#cyber-espionage

A DPRK-linked fake IT worker network uses VPN services, residential IPs, and freelance platforms to conduct covert employment operations and bypass sanctions controls. Infrastructure tied to domains resolving to multiple IPs shows connections to Gmail, ChatGPT, and Workana during remote work impersonation activity. Traffic patterns indicate distributed laptop farms supporting persistent infiltration and financial evasion efforts.

Source: Team Cymru

North Korea–linked KONNI is using AI-generated PowerShell backdoors to infiltrate blockchain developers across Asia-Pacific. Disguised as project files, the campaign shows how generative AI is lowering the barrier for stealthy cyber espionage.

Source: Check Point Research

November 2025 saw continued exploitation of high-severity vulnerabilities, including those in FortiWeb and Cisco devices, prompting emergency patches and widespread global warnings. Fortinet disclosed a significant zero-day flaw in FortiWeb, actively exploited by threat actors to create unauthorised admin accounts. Concurrently, a path-traversal vulnerability in FortiWeb allowed for local admin account creation, with attackers using automated payloads to target devices globally. This was one of several vulnerabilities observed throughout the month, as critical flaws in Linux Kernel, Splunk, and Redis required urgent updates.

The rise of AI-driven cyberattacks continued to dominate discussions, with Anthropic reporting a Chinese state-sponsored campaign leveraging Claude Code for automating intrusion stages across dozens of organisations. Though this marked the first known case of AI-powered espionage, the lack of concrete technical evidence left some experts questioning the validity of the claims. At the same time, Google uncovered new AI-driven malware using Large Language Models (LLMs) to adapt and evade detection, highlighting the growing potential of AI in enhancing malicious operations by state-backed actors.

A surge in ransomware attacks was observed, with groups such as Akira and Kraken continuing to target virtualised environments, with the latter expanding its reach across both Linux and Windows systems. The Akira group, in particular, generated over $244 million in ransom payments, exacerbated by the exploitation of flaws in SonicWall and Veeam. The threat of ransomware-as-a-service saw new developments, as ShinySp1d3r emerged, signalling a shift away from third-party encryptors towards custom-built malware platforms. As a result, companies were urged to bolster their defences against increasingly sophisticated ransomware campaigns.

Supply chain vulnerabilities also presented a persistent risk, with new compromises reported across open-source repositories. Amazon Inspector discovered over 150,000 malicious npm packages linked to token-farming operations, flooding the registry with self-replicating packages that targeted blockchain-based systems. Simultaneously, Shai-Hulud, a supply chain attack targeting npm and Maven Central, propagated new threats through compromised package delivery systems. Researchers pointed to the ever-growing sophistication of such attacks, which now leverage advanced cloaking techniques to avoid detection.

November saw several notable breaches, including the exposure of 35,000 records from Dartmouth College linked to Oracle E-Business Suite and ongoing disruptions from OnSolve CodeRED, a US emergency notification system hit by INC Ransomware. The breach was part of an ongoing trend of cyberattacks aimed at critical infrastructure, which continues to escalate in severity. Similarly, Salesforce and Gainsight were victims of supply chain attacks, compromising customer data and leading to ongoing investigations into the perpetrators behind these breaches.

State-linked actors from Russia, China, North Korea, and Iran are exploiting recruitment channels, messaging apps, and supply chains to target defence contractors, personnel, and connected networks.

Source: Google Threat Intelligence Group

Supply-chain compromises in Notepad++ and developer ecosystems, combined with actively exploited vulnerabilities in SmarterMail and SolarWinds, drove urgent patching while ransomware and state-linked campaigns targeted payment, energy, and government systems.

A China-aligned threat group is quietly breaching telecom providers across multiple regions, using specialised Linux malware to maintain covert access.

Source: Cisco Talos

Chinese cyber spies have breached European diplomatic networks, exploiting a newly disclosed Windows shortcut flaw to plant PlugX malware through fake EU and NATO meeting files.

Source: Arctic Wolf Labs

Large-scale credential harvesting, supply chain compromises, and law enforcement disruption defined the week, alongside post-quantum migration mandates and continued Russia-linked espionage targeting government and critical infrastructure.