
North Korean Hackers Turn Terraform Job Tests Into a Path Toward Developer Networks
Jade Sleet breached an Indian IT firm via fake Terraform job tests, deploying FLATROOF and ROOFDECK macOS backdoors to steal credentials.

Jade Sleet breached an Indian IT firm via fake Terraform job tests, deploying FLATROOF and ROOFDECK macOS backdoors to steal credentials.

HEAVYGRAM uses Telegram bots to control Windows systems, steal credentials, capture data, evade Defender, and deploy further malware.

North Korea-linked WaterPlum used fake job interviews to infect 30,000 devices, steal $10.5M in crypto and gain access to corporate networks.

Transparent Tribe uses Rust backdoor RUSTYSHADE and file stealers via private GitHub repos to spy on Indian and Afghan government targets.

China-linked FamousSparrow deployed SparroWocky backdoor against Latin American governments for espionage, using DLL sideloading and stealth techniques.

US, UK and Dutch agencies expose CHOSEN BRICK, Iranian Windows malware spreading via WhatsApp and Telegram to spy on dissidents, journalists and activists.

Kaspersky reports NightEagle, Hacking Cat and Toy Ghouls targeting Russian firms with Exchange exploits, backdoors, ransomware and wipers.

China-linked UTA0560 and APT31 chained Chrome and Windows zero-days via spear-phishing to breach NGOs, deploying GRIMWEDGE and credential-stealing malware.

Russian-linked actors exploit CVE-2026-20079 and CVE-2026-20316 in Cisco FMC to deploy redesigned Cyclops Blink backdoor for persistence and espionage.