State-Sponsored Heists and Patch Tuesdays: Today's High-Value Intel

News

Lazarus Group Targets Cryptocurrency Sector in New Campaign

North Korea's TraderTraitor crew is back in the headlines, linked to a new wave of attacks targeting the cryptocurrency sector. This is a direct reminder that state-sponsored groups treat crypto platforms as high-yield ATMs.

Leaked LockBit Chat Logs Expose Ransomware Gang's Tactics

The LockBit leak continues to yield intel. This time, it's chat logs showing the group's internal communications and operational tactics. This is raw, actionable adversary intel for threat hunters.

D-Link Confirms Active Exploit for Unpatched, End-of-Life Router

D-Link confirms an active remote code execution exploit for a router model (DIR-859) that's end-of-life and won't be patched. This is a clear example of technical debt turning into a direct attack vector.

Critical SAP NetWeaver Vulnerability (CVSS 10.0) Has Public PoC

SAP has released a patch for a critical (CVSS 10.0) code injection vulnerability in NetWeaver AS Java. The public proof-of-concept makes mass exploitation a near-certainty. This is a must-patch for any SAP shop.

North Korean Maui Ransomware Returns with Updated Tactics

North Korea's Maui ransomware has resurfaced with updated tactics, showing this isn't a one-off tool but a persistent capability being refined. It's another signal that state-sponsored and financially motivated attacks are converging.

Tools

Nuclei Templates for Critical Ivanti EPMM Vulnerability Released

New Nuclei templates are out for the critical Ivanti EPMM flaw (CVE-2025-4428). If you're running Ivanti, your exploit window is shrinking fast. This is a direct call to patch or get scanned.