Tag: blindingcan

3 Attack Reports | 0 Vulnerabilities

Attack reports

North Korean Lazarus Group Now Working With Medusa Ransomware

North Korean state-backed attackers are utilizing Medusa ransomware in their ongoing extortion attacks against the U.S. healthcare sector. The Symantec and Carbon Black Threat Hunter Team discovered evidence of North Korean actors employing Medusa in an attack on a Middle Eastern target and an unsu…

Published: February 24, 2026

Downloadable IOCs: 52

Inside DPRK Operations: New Infrastructure Uncovered Across Global Campaigns

North Korean state-sponsored threat actors, including Lazarus and Kimsuky, continue to conduct widespread hacking operations for intelligence gathering, financial gain, and access. The investigation uncovered previously unconnected operational assets, revealing active tool-staging servers, credenti…

Published: December 18, 2025

Linked vulnerabilities : CVE-2025-55182 (CVSS 10.0)

Downloadable IOCs: 20

DPRK's Playbook: HttpTroy and New BLINDINGCAN Variant

Recent investigations have uncovered two new toolsets from North Korean threat actors. Kimsuky deployed a new backdoor called HttpTroy, targeting a victim in South Korea through a VPN invoice-themed attack. The attack chain involves a dropper, a loader called MemLoad, and the HttpTroy backdoor, whi…

remote access tool

Published: November 3, 2025

Downloadable IOCs: 15

Click here to see more Attack Reports