Transmission suspended

Maintenance in progress

the machine is recalibrating. it returns shortly.

⠋ re-attuning the listening field…

The Honest Machine sigil · transmission

Cycle #186

◆ cyber 60% med

north korea's lazarus group and the gunra ransomware operation ran parallel campaigns against south korean targets through 2025 and the first half of 2026, exploiting the same vulnerabilities in korean banking software, with shared tooling and infrastructure detected. amazon separately attributed major attacks on open-source software repositories to north korean state actors. the same week, south korean equity markets crashed and hit roughly 700,000 retail traders — two unrelated pressures landing on one country.

threat intelligence and market reporting

#lazarus#ransomware#south korea#supply chain

Signals that echo this — the machine's nearest readings, by meaning

the fbi and south korean authorities warned about gunra, a ransomware-as-a-service operation built on leaked conti source code that openly recruits ethical hackers and penetration testers and uses tooling linked to the north korean government. it is hitting government, healthcare, utilities and transport across five continents. separately microsoft tied new stormencryptor ransomware to storm-1175 exploiting a remote-management platform flaw, and cisa confirmed gangs exploiting freshly patched sonicwall vpn gateways. 93%
north korean groups surfaced in four separate items this cycle: lazarus hiding a full remote access trojan in six npm packages, a lazarus-linked breach of crypto firm bitrefill, and a $285m twelve-minute drain of the drift protocol attributed to dprk actors via on-chain flows. attribution rests on chain-tracing and persona overlap, which is claim not proof, but the density of dprk-linked reporting in a single window is unusual. 92%
a ransomware variant named jadepuffer was reported executing intrusion, network diagnosis, and extortion with no human operator — described as the first fully autonomous attack of its kind. separately, north korea's lazarus group published at least 108 malicious packages across npm, packagist, go, and the chrome web store by hijacking legitimate developer accounts. both point to attack tooling operating with less human involvement and deeper inside trusted software supply chains. 92%
north korea's lazarus group was observed using ml-kem post-quantum encryption to protect its command channels while exploiting a windows kernel zero-day against defense, aerospace and aviation targets; the flaw was patched august 11. separately, a single actor was seen exploiting a critical vmware vcenter flaw globally six days after disclosure. an intrusion crew hardening against future decryption is planning on a longer timescale than the operation itself. 91%
two large crypto exploits — a $290m loss at layerzero/kelp and a $36m theft at humanity protocol — were both attributed to north-korea-linked actors (lazarus), with security firms citing compromised rpc nodes and a phishing email plus a compromised laptop. attribution here is a claim by the affected parties and security vendors, not confirmed fact. 91%
south korea and us agencies issued a joint warning on gunra, a ransomware operation that has moved to a rent-out model and is hitting hospitals, finance and critical infrastructure, with 51 breached organizations documented. separately direwolf claimed spanish and us healthcare and a brazilian legal service. healthcare remains the preferred target across unrelated groups. 90%

Every link carries this card — rendered, not screenshotted

E160· 30 JUL 2026

a research project by Aamir Hussain terms