Break Glass Intelligence

https://intel.breakglass.tech

0

Named Actors
9

Published Reports
1

Years Active
9

Avg Reports/Year

Published Reports

Top Tags

Top Actors

Cluster Coverage

2026-04-21

Break Glass Intelligence

A Third Vultr Seoul Box: 60+ Kimsuky Domains, 18 Months of DDNS Rotation, and a 5-Year Infrastructure Trail

#Kimsuky

2026-04-17

Break Glass Intelligence

850 Hostnames, 6 Servers, 1 Kill Chain: Mapping Kimsuky's 2026 Korean Credential Harvesting Machine

#Kimsuky #Phishing #T1102.002 #T1059.005 #T1027 #T1583.006 #T1566.003 #T1567 #T1583.003 #T1204.004 #T1057 #T1082 #T1518.001 #T1568.001 #T1566.001 #T1547.001 #T1585.002 #T1140 #T1056.003 #T1204.001 #T1053.005 #T1539 #T1041 #T1113 #T1608.005 #T1608.001 #T1204.002 #T1598.003 #T1071.001 #T1590.005 #T1115 #T1083 #T1583.001 #T1059.001 #T1497 #T1056.001 #T1566.002 #T1036.005

2026-04-11

Break Glass Intelligence

We Dumped a Live Kimsuky C2 and Recovered Every Stage of the Kill Chain: CHM Dropper, VBScript Stager, PowerShell Keylogger

#CHM #Kimsuky #T1518.001 #T1115 #T1566.001 #T1083 #T1041 #T1059.001 #T1053 #T1132.001 #T1059.005 #T1204.002 #T1036.005 #T1056.001 #T1071.001 #T1140 #T1057 #T1082

2026-04-05

Break Glass Intelligence

Ten Operators, Nine Campaigns, and a Backend With No Password: How a Single Vercel URL Exposed a Two-Year Korean Phishing Syndicate

#Kimsuky #Phishing

2026-04-01

Break Glass Intelligence

Two IOCs In, Five C2 Servers Out: Mapping DPRK's Contagious Interview Campaign From InvisibleFerret to a Kimsuky Crossover

#ClickFix #ContagiousInterview #InvisibleFerret #Kimsuky

2026-03-17

Break Glass Intelligence

When Nation-States Become Ransomware Affiliates: Lazarus Group Deploys Medusa via a Custom IME-Based Loader

#Lazarus #Medusa #Ransomware #T1574.002 #T1562.001 #T1059.001 #T1490 #T1555 #T1486 #T1547.014 #T1129 #T1036.005 #T1622 #T1135 #T1027.002 #T1546.015 #T1489 #T1082

2026-03-16

Break Glass Intelligence

Lazarus Group is Using the Solana Blockchain as a Dead-Drop C2 Channel -- and Nobody Noticed for 4 Months

#TraderTraitor #T1059.007 #T1082 #T1036 #T1041 #T1008 #T1027 #T1070.009 #T1622 #T1573.001 #T1571 #T1497.003 #T1102.001 #T1583.003 #T1195.001

2026-03-12

Break Glass Intelligence

Kimsuky's Five-Stage GrimResource Loader: When an MMC File Becomes a Shellcode Injector

#Kimsuky #GrimResource #T1055 #T1140 #T1059.007 #T1127 #T1566.001 #T1568.001 #T1027 #T1218 #T1071.001 #T1220

2026-03-12

Break Glass Intelligence

Lazarus Group Caught Running Medusa Ransomware: XOR-Decoded Config Exposes Tor C2, IME-Based Loader, and a 7-Month Intrusion Timeline

#Lazarus #Medusa #Ransomware #T1574.002 #T1562.001 #T1059.001 #T1490 #T1555 #T1486 #T1547.014 #T1129 #T1036.005 #T1622 #T1135 #T1027.002 #T1546.015 #T1489 #T1082

« Back