likely South Korea. Its most distinctive marker is consistent DLL sideloading of legitimate Sandboxie executab…
BRONZE SANDCASTLE is a suspected China-based intrusion set. Between August 2025 and August 2026 it compromised victims in the Philippines, Taiwan, Afghanistan, Namibia and likely South Korea. Its operators sideload malicious DLLs into legitimate applications, then run encrypted payloads in memory. After deployment they enumerate accounts …
