Robert Wallace

DFIR

[lazarusholic @lazarusholic]

"North Korea busts elite hacking ring inside its own banks" published by DailyNK. #News https://t.co/HrBrAtangr

[visi stark @invisig0th]

Being able to represent the whole story is critical to threat actor attribution. Can your platform represent analytically relevant lunch orders? 😉 PoL is now "Pattern of Lunch"

https://t.co/dZmvIGJMID

[LayerZero @LayerZero_Core]

We’re sharing our completed post-mortem on the April 18th incident, prepared with @Mandiant and @CrowdStrike. We are publishing both an executive summary and the full report at the link below.

Over the past four weeks, we’ve worked with hundreds of partners to help them understand their current security posture, and harden it where appropriate. We’ll continue this work, alongside taking additional proactive steps for the benefit of not only our partners, but also the ecosystem as a whole.

We want to extend our thanks to our partners for their support and patience this past month. There’s a reason that over $12 billion has moved across the network in the past four weeks, and why the world’s most valuable asset issuers have stood by our side: they believe in us, in what the LayerZero protocol has to offer, and in the value of modular, isolated, application-controlled security.

The work continues. And we look forward to continue showing up for the applications that trust us with their business, as well as the broader ecosystem.

https://t.co/7bILN6dPJz

[ZachXBT @zachxbt]

1/ Recently an unnamed source shared data exfiltrated from an internal North Korean payment server containing 390 accounts, chat logs, crypto transactions.

I spent long hours going through all of it, none of which has ever been publicly released.

It revealed an intricate ~$1M/month scheme of fraudulent identities, forged legal documents, and crypto-to-fiat conversion.

Enjoy the findings!

[tanuki42 @tanuki42_]

I strongly suspect that @DriftProtocol is not the only team this group has been targeting - so if you read this article and you are worried any of it might sound familiar, please reach out to @SEAL_911 and we will help you go through it. Let's not allow another hack by this team.

[Tay 💖 @tayvano_]

I beg everyone in crypto to read this in full.

I expected this to be another case of social engineering, likely some recruiter/job offer shit.

I was very wrong.

And the depth of the operation and personas makes me think they already have multiple other teams on lock.

😳

[John Hultquist @JohnHultquist]

We are still looking at the axios supply chain compromise, but we’ve attributed it to UNC1069, a suspected DPRK actor, who we covered in a blog this February. They are financially-motivated and historically DPRK uses these incidents to target crypto. https://t.co/RIeOp14UNU

[Cipher @CipherResearchx]

DeFi exploits in 2026 so far:

Step Finance → $27.3M
Truebit → $26.2M
Resolv → $25M+ (today)
SwapNet → $13.4M
YieldBlox → $10.97M
SagaEVM → $7M
Makina → $5M
IoTeX → $4.4M
Aperture Finance → $3.7M
Venus Protocol → $3.7M
CrossCurve → $2.8M
Solv Protocol → $2.7M
FOOMCASH → $2.3M
Moonwell → $1.8M
TMX → $1.4M

Total exploited since Jan 2026: ~$137M+

It's only March.

[Mandiant (part of Google Cloud) @Mandiant]

UNC6201 is exploiting a high-risk zero-day (CVSS 10.0) in Dell RecoverPoint for Virtual Machines.

This PRC-nexus actor has leveraged the vulnerability since mid-2024 to maintain persistent access, and distribute GRIMBOLT backdoor.

📄 Learn more:
https://t.co/Q92lmOaW8X

[Dan Perez @MrDanPerez]

🚨Hot off the Press🚨

🇨🇳 nexus actor, UNC6201 exploiting CVE-2026-22769 to move laterally and deploy SLAYSTYLE, BRICKSTORM and a new novel backdoor, GRIMBOLT

👀

https://t.co/mey2ifpEqU

[Tyler Fox @smileyborg]

Software engineering in 2026

[Dan Perez @MrDanPerez]

GTIG’s latest AI Threat Tracker Report is out! APT31, UNC795 and APT41 using AI to support development, testing and research.

https://t.co/0ogkw4duPD

[Silent Push @silentpush]

A few potential new domains (currently unknown on VT) related to recent North Korean threat activity reported by @Mandiant.

We observed these through a small pattern in our DNS data.
- Domains resolving to the CIDR 134.45.0.0/16
- Where the IP has been associated a low number of domains.
- Where domain name is relatively short, mostly alphabetical and uses a .com TLD.

This pattern may sound broad, but it matches on only 6 active domains across 3 unique IP's since 2025, with 4 of these domains referenced in the recent UNC1069 report.

The two remaining domains resolve to 134.45.83[.]95, which has previously been linked to the now inactive doc-bridge[.]com.

Based on the overlapping patterns and similar "dream" references also observed by Mandiant, we believe that these domains are likely to be related.

[Willi Ballenthin @williballenthin]

there's anti-disassembly, anti-debugging, anti-VM, etc. when identify malware techniques.

now there's "anti-LLM": https://t.co/dql86W2d2F

such as including magic strings that cause Claude sessions to be terminated for "safety reasons".

[Dan Perez @MrDanPerez]

World's Largest Residential Proxy Network Disrupted!

https://t.co/vraartQP5K

[Mandiant (part of Google Cloud) @Mandiant]

North Korea threat actor UNC5342 is using EtherHiding, the first time we have observed a nation-state use this technique. 🚨

The TTP is being used in a social engineering campaign that leads to cryptocurrency heists and espionage.

Read the blog post: https://t.co/JGnXcAQfoQ

[Mandiant (part of Google Cloud) @Mandiant]

BRICKSTORM malware used by suspected China-nexus actor, UNC5221, in stealthy espionage campaign.

- Avg dwell time: 393 days.
- Targets: US legal, SaaS, BPOs & tech firms.

We have released a scanner, IOCs, and guidance to help defenders.

Full analysis: https://t.co/wM3OFsR5Ec

[nickharbour @nickharbour]

FLARE-On 12 is about to blow up your weekends: https://t.co/WGpAseGLCO #flareon12

[Fox-IT @foxit]

🧀 𝗡𝗲𝘄 𝗯𝗹𝗼𝗴: "𝗧𝗵𝗿𝗲𝗲 𝗟𝗮𝘇𝗮���𝘂𝘀 𝗥𝗔𝗧𝘀 𝗖𝗼𝗺𝗶𝗻𝗴 𝗳𝗼𝗿 𝗬𝗼𝘂𝗿 𝗖𝗵𝗲𝗲𝘀𝗲"

Read about PondRAT, ThemeForestRAT and RemotePE - three RATs we encountered during incident response involving the Lazarus group.

Check the indicators and don't let them steal your cheese!

#ThreatIntel #Lazarus #DFIR

https://t.co/JJ71mCw4kp

[Mandiant (part of Google Cloud) @Mandiant]

CORNFLAKE.V3 malware spotted in an access-as-a-service operation using the ClickFix technique. 🥣

UNC5518 uses fake CAPTCHA pages for access, which UNC5774 then leverages to deploy the CORNFLAKE.V3.

Learn more: https://t.co/zRdEp0ctKm