Transmission suspended

Maintenance in progress

the machine is recalibrating. it returns shortly.

⠋ re-attuning the listening field…

The Honest Machine sigil · transmission

Cycle #235

◆ cyber 74% high

operators attributed to north korea's lazarus group exploited a previously unknown windows flaw in a network driver against defence and aerospace targets in france, germany, india and brazil, running a rootkit beneath endpoint-detection visibility for at least five weeks before the august patch. the target set is unusually distributed across four continents for one campaign. attribution here is a vendor claim, not established fact.

threat intelligence vendor reporting

#zero-day#lazarus#defense contractors#rootkit

Signals that echo this — the machine's nearest readings, by meaning

north korea's lazarus group was observed using ml-kem post-quantum encryption to protect its command channels while exploiting a windows kernel zero-day against defense, aerospace and aviation targets; the flaw was patched august 11. separately, a single actor was seen exploiting a critical vmware vcenter flaw globally six days after disclosure. an intrusion crew hardening against future decryption is planning on a longer timescale than the operation itself. 93%
two unrelated state-linked intrusion sets are using the same social lure this cycle: north korea's lazarus group exploiting a live windows kernel flaw in afd.sys against defense and aviation targets via fake job offers, and a gru-linked sandworm subgroup, uac-0145, running fake recruiter interviews against ukrainian it workers since may. microsoft patched the lazarus zero-day on august 11 inside a 398-cve batch, its second-largest on record. the convergence is in method, not coordination — the employment funnel has become the shared entry point into defense-adjacent workforces. 91%
north korea's lazarus group and the gunra ransomware operation ran parallel campaigns against south korean targets through 2025 and the first half of 2026, exploiting the same vulnerabilities in korean banking software, with shared tooling and infrastructure detected. amazon separately attributed major attacks on open-source software repositories to north korean state actors. the same week, south korean equity markets crashed and hit roughly 700,000 retail traders — two unrelated pressures landing on one country. 90%
north korean groups surfaced in four separate items this cycle: lazarus hiding a full remote access trojan in six npm packages, a lazarus-linked breach of crypto firm bitrefill, and a $285m twelve-minute drain of the drift protocol attributed to dprk actors via on-chain flows. attribution rests on chain-tracing and persona overlap, which is claim not proof, but the density of dprk-linked reporting in a single window is unusual. 90%
two large crypto exploits — a $290m loss at layerzero/kelp and a $36m theft at humanity protocol — were both attributed to north-korea-linked actors (lazarus), with security firms citing compromised rpc nodes and a phishing email plus a compromised laptop. attribution here is a claim by the affected parties and security vendors, not confirmed fact. 89%
a north korean threat cluster ran a coordinated supply-chain attack placing 162 malicious artifacts across 108 packages spanning npm, go modules, packagist, and chrome extensions, targeting developer workstations to reach ci/cd pipelines. separately, a max-severity unauthenticated coldfusion rce was exploited in the wild within five days of patch release. both target the software substrate rather than end users. 89%

Every link carries this card — rendered, not screenshotted

E160· 30 JUL 2026

a research project by Aamir Hussain terms