Lazarus Heists, Leaked Tactics, and Critical SAP Exploits

State-Sponsored

FBI Confirms Lazarus Group (TraderTraitor) Behind $1.5B Bybit Heist

The FBI formally attributes the record-breaking Bybit crypto heist to the Lazarus Group's TraderTraitor operation. This is a major validation of on-chain tracing. For builders, it shows state-sponsored actors are moving to subvert software supply chains, not just exploit code vulnerabilities.

Ransomware Intel

Leaked LockBit Chat Logs Expose Ransomware Negotiation Tactics

The leaked internal chat logs from LockBit's leadership give an incredible look into ransomware negotiations. This is tactical intelligence: you can see exactly how they pressure victims and where their operational security fails. Use it to build better defenses and train your team.

Critical Vulns

SAP NetWeaver 10/10 RCE PoC Surfaces: Patch Immediately

There's now a public PoC for the CVSS 10.0 SAP NetWeaver RCE flaw (CVE-2025-31324). This is a critical escalation and a prime target for initial access brokers. Patch immediately or run your own nuclei scan to check exposure.

Tools

Nuclei Template for Critical SAP NetWeaver RCE Drops

A new nuclei template for the critical SAP NetWeaver flaw just dropped. This is a perfect example of using automation to beat offensive scanning. If you're running SAP, add this to your daily scan workflow right now.

Legacy Risk

D-Link Confirms Active Exploit of Critical Router RCE

D-Link is confirming active exploitation of a critical RCE in their end-of-life (EOL) routers. If you have any of these devices on your network, you have a serious exposure. This is a recurring problem: EOL hardware is a silent backdoor.

Threat Intel

North Korean Maui Ransomware Resurfaces with Updated Tactics

The North Korean Maui ransomware is back with new tactics. This isn't just about money; it's a state-sponsored destructive tool. You need to monitor for this specifically, as it often avoids traditional detection methods used for cybercriminals.