Espionage, pre-positioning, and the long eviction. Attribution here is a graded claim, never a headline: we name a government only when two independent sources and a reviewed artefact agree, and we say so when they do not.
Lazarus used a Windows kernel zero-day against defence and aerospace firms for about five weeks — and ran the command channel over ML-KEM, the post-quantum standard NIST finalised in 2024. Almost none of the organisations being targeted have deployed it.
A private network is still a network. Once anything inside it could reach anything else, the isolation was a route.
Post-incident guidance that leads with the exposed device rather than the adversary. For a utility with one engineer, that is the usable document.
New guidance asks operators to build and test plans for running vital systems disconnected. The assumption underneath it is the story.
More than 30 Minnesota communities disrupted through internet-facing controllers. Manual operation was the fallback, and it is a capability most utilities are losing.
76% of the year’s crypto theft value attributed to one state. On a public ledger, attribution is tractable in a way network telemetry never is.
More than 600 organisations across 80 countries since 2019, including US carriers and the lawful-intercept systems they run. The metadata was always the point.
Common-use platforms are why terminals can flex, and why one supplier failure degrades four countries at once. Nobody in the contract chain prices that.
Unpatched vulnerability, persistent tooling, deleted logs. The deletion is a finding in itself — nobody spends that effort on a boring record.
Foothold to exfiltration in about 72 minutes. Every response process that assumes a human decides in time is now mistimed.
Up roughly tenfold since 2021 and projected to double again. The manual fallback that limits the damage is a wasting asset.
Mass credential compromise across tens of thousands of firewalls. Patching fixes the device; it does not un-disclose the credentials.
Five years of access with no exfiltration objective. Pre-positioning breaks every response method that starts by asking what the intruder wanted.
Carriers are the target, the transit and the only party who can see an individual compromised device. The benefit of acting accrues to everyone else.
73,500 accounts on the state’s own messenger. For an internal platform the graph is the intelligence, not the messages.
The algorithms are free. The $15 billion is discovery, hardware replacement and re-certification — and small institutions will not be paying it.
Three standards finalised, deadlines from September. The blocker is that nobody knows where their cryptography actually is.
A reported $292 million protocol exploit. No credential, no dwell time, no log — and no ability to disconnect while you investigate.
A cloud flaw touching Commission web properties, internal systems untouched. The second such file this year, and the boundary held both times.
Check-in, boarding and baggage degraded across four capitals through one shared platform. Manual fallback is what kept it to queues.
Originating traffic from a home connection in any country used to need a state service. It is now a subscription, and it breaks three controls at once.