The post CISA Sounds the Alarm: State-Sponsored Hackers Weaponize New Windows and ScreenConnect Flaws appeared first on Daily CyberSecurity. Related posts: The Zero-Click Vulnerability: Akamai Uncovers Incomplete Patch for APT28 Exploit CISA Adds 5 Actively Exploited Vulnerabilities to KEV Catalog: ASUS Routers, Craft CMS, and ConnectWise Targeted CISA Adds 2008 Windows Flaw & Chrome Zero-Day to KEV

Overview ahnLab monitored APT attacks against domestic targets during the month of March 2026. most of the attacks were launched through Spear Phishing emails sent after reconnaissance of specific targets. APT Attack Trends in Korea the majority of distribution vectors were shortcut (.lnk) files, with LNK-based attacks dominating. Type A is to run PowerShell with […]

The post North Korea’s “Portfolio Model” Shatters Modern Attribution appeared first on Daily CyberSecurity. Related posts: Shadows of the North: Unmasking the Sprawling Cyber Infrastructure of the DPRK Kimsuky’s AppleSeed Returns: North Korea-Linked APT Targets Korean Users via Social Media North Korean Hackers Exploit GitHub and Dropbox in Targeted Spearphishing Attacks

The post The Python Pivot: Kimsuky’s New Multi-Stage LNK Maze for Stealthy Backdoors appeared first on Daily CyberSecurity. Related posts: North Korean APT Group Kimsuky Targets Japanese Organizations with Stealthy Malware Campaign ViperSoftX Malware: Arabic-Speaking Attackers Exploit PowerShell in New Cyberattack Campaign PlugX Evolves: New “Meeting Invitation” Phishing Campaign Leverages Trusted Security Software

Overview AhnLab SEcurity intelligence Center (ASEC) recently identified a change in the Kimsuky group’s method of distributing malicious LNK files. The overall attack flow remains the same as before, with a malicious LNK ultimately executing a Python-based backdoor or downloader. However, a structural change was observed in the intermediate execution phase.   Category Previous Distribution […]

  Key APT Groups   Sandworm attempted to destroy OT and IT equipment using DynoWiper after exploiting a vulnerable configuration of FortiGate, targeting at least 30 energy facilities, including wind and solar power plants in Poland, by the end of December 2025. They directly damaged RTUs, IEDs, and serial devices or manipulated settings to cause […]