Leaky TLS certificate exposes North Korea's Hangro VPN infrastructure

🕵️ RESEARCH & DEEP DIVES

• Leaky TLS certificate exposes North Korea's Hangro VPN infrastructure in Russia and China
  A misconfigured TLS certificate exposed North Korea's Hangro VPN infrastructure spanning North Korea, Russia, and Chinese address space.

  • Hangro is a state-linked VPN client with email and chat functions used by North Korean officials and trade representatives abroad to reach domestic systems.
  • A management certificate on port 6006 listed three North Korean and two Russian IPs plus internal carrier-grade NAT address 100.100.100.170, and appeared on 175.45.176.21 (Pyongyang) and 188.43.136.115/116 (Russia).
  • Malwarebox found all signatures in Hangro's 2024 certificate chain fail verification, and the Hangro client trusts bundled certificates rather than validating chains; older services on ports 465 and 7443 returned bad-signature errors.
  • Older infrastructure in Chinese address space includes default client endpoint 218.25.43.212, with registry contacts tied to silibank.com and ranges like 218.25.43.208/28.
  • IOCs include hangro.net.kp, certificate SHA-256 b8810eae6ead0ec3a606300c5e3fe9c7af23f836719596e9519f73b4e1e7ad01, and management TLS fingerprint 5a2f81451d6c921a7ab845b1856f67d71c76196cc34ace5ef7c7e8e471c3214b.
  Sources 📄 Source: blog.synapticsystems.de · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

• tradertraitor-terraform-macos — Cyber Security News

📋 ADVISORIES

• FBI's CJIS Security Policy v6.1 tightens encryption and vulnerability scanning requirements
  The FBI published CJIS Security Policy v6.1, raising encryption strength requirements and increasing vulnerability scanning frequency.

  • Applies to agencies and organizations handling Criminal Justice Information (CJI), with audits phased through 2027 and some states still auditing against v5.9.5.
  • SC-13 encryption for CJI in transit now requires at least 256-bit symmetric keys, up from 128-bit; SC-28 for CJI at rest also requires 256-bit encryption.
  • Vulnerability scanning frequency increased from quarterly to at least monthly under v6.1.
  • IA-2 requires MFA for privileged and non-privileged accounts; IA-5 requires quarterly updates to compromised password lists and checking new passwords against them.
  • Version 6.1 was published June 25, 2026, refining the NIST SP 800-53-aligned control structure introduced in v6.0.
  • Common audit findings include MFA gaps, BYOD policies, training, event logging, and fingerprinting.
  Sources 📎 Coverage: bleepingcomputer.com · 👁 via BleepingComputer

• • Source for Malicious npm package indexed-btree with ~2M downloads hides malware in runtime code — checkmarx.com

🔓 CVEs & KEV

• CVE-2026-84285 — Dassault Systèmes Tuleap Enterprise Edition — CVSS 8.8 — OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 1...

• CVE-2026-94381 — MISP — CVSS 8.7 — MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via up...

• CVE-2026-89139 — Temporal Technologies, Inc. Temporal Server — CVSS 8.7 — Temporal Server worker deployment compute provider executes a caller-supplied...

• CVE-2026-65654 — Temporal Technologies, Inc. temporalio/ringpop-go — CVSS 8.7 — temporalio/ringpop-go fails to enforce configured label limits on inbound mem...

• CVE-2026-65653 — Temporal Technologies, Inc. temporalio/tchannel-go — CVSS 8.7 — temporalio/tchannel-go zero-chunk call fragment causes process terminationgit...

• CVE-2026-65652 — Temporal Technologies, Inc. temporalio/tchannel-go — CVSS 8.7 — temporalio/tchannel-go malformed checksum type causes process terminationgith...

• CVE-2026-94383 — MISP — CVSS 8.6 — MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted F...

• CVE-2026-94374 — MISP — CVSS 8.3 — MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows ...

• CVE-2026-87858 — Temporal Technologies, Inc. Temporal Server — CVSS 7.2 — Temporal Server completion callback source header can direct attacker-chosen ...

• CVE-2026-94368 — Red Hat Openshift Data Foundation 4 — CVSS 7.1 — Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsi...

• CVE-2026-94379 — MISP — CVSS 6.9 — MISP: HTTP Method Bypass of Login Security Controls (Bruteforce Protection an...

• CVE-2026-94373 — MISP — CVSS 6.3 — MISP DOM-based Cross-Site Scripting via innerHTML in Contextual MenuMISP cont...

• CVE-2026-94372 — MISP — CVSS 6.3 — Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP De...