Japan Dismantles First North Korean Laptop Farm as Allies Detail

💥 BREACHES & INCIDENTS

• Elsevier hacked, website replaced with LAPSUS$ ransomware group portal
  Elsevier was hacked and its website was replaced with a LAPSUS$ ransomware group portal.
  • WHO: Elsevier, the academic publisher, and its website visitors
  • WHAT: Elsevier's website was defaced and replaced with a LAPSUS$ ransomware group portal
  • HOW: Details of the intrusion method were not disclosed in the reporting
  Sources 📎 Coverage: cyberplace.social · 👁 via @GossiTheDog@cyberplace.social

🕵️ RESEARCH & DEEP DIVES

• Japan Dismantles First North Korean Laptop Farm as Allies Detail WaterPlum Scheme
  The US, Japan, Germany and Australia published a joint advisory on North Korea's WaterPlum (Contagious Interview) campaign, including Japan's first dismantling of a North Korean laptop farm.

  • Targets software developers, web designers, engineers, and cryptocurrency, blockchain and web3 specialists, impersonating real AI, crypto and NFT companies as fake employers
  • Between December 2025 and July 2026, WaterPlum infected at least 30,000 devices in over 100 countries and drained funds or credentials from more than 7,000 crypto wallets, with roughly $10.71 million reaching North Korea
  • Compromised developers give the group a path into employer networks; stolen data has also been used for extortion and accessing trade secrets
  • Operatives use AI face-swapping on video interviews, VPNs, fake resumes, and laptop farms run by accomplices to mask North Korean IT workers' locations
  • Japan and the FBI attribute WaterPlum and North Korean IT workers to the 313 General Bureau of the Munitions Industry Department; Japan seized a laptop farm and traced hundreds of millions of yen in crypto transfers
  Sources 📎 Coverage: securityweek.com · 👁 via SecurityWeek

• Hidden Meta Muse Setting Can Turn Mac AI Assistant Into a Backdoor, PoC Shows
  A proof-of-concept shows malware already on a Mac can hijack Meta's Muse assistant via a hidden dictation setting and abuse its broad user-granted access.

  • Affects Mac users of Meta's Muse personal AI assistant, launched this month in the US with access to files, email, messages, calendar, shopping and smart-home apps
  • The undocumented preference endo_voyager_dictation_endpoint controls where Muse sends dictation and can be changed by any program running as the logged-in user, redirecting audio and text to an attacker
  • An attacker can read dictated prompts, inject instructions Muse trusts and acts on, and steal the Muse account token to control the assistant on any signed-in device, including an iPhone
  • Remote delivery is possible via a ClickFix trick that fools the user into running a single command with nothing to download
  • Commands come from the signed Muse app, so security software may not flag them; researcher Patrick Wardle released the PoC on September 21 without reporting to Meta first
  Sources 📎 Coverage: thehackernews.com · 👁 via The Hacker News

• Trellix details NTDS.dit theft chain that dumps AD hashes and forges Golden Tickets
  Trellix has documented an attack chain in which hackers steal the NTDS.dit Active Directory database to dump password hashes and forge Golden Tickets.

  • Applies to Windows networks using Active Directory domain controllers, which manage identities and permissions for every account in the domain.
  • Attackers target the NTDS.dit database and the SYSTEM registry hive to extract NTLM hashes, Kerberos keys, and password history offline.
  • The chain begins with spearphishing, malicious Office macros, shortcut files, or tampered installers, followed by an in-memory first-stage payload that escalates privileges.
  • After reaching SYSTEM access, attackers harvest credentials from lsass.exe, abuse Volume Shadow Copy Service to copy the locked database, and exfiltrate files via SMB and HTTPS to cloud storage.
  • Theft of the KRBTGT secret enables forging Golden Tickets for durable domain access; IOCs include ntds.dit, the SYSTEM hive, secretsdump.py, and the HarddiskVolumeShadowCopy1 shadow-copy path.
  Sources 📄 Source: trellix.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

🔓 CVEs & KEV

• CVE-2026-82187 — WPScan Web to Print Online Designer — CVSS 9.8 — WooCommerce Online Product Designer 1.7.0 - before 2.15.0 - Unauthenticated Arbitr...

• CVE-2026-93485 — Automattic WordPress — CVSS 7.1 — WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session

📋 ADVISORIES

• 📄 Source for CISA Adds Actively Exploited Zyxel GS1900 Switch Buffer Overflow (CVE-2026-7273) to KEV Catalog — zyxel.com

• 📄 Source for Booking Calendar WordPress plugin <= 11.8.3 vulnerable to reflected XSS via wpbc_auto_fill (CVE-2026-93655) — wordfence.com