When I woke up, I found a reply saying that my request had been approved. However, I still couldn't continue the chat. I started a new conversation instead, and fortunately it retained the context of my previous conversation with Claude. I'm currently continuing the new conversation using a different model.
Using AI for cybersecurity work is tough. Claude paused my conversation for review while I was tracking a threat actor. I've submitted a 'request an exemption' and I'm curious how long the wait will be.
China's MPS announced 5 crackdowns (June 16, 2026) tied to Silver Fox malware (likely ValleyRAT/Winos4.0) development, sale, and distribution. Unclear if the 5 cases are linked or separate.
Since the Silver Fox source code/builder leaked in 2023, this looks like Chinese nationals who built variants from the leaked builder or sold/used it got arrested — not necessarily the original threat actor we've been tracking.
Similar to ransomware ecosystems: resellers/affiliates tend to get caught before the core developers do.
https://t.co/tiyDNf68DD (Chinese) #SilverFox
North Korean hackers are stealing identities to land freelance work with Western companies, and some of the victims are in the Balkans.
Read more: https://t.co/dHkpMD8RNt
North Korea uses MetaMask as a cryptocurrency wallet. According to South Korean media reports, North Korea is researching the implementation of Ethereum smart contracts on its isolated internal network. https://t.co/WnqDiZyty5 (Korean)
@Sec_S_Owl This blog post includes several clusters that I am currently tracking. Unfortunately, the analysis does not explain how the attribution was made, so until it can be verified, I am treating it as a reference only and continue to distinguish those clusters separately.
The group we suspect to be Silver Fox attacked Korean organizations via SEO poisoning, and it appears they implemented IP filtering. While some of the targets were identified, we were unable to determine what actions were taken post-infection. The activity targeting Japan differs somewhat from the traditional Silver Fox we have been tracking, which leads us to assess it as either an affiliated group or an entirely separate threat actor.
Attribution of Silver Fox remains challenging. I consider it a misguided approach when some security vendors classify any ValleyRAT usage as Silver Fox activity. While Silver Fox is more aligned with cybercrime operations, their behavior outside of China tends to resemble that of an APT actor. (Though it's also possible this represents a distinct group operating in a similar manner.)
According to the Tving data breach report, the attacker directly accessed the database server where personal information was stored. https://t.co/hndshFOzXe (Korean)
User data from the Korean OTT service Tving has been leaked, including member IDs, names, dates of birth, gender, phone numbers, and email addresses. https://t.co/MuoiJAPECz , https://t.co/qRucOtatZv (Korean)
BGF Networks, the operator of CU convenience store parcel delivery, announced that a personal data breach was confirmed on June 4 at 3:30 PM.
The leaked data items include:
User ID & Password
Name, Date of Birth, & Gender
Address, Email, & Phone number
Connecting Information (CI)
https://t.co/ZBnODiGOEq (Korean)
As a Korean, this is very sad.
According to a local Korean media report released today, LG Electronics has reportedly explored the possibility of selling its TV business to China’s Hisense.
The Korean TV industry has collapsed.
The President of LG Electronics' TV (MS) Business Division met with representatives from rival TV manufacturer Hisense and retailer https://t.co/YTdE9VTOXC in Beijing late last month. https://t.co/OM390ntIEl (Korean) While one Korean media outlet reported that LG Electronics might abandon its TV business, the accuracy of this claim remains unverified. https://t.co/1C6Wjgq2Vg (Korean) ,
Russia's #FSB-linked #Gamaredon has been hammering Ukraine's government, military & critical infrastructure for over a decade. We went behind the scenes.
Tracked their infrastructure. Recovered artefacts from compromised machines. Here's what we found 🧵 https://t.co/o4KN9OAiip
Microsoft has identified a npm supply chain compromise impacting 90+ redhat-cloud-services/* packages, including patch-client 4.0.4, insights-client 4.0.4, rbac-client 9.0.3, host-inventory-client 5.0.3, frontend-components 7.7.2, and others. The payload is a self-propagating worm that infects other npm packages and self-publishes.
Each compromised package adds a malicious preinstall hook, embedding an index.js script in the package.json that silently executes “node index.js” during installation, downloads Bun, and runs a payload that steals secrets from npm, GitHub, Amazon Web Services (AWS), and Secure Shell (SSH). The added code bloats index.js from ~8KB to ~4.3MB, acting as a heavily obfuscated ROT-9 eval loader.
If any of the compromised packages are installed, users and organizations should assume compromise, rotate credentials, revert to a previously trusted version, and block compromised packages. Identified compromised npm packages have been taken down, and we continue to work with the npm team. Microsoft continues to investigate this attack and will publish updates as more information is available.
Similar variants have been emerging since April 2026, with 15 instances identified so far. The DLL includes the PDB path: C:\Users\Administrator\Desktop\084049\crashreport_new\Release\crashreport_new.pdb. Additionally, infection cases have been reported within our systems in Germany.