Threat Intel and more. Opinions are my own, unless retweeted. Open DMs.
Joined December 2009
- Tweets913
- Following663
- Followers13.5K
- Likes6.8K
Bart retweeted
People kept asking me for “ARTEX signatures” and “Cairn indicators”, so I wrote this
We found useful fingerprints and wrote rules. But identifying the framework isn’t the same as covering the attacks it orchestrates.
I wanted to explain that distinction, why attribution gets harder, and how noisy attacks can still succeed by moving fast.
I expect these frameworks to have a much bigger impact in the coming months. It’s worth understanding the technology behind the current attack waves, because I suspect they’ll build into a flood.
#ARTEX #Cairn
nextron-systems.com/2026/10/…
🤖 Made with AI
Bart retweeted
The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."
The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.
How You Can Help:
FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.
A list of addresses associated with this activity is available here: fbi.gov/investigate/cyber/al…
ALT FBI public service announcement with Department of Justice seal in the background on a gold gradient.
Bart retweeted
AI adoption by North Korean threat actors largely supports existing goals and targeting priorities, including generating revenue for the regime, collecting strategic intelligence, and, in some cases, pursuing politically motivated disruptive or destructive objectives, rather than representing a shift in actor motivations. msft.it/6010a0LAm
Recent activity by these threat actors illustrates AI-enabled acceleration and scaling:
- Jade Sleet launched campaigns through three front companies in a single week
- Onyx Sleet generated dozens of tailored lures in minutes
- Coral Sleet rapidly built a new capability to trojanize private source code repositories
- Diamond Sleet used AI to enhance tailored targeting workflows, including persona development and front company creation
- Pearl Sleet and Onyx Sleet have been leveraging the open-source agentic AI penetration testing framework ARTEX to conduct operations
Our latest blog breaks down how North Korean threat actors are utilizing AI across their operations, and provides mitigation guidance and Microsoft Defender detections to help organizations defend against these threats.
Bart retweeted
1/ Thought it might be helpful to translate this for crypto folks so you know who is hacking you.
tl;dr the word "Lazarus" doesn't mean anything anymore, it's just a collective name used to describe various North Korean cyber operations. The (relevant) clusters are as follows:
Bart retweeted
Confirmed: Binance hacker routed stolen TRX through Bitget wallet bridge into ETH, dumping straight into a wallet previously used in the Phemex hack.
It's Lazarus, without a doubt.
Funny how an APT unit can orchestrate a $6.3B multi-chain heist, but still gets caught reusing old deposit targets from 2025.
Swapping TRX to native ETH as fast as humanly possible because they know mainnet ETH has no admin freeze button.
2024: DMM Bitcoin
2025: Phemex & Bybit
2026: Binance ($6.3B)
They don't even bother generating fresh deposit addresses anymore. Lazarus is just running an automated DevOps pipeline to turn Web3 liquidity into national treasury reserves.
Bridge TRX -> native ETH -> Tornado/privacy -> off-grid.
The industry keeps building bridges, and North Korea keeps using them as sovereign exit liquidity.
Bart retweeted
Do you know Google Flare team ( an elite reverse engineering and malware analysis unit ) has a crash course that explains and teaches malware analysis from basics to advanced step by step.
Link :- docs.google.com/document/d/1…
Bart retweeted
Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.
Read more: chainalysis.com/blog/binance…
Bart retweeted
Our investigators observed funds stolen by DPRK in last month's Bitget exploit commingling with funds stolen from Binance.
We have a high degree of confidence that DPRK is responsible for the $6.4 billion hack of Binance.
We live in unprecedented times. But DPRK are up to their old tricks. We assess @binance hack for $6.4B was likely done by DPRK group TraderTraitor due to links to previous hack. Industry partners have already frozen ~$3B and we @chainalysis continue to follow all of the funds
Bart retweeted
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
Bart retweeted
Just dropped a new blog post! 🔥
blog.orange.tw/posts/2026-10…
