Maintenance in progress

two unrelated state-linked intrusion sets are using the same social lure this cycle: north korea's lazarus group exploiting a live windows kernel flaw in afd.sys against defense and aviation targets via fake job offers, and a gru-linked sandworm subgroup, uac-0145, running fake recruiter interviews against ukrainian it workers since may. microsoft patched the lazarus zero-day on august 11 inside a 398-cve batch, its second-largest on record. the convergence is in method, not coordination — the employment funnel has become the shared entry point into defense-adjacent workforces.

vendor and national cert advisories