Av4x

i like malware, cti, geopolitics, and khachapuri.

Prolific Pivoter @ Magic Internet Money LLC

[Av4x @_av4x]

@blackbigswan No AC just vibes

[Av4x @_av4x]

I think the attribution is mostly sound based on some of the other stuff that was going on at the time. GH issue spam and Blocknovas was wrapped into it all too.

I do agree with you on all your points though. I think the lads got a lot more autonomy and operations have forked all over the place.

[Av4x @_av4x]

@blackbigswan @L0Psec @malwrhunterteam The theme reminds me a lot of the willo interview/nvidiadriver stuff that was going on last year
https://t.co/eBWYHuDy5A

[Av4x @_av4x]

@DenysVitali @chweicki @markodayan @SocketSecurity @GovCERT_CH Not targeted, but absolutely DPRK

https://t.co/suhOpn7l4F

[Av4x @_av4x]

@tayvano_ @_choppingblock @ethereumJoseph Ik its sarcasm but comparing DPRK to Cambodia just aint right

[Av4x @_av4x]

@greglesnewich Ghostty gang

[meow mfer @meow_mfer]

🧵1/13

A suspected DPRK IT worker was employed at @THORSwap and had at least 3 pull requests MERGED into the official swapkit/SwapKit repository — the core SDK powering ThorSwap's cross-chain swap infrastructure.

The PRs modified wallet integration code for Talisman, Polkadot.js, and Chainflip.

Here's what we found.

[Av4x @_av4x]

Weird DPRK cluster. Related:
techcross-es[.]com
- Investor Profile (Japan-based) - Shiro Arai.pdf.scpt (60dfa5b92193cdc80fd759cd5a228527b1019c4706e5a1ed2e9bce3c232ef531)
stomcs[.]com
sevrrhst[.]com

Overlap w/scarcruft via:
https://t.co/Xeo6MFH3Os

https://t.co/pWl6mwNXly

[L0Psec @L0Psec]

also sets up a status bar when executing as a fake UI element while it downloads the next stage. Reaches out to C2 woodcastpro\.com to grab another compiled AppleScript.

[Av4x @_av4x]

“Oh wow this sounds great”

Its just contagious and theres not even an ioc list

[Expel @ExpelSecurity]

Marcus Hutchins, principal threat researcher at Expel, has been tracking the group we call HexagonalRodent, a subgroup likely affiliated with DPRK's Famous Chollima, since late 2025.

1/6

[calle @callebtc]

if you go on a zoom call and click a link to "update your zoom because we can't hear you" in 2026, you're not going to make it

[Greg Lesnewich @greglesnewich]

I’d believe that DPRK IT workers has taken in house CTI to new heights, maybe to where it belongs in those orgs. I see many of these team shining now

Info sharing is prolific, much innovation being made on detection, and much more straightforward customers/engagement across BUs

[Av4x @_av4x]

@vxunderground @yunginnanet a few months after getting into infosec I made this account, a crappy blog, and a post analyzing some malware. He somehow found that post and gave me some encouraging words that made my day. Was my first interaction with this community and still here 3 years later. RIP kayos

[Greg Lesnewich @greglesnewich]

Suddenly a low grade Chinese-speaking criminal crew has enough juice to physically burn a data center?

To what, cover their op that already had been found in the adversary’s own infra?

[vx-underground @vxunderground]

DoNt SuPpOrT tHe EfF tHeYrE wOkE aNd LeFtISt

Okay.

Well, we're trying to DO SOMETHING. If you don't like the EFF, then DO SOMETHING else. Do something. Do LITERALLY ANYTHING. If you genuinely care about privacy, your digital anonymity, and your right as a free-willed human-being online, then DO SOMETHING. If there is an alternative to the EFF that you believe is not 'woke', please donate to them. If you think the EFF, or any other non-profit related to digital privacy is 'woke', then call your local representative.

At least TRY to DO SOMETHING.

Alternatively, let the government invade your privacy. Let the government control what you can and cannot see. Let the government determine what's good and what's not. Let the government think for you.

Want to visit Reddit? The government needs to see your ID.

Want to watch YouTube? The government needs to see your ID.

Want to listen to Spotify? The government needs to see your ID.

Want to play video games that may be "violent"? The government needs to see your ID.

Want to update some software on your computer? The government needs to see your ID.

Want to look at pornography? The government needs to see your ID.

Want to look at Wikipedia? The government needs to see your ID.

Want to visit a Discord server? The government needs to see your ID.

Want to use a search engine? The government needs to see your ID.

The government needs to know what music you listen to, what movies you watch, what YouTubers you like, which Wikipedia articles you're reading, what your sexual preferences are, what you're searching online, which video games you're playing, which podcasts you like, what subreddits you visit, what hobbies you enjoy, what you identify as politically.

This is all important information under the Online Safety Act. The government needs to know all of these things to keep you "safe". Don't worry, the government has your best interests in mind so they will decide what is "safe" and what is "not safe".

[Av4x @_av4x]

@kladblokje_88 Think you meant this one

[Team Cymru Research @teamcymru_S2]

Now that the cat is out of the bag regarding the use of front companies like BlockNovas LLC (blocknovas[.]com) in DPRK-linked #ContagiousInterview campaigns. We thought we'd share our overview of network telemetry surrounding this particular activity.

[. @7N7]

why are we giving 900 megs of logs this much traction? lol

[Av4x @_av4x]

@DPRK_News Hello

[Nick @superducktoes]

north koreas offline this morning https://t.co/1JoKZxe9RZ

[hithere @asdasd13asbz]

#Kimsuky #APT
VServer Tool

DOWNLOAD :
https://t.co/TevmxsrMHl