Targeting Build Systems: SAP PoCs, LockBit Logs, and Persistent State Threats

News

FBI Confirms Lazarus Group Behind Bybit Crypto Heist

The FBI has confirmed the Lazarus Group's involvement in the Bybit exchange heist, highlighting the ongoing threat of state-sponsored crypto theft. This is a direct reminder that North Korean APTs treat your liquidity pool like a manufacturing plant; they operate with industrial efficiency.

Exploitation

SAP NetWeaver Critical RCE (CVSS 10) Exploit Now Public

SAP NetWeaver is leaking a 10/10 CVSS vulnerability with a public PoC. If you are running legacy SAP, assume compromise is imminent unless patched; this is a textbook example of technical debt becoming an active liability.

Tools

New Nuclei Templates for SAP and Ivanti Vulnerabilities

Nuclei templates for SAP NetWeaver and Ivanti EPMM are closing the gap between disclosure and defense. If you are automating your vuln management, updating your scanners is the difference between seeing the patch and missing it entirely.

Intel

Leaked LockBit Chat Logs Offer Deep Threat Intel

Leaked internal chat logs are peeling back the curtain on LockBit's operations. Use this raw data to stress test your threat models; real-world adversary behavior is always more valuable than theoretical frameworks.

Threats

North Korean Maui Ransomware Resurfaces with New Tactics

The Maui ransomware strain is back with new tactics, specifically targeting critical infrastructure sectors. This is proof that 'persistence' in the threat landscape means the same playbook gets recycled until you patch the human or process failure.

Vulnerabilities

D-Link Confirms Active Exploitation of RCE Vulnerability

D-Link is confirming active exploitation of a remote code execution flaw, affecting legacy router lines. If you have unmanaged or 'shadow IT' devices sitting in closets, your perimeter is wider than your dashboard says it is.