30
Search: “Human Communications Intelligence”
133 stories
30
30
30
30
30
30
30
45
30
30
30
45
45
30
30
45
30
30
30
30
30
30
30
30
30
30
30
China-Aligned Hackers Hide PeckBirdy Malware C2 Inside Casino and Adult Websites
Infoblox found China-aligned actors hiding PeckBirdy malware C2 inside fake Chinese-language casino and adult websites, evading security scans via service workers and WebSockets.
Infoblox reported that China-aligned actors behind the PeckBirdy JScript C2 framework conceal command-and-control inside low-quality Chinese-language casino and adult websites, extending Trend Micro's earlier findings that tied the framework to backdoors including MKDOOR and HOLODONUT. One decoy, vip311[.]cc, embedded JavaScript linked to cache-mcp[.]com and registered a service worker connecting to mcp-source[.]online over WebSocket; at publication mcp-source[.]online had zero VirusTotal detections, showing how the layered design evades conventional scanning. The campaign has been active since at least 2023, and just over 3% of Infoblox enterprise customers resolved at least one PeckBirdy C2 domain, with education, IT, banking and government among observed sectors.
62
North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales
North Korea's IT worker scheme (Famous Chollima/PurpleDelta) has expanded from IT into healthcare, sales, and financial services roles worldwide.
Huntress and Recorded Future documented DPRK-linked fraudulent workers landing remote jobs beyond IT, including at an Australian healthcare company, a financial services firm, and a sales hire with a stolen identity. The scheme, tracked as Famous Chollima, Jasper Sleet, Nickel Tapestry, PurpleDelta, UNC5267, and Wagemole, uses forged identity documents, VPNs, proxies, and laptop farms with PiKVM and capture cards to fund Pyongyang's weapons programs. Recorded Future found the PurpleDelta cluster applied to 1,100+ companies between late 2024 and early 2025 with 22 fabricated personas, some AI-generated, using ChatGPT and AI transcription during interviews. Analysts assess the activity is ongoing and likely to expand in scale and sophistication.
65
30
30
30
30
30
45
45
30
30
30