eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Kimsuky’s HttpTroy and Lazarus’s New BLINDINGCAN Variant
Bottom Line: The North Korean state-sponsored APT groups Kimsuky and Lazarus have been observed launching attacks against Canada and South Korea. While the attacks involved novel malware, these threat actors continue to rely on phishing as a means of initial access.
On October 30th, 2025, Gendigital published a report on their observations on the recent investigations into attacks conducted by the Democratic People's Republic of Korea (DPRK) state-sponsored Advanced Persistent Threat (APT) groups Kimsuky and Lazarus. The report highlights the addition of new malware and advanced defense evasion techniques to the groups’ attack strategies.
Lazarus (aka Labyrinth Chollima, HIDDEN COBRA, and APT38) was observed targeting two victims in Canada where the threat actors delivered malware likely via phishing emails. Gendigital identified two new variants of the Comebacker downloader and a new version of the BLINDINGCAN Remote Access Trojan (RAT), both of which Lazarus has previously employed in past attacks. The Dynamic Link Library (DLL) variant of Comebacker is executed via a Windows service, while the Executable (EXE) is launched via Command Prompt. The malware resolves APIs dynamically, configures registry entries, decrypts embedded payloads, and deploys the next stage payload as a service. Comebacker drops a service binary, internally named “Compcat_v1.dll”, which decrypts the final payload. BLINDINGCAN RAT is launched in the last stage, which establishes connection to the Command-and-Control (C2) server. The RAT executes a series of commands to collect system and directory information, create and kill processes, and exfiltrate data. Advanced obfuscation was observed throughout the infection chain including HC256 stream cipher and AES-128-CBC encryption.
Kimsuky (aka Black Banshee, Velvet Chollima, and APT43) targeted a victim in South Korea possibly via phishing email to deliver a VPN invoice-themed ZIP archive file, containing a malicious Microsoft Windows screensaver file (.SCR). The file is a GO binary which upon execution, displays a decoy PDF file and deploys the next stage payload as a COM server. The first malware, MemLoad, creates an AhnLab-style scheduled task name to evade the anti-virus software and establish persistence. MemLoad decrypts and executes a new, highly obfuscated backdoor, named HttpTroy. The backdoor enables the attacker to gain complete control over the compromised device. It can upload and download files, capture screenshots, execute commands remotely with elevated privileges, load executables in memory, initiate reverse shell session, terminate processes and clear traces.
eSentire Threat Intelligence Analysis:
North Korea's cyber program is a fully developed, state-sponsored national initiative that involves the training and deployment of specialized personnel, referred to as APTs, to conduct cyber espionage, financial theft, and disruptive cyberattacks. A recent joint report by participating states of the Multilateral Sanctions Monitoring Team (MSMT) highlights DPRK APT campaigns aimed at circumventing United Nations sanctions to support the regime's scientific and technological progress. Both the Kimsuky and Lazarus APT groups have been active for decades, executing numerous operations. Gendigital's report underscores these groups' persistent efforts to update their malware tools and refine their attack techniques, particularly in evading detection
Since November 2023, the Lazarus APT group has been actively engaged in the financially motivated Contagious Interview campaign. This campaign has evolved by utilizing new versions of malware previously used in attacks and introducing entirely new malware, including BeaverTail, InvisibleFerret, and OtterCookie. On October 16th, 2025, Cisco reported that recent observations of the campaign involved the deployment of an advanced JavaScript malware, which combines BeaverTail and OtterCookie, aimed at stealing sensitive data. The Contagious Interview campaign highlights the sophistication of Lazarus operations, contributing to the campaign's prolonged duration.
Kimsuky and Lazarus have consistently relied on phishing techniques to deploy malware in their campaigns. While the malware used in these campaigns continuously evolve, showcasing the advanced technical skills of the threat actors, the reliance on phishing underscores the ongoing relevance of the social engineering tactic as a primary Initial Access Vector (IAV) among threat actors. As per a DeepStrike report, phishing accounted for 36% of all data breaches in 2025, making it an effective method for attackers to achieve initial access. Organizations are advised to regularly conduct Phishing and Security Awareness Training (PSAT) to educate employees about the latest phishing trends. The training should enable employees to recognize and report phishing attempts, thereby lowering the potential risk of a security breach. Other mitigations can include disabling the automatic download of file attachments in emails to enhance security and deploying robust Endpoint Detection and Response (EDR) solutions to help identify and contain malicious payloads.
The eSentire Threat Intelligence team monitors significant campaigns conducted by DPRK threat actor groups and is currently tracking the attacks highlighted in the Gendigital report to identify potential detection opportunities.
Scattered LAPSUS$ Hunters Onion Leak Website Taken Down by Law-Enforcement Agencies
Bottom Line: The data leak website managed by the Scattered LAPSUS$ Hunters group has been seized by law enforcement agencies after the group claimed to have acquired one billion records from a Salesforce data breach in August 2025. Following the takedown, the group announced a temporary halt to operations, claiming that they will resume in 2026.
On October 9th, 2025, a coordinated international law enforcement operation led by the FBI, U.S. Department of Justice, and French cybercrime authorities successfully seized the onion leak infrastructure operated by the cybercriminal collective known as Scattered LAPSUS$ Hunters. Scattered LAPSUS$ Hunters is described as an alliance of three established groups: Scattered Spider, LAPSUS$ and ShinyHunters (referred to as the “Trinity of Chaos”) operating under the ecosystem called “The Com”. They had repurposed the BreachForums platform to extort victims following a massive breach of Salesforce customer databases.
The group employed social engineering tactics to compromise Salesforce tenants, claiming theft of over one billion records from major corporations, including Adidas, Cisco, McDonald’s, and Qantas Airways. BreachForums was used as a clearnet and TOR-based leak site to pressure victims into ransom payments, with a deadline set for October 10th, 2025. Authorities seized BreachForums’ domains and backend servers, including historical database backups dating back to 2023. A seizure notice was displayed on both clearnet and onion versions of the site.
Despite the takedown, the group leaked data from six companies on October 10th and announced a temporary dissolution on October 11th, 2025, with plans to return in 2026 under an Extortion-as-a-Service (EaaS) model. The group maintains a presence on Telegram and may relaunch operations via mirror sites.
eSentire Threat Intelligence Analysis:
The operating style of Scattered LAPSUS$ Hunters is quite significant in the cybercrime extortion ecosystem. This isn’t just a single ransomware gang; it is a coordinated alliance with specialized skillsets aligned toward data theft and public extortion. The takedown of the leak domain is a positive step, but public posting by the group indicates that the domain seizure did not impact their operations. It is possible that the takedown had a greater impact than what was publicly stated by the group and this statement was meant to preserve their reputation.
On October 10th, 2025, the group announced the launch of an EaaS program that enables affiliates to perform data-theft-only operations without deploying encryption payloads. This model reduces operational complexity and allows affiliates to “fly under the radar” by focusing solely on stealing and threatening to leak data. Based on new findings from Unit42, on October 5th, the group posted an advertisement for insider access recruitment specifically targeting employees within call centers, telecom providers, hosting services, gaming, and Software-as-a-Service (SaaS) companies located in the United States, the United Kingdom, Canada, Australia, and France. On October 4th, Scattered LAPSUS$ Hunters referenced the development of a new ransomware strain dubbed “SHINYSP1D3R.” While no active samples or confirmed deployments have been identified, this announcement may represent a tactic to intimidate potential targets.
The group’s transition to EaaS operations underscores the evolving landscape of financially motivated cybercrime, where encryption is no longer a prerequisite for monetization. By focusing on data exfiltration and exposure threats, threat actors can achieve comparable financial outcomes while minimizing detection and forensic exposure. The recruitment efforts of insiders highlight the persistent risk of internal compromise, particularly within industries that rely on third-party support or customer-service outsourcing. This approach could enable attackers to bypass perimeter defenses and access sensitive systems with legitimate credentials.
Given the collaborative structure of this alliance, which enables shared resources, expertise, and tooling across groups, organizations should proactively monitor for tactics and overlapping infrastructure use. Assume your SaaS and cloud data may be targeted, monitor for suspicious access and data extraction, establish clear incident-response playbooks for data leaks, and ensure visibility into third-party and vendor access. The eSentire Threat Response Unit (TRU) is actively tracking this topic for additional details and detection opportunities.
Hacktivists Target Canadian Industrial Control Systems
Bottom Line: A report from CCCS was recently published, shedding light on cyber attacks within Canada, targeting Industrial Control Systems. The report indicates that hacktivists were behind the attacks, suggesting that the attacks may have likely been an attempt to gain media attention and discredit organizations.
On October 29th, 2025, the Canadian Centre for Cyber Security (CCCS) issued an alert for recent attacks observed within Canada, targeting Industrial Control Systems (ICS). CCCS indicates that they, along with the Royal Canadian Mounted Police (RCMP), have received “multiple reports of incidents involving Internet Accessible ICS” over the recent weeks. ICS are integrated hardware and software configurations, which are used to control and automate industrial processes, including manufacturing, energy, utilities, and critical infrastructure.
Within their alert, CCCS provides examples of attacks against ICS that were observed, including a water treatment plant, a Canadian oil and gas company, and a Canadian farm. In the incident that impacted the water facility, attackers were able to tamper with water pressure valves, which resulted in “degraded service for its community”. In the attack reported against an oil and gas company, the attackers were able to manipulate an Automated Tank Gauge (ATG), which caused false alarms to trigger. The final example that CCCS provides was an attack against a Canadian farm, which involved threat actors manipulating the temperature and humidity levels of a grain drying silo, which could have resulted in “potentially unsafe conditions if not caught on time”. CCCS indicates that the attacks were conducted by hacktivists, which are threat actors who perform politically or socially motivated cyber attacks, and are “increasingly exploiting” ICS devices to “gain media attention, discredit organizations, and undermine Canada's reputation”.
CCCS states that exposed ICS components can pose “significant risks to organizations, their clients, and the broader Canadian public”, and should be properly secured. Examples of such components include Programmable Logic Controllers (PLCs), Remote Terminal Units (RTUs), Supervisory Control and Data Acquisition (SCADA) systems, Safety Instrumented Systems (SIS), Building Management Systems (BMS) and Industrial Internet of Things (IIoT) devices. Recommendations provided by CCCS include conducting a comprehensive inventory of Internet-accessible ICS devices and assessing their necessity, and if possible, these devices should be placed behind Virtual Private Networks (VPNs) with Multi-Factor Authentication (MFA) enabled to avoid direct exposure. If this is not possible, CCCS recommends “enhanced monitoring practices”, which include the deployment of Intrusion Prevention Systems (IPS), regular penetration testing, and continuous vulnerability management.
eSentire Threat Intelligence Analysis:
CCCS indicates that the threat actors behind the reported attacks were hacktivists but does not provide any additional information or evidence to support this claim. However, attacks against ICS devices are notable, as these systems are critical within our daily lives, and control critical supply chains and services including food, health, and energy. Within the examples of attacks provided by CCCS, the impacts have the potential to be far-reaching, with not only being financial, but impacting the environment and public safety as well. Attacks against ICS within water treatment facilities can cause water contamination or shortages to impacted communities. With the example of the attack against the systems within a grain drying silo on a farm, the impacts of this attack could have resulted in physical damage, such as a fire, or the contamination and spoilage of grain, which on a large scale can lead to food shortages and increased prices. The criticality of ICS devices, and the large-scale impacts that attacks can have, are a large reason why these devices are prime targets in cyber-attacks.
Threat actors have a long history with targeting ICS devices around the globe to complete their objectives, with an early example being the Stuxnet worm from 2010. Stuxnet was used against Iranian nuclear facilities, with the objective to cause physical damage to the centrifuges, impacting the Iranian nuclear program. In April 2020, an Iranian-linked threat group targeted water facilities in Israel, attempting to increase the chlorine concentration within the water supply, which can lead to both immediate and long-term health issues, including cancer. Not all attacks impacting ICS systems are politically motivated, with an example from May 2021 involving a ransomware attack against Colonial Pipeline in the United States. Although an ICS was not the Initial Access Vector (IAV), the attack caused Colonial Pipeline to shut down their pipeline to prevent the spread of ransomware. This resulted in jet fuel shortages, causing some airlines to shut down, along with gasoline shortages due to consumer panic buying. These examples demonstrate the continued blurring of lines between cyber and real-world attacks and highlight the impact and harm that attacks targeting ICS can have.
The United States Cybersecurity and Infrastructure Security Agency (CISA) has published advisories regarding attacks against ICS and other critical systems by Russian and Iranian state-sponsored threat actors, with the suspected “purposes of espionage, destruction, and influence”. A recent report from the McCrary Institute for Cyber and Critical Infrastructure Security notes that Chinese state-sponsored threat actors are targeting energy, water, telecommunications, transportation, and healthcare systems in the United States, suggesting that the goal of the attacks would be to ”disrupt logistics, delay military deployments, and target essential civilian systems". As Canada and the United States share a lot of infrastructure, an attack against an ICS in one country has the potential to negatively impact the other. Outside of North America, the European Union Agency for Cybersecurity, ENISA, published their Threat Landscape 2025 report, indicating that attacks targeting ICS and other critical systems comprised of 18.2% of attacks observed in Europe between July 2024 and June 2025, underscoring how prevalent they are. eSentire's Threat Intelligence team assesses with high confidence that attacks targeting ICS will continue to increase in the future, and organizations that make use of these systems should follow recommended best practices to harden infrastructure and mitigate risk.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
