Researchers from Cisco Talos and Google’s Threat Intelligence Group have identified North Korean threat actors employing new malware strains and advanced techniques to steal credentials, cryptocurrency, and deploy ransomware, primarily by tricking job seekers into installing malicious code. The campaigns, linked to groups like Famous Chollima and UNC5342, involve malware—such as BeaverTail, OtterCookie, EtherHiding, JadeSnow, and InvisibleFerret—with some leveraging public blockchains for resilient command and control, making the attacks highly evasive and resistant to takedowns. These operations demonstrate North Korea’s ongoing and escalating efforts to infiltrate corporate networks for espionage and financial theft, often targeting victims through fake job interviews and technical assessments. Matt Kapko has more.

This week's episode of Safe Mode features a nuanced conversation with Ben Harris, CEO of watchTowr who delves into the complexities of vulnerability management in today’s threat landscape. Harris discusses why traditional patching is no longer a guarantee of security, revealing how sophisticated attackers are staying persistent even after organizations update and remediate systems—particularly in the challenging context of edge devices and black-box appliances. Drawing on real-world research and recent incidents involving vendors like Oracle, Cisco, and Avanti, the interview highlights the urgent need for resilience, increased transparency from companies, and a cultural shift toward proactive detection. Listen here.