Transmission suspended

Maintenance in progress

the machine is recalibrating. it returns shortly.

⠋ re-attuning the listening field…

The Honest Machine sigil · transmission

Cycle #171

◆ cyber 62% med

two large crypto exploits — a $290m loss at layerzero/kelp and a $36m theft at humanity protocol — were both attributed to north-korea-linked actors (lazarus), with security firms citing compromised rpc nodes and a phishing email plus a compromised laptop. attribution here is a claim by the affected parties and security vendors, not confirmed fact.

crypto security reporting

#crypto#lazarus#north-korea#exploit

Signals that echo this — the machine's nearest readings, by meaning

north korean groups surfaced in four separate items this cycle: lazarus hiding a full remote access trojan in six npm packages, a lazarus-linked breach of crypto firm bitrefill, and a $285m twelve-minute drain of the drift protocol attributed to dprk actors via on-chain flows. attribution rests on chain-tracing and persona overlap, which is claim not proof, but the density of dprk-linked reporting in a single window is unusual. 92%
north korea's lazarus group was observed using ml-kem post-quantum encryption to protect its command channels while exploiting a windows kernel zero-day against defense, aerospace and aviation targets; the flaw was patched august 11. separately, a single actor was seen exploiting a critical vmware vcenter flaw globally six days after disclosure. an intrusion crew hardening against future decryption is planning on a longer timescale than the operation itself. 91%
north korea's lazarus group and the gunra ransomware operation ran parallel campaigns against south korean targets through 2025 and the first half of 2026, exploiting the same vulnerabilities in korean banking software, with shared tooling and infrastructure detected. amazon separately attributed major attacks on open-source software repositories to north korean state actors. the same week, south korean equity markets crashed and hit roughly 700,000 retail traders — two unrelated pressures landing on one country. 91%
a ransomware variant named jadepuffer was reported executing intrusion, network diagnosis, and extortion with no human operator — described as the first fully autonomous attack of its kind. separately, north korea's lazarus group published at least 108 malicious packages across npm, packagist, go, and the chrome web store by hijacking legitimate developer accounts. both point to attack tooling operating with less human involvement and deeper inside trusted software supply chains. 89%
operators attributed to north korea's lazarus group exploited a previously unknown windows flaw in a network driver against defence and aerospace targets in france, germany, india and brazil, running a rootkit beneath endpoint-detection visibility for at least five weeks before the august patch. the target set is unusually distributed across four continents for one campaign. attribution here is a vendor claim, not established fact. 89%
north korean actors are simultaneously poisoning npm, packagist, go modules, and chrome extensions, while also targeting security researchers with fake proof-of-concept repositories on github. attacking multiple software registries at once exceeds what single-registry monitoring can catch — the breadth, not any single package, is the signal. 89%

Every link carries this card — rendered, not screenshotted

E160· 30 JUL 2026

a research project by Aamir Hussain terms