ESET: GhostWriter wiper hit a Ukrainian manufacturer
ESET calls the late-May attack the first destructive Belarus-aligned operation it has documented in Europe and says intent is unclear.
74
- Mentions · 7d1
- Mentions · 30d2
- All mentions7
- First seenAug 16, 2026
- Last mentioned2d ago
Timeline
7 articles · newest firstNorth Korea Phishes Ukrainians for War Intel
North Korean hackers are spear-phishing Ukrainian officials and researchers to collect intelligence on the Russia-Ukraine war.
62
Operation Conflict Compass Deploys VelvetCake PowerShell Malware Through Malicious LNK Files
North Korea-linked Konni deployed VelvetCake PowerShell malware against Ukraine-focused targets via malicious LNK files.
76
Critical ScreenConnect flaw now actively exploited in attacks
CISA confirms active exploitation of critical ConnectWise ScreenConnect flaw CVE-2026-84869, ordering federal agencies to mitigate within three days.
82
New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic
Rapid7 found a new backdoor, ted, compiled into trojanized HAProxy at two South Korean organizations, with medium-confidence attribution to North Korean actors.
65
DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors
Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.
68
Security Affairs newsletter Round 590 by Pierluigi Paganini
Weekly Security Affairs newsletter roundup aggregating top cybercrime, malware, APT and AI security stories including ExfilSquad, Kimwolf v7 and Kimsuky AI use.
10
Related CVEs
by mentions- CVE-2024-1709100%10.0Authentication Bypass in ConnectWise ScreenConnect Creates Rogue Admin Accounts
- CVE-2026-84869<1%9.9Missing authorization in ScreenConnect client allows unauthorized file execution
- CVE-2025-39354%7.2ViewState Code Injection in ConnectWise ScreenConnect May Lead to RCE
- CVE-2026-3564<1%9.0A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain…
Appears with
- curlRATmalware · 2
- APT37threat actor · 2
- Konnithreat actor · 2
- TA406threat actor · 2
- Opal Sleetthreat actor · 2
- Rapid7vendor · 2
- HAProxyproduct · 2
- Proofpointorganization · 2
- SSH keyloggermalware · 1
- South Korean media organizationsvictim · 1
- Zoomproduct · 1
- GitHubproduct · 1
- tedmalware · 1
- ConnectWisevendor · 1
- OneDriveproduct · 1
- SOCRadarorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.