Hackers
Hackers
Hackers
The people behind the keyboard — profiles, culture and news from the world of hackers.
LegacyHive: Unpatched Windows Zero-Day PoC Dropped Hours After Patch Tuesday
Within hours of July's Patch Tuesday, a researcher going by Nightmare Eclipse (also seen as Chaotic Eclipse) published a proof-of-concept exploit for a new Windows vulnerability dubbed LegacyHive. No patch existed at the time of release, and the exploit works on the latest build of the system, assembled with July's updates already applied. The vulnerability lives in the Windows User Profile Service (ProfSvc) and its registry hive loading mechanism. When a user signs in, Windows mounts the UsrCl
More Stories
$643M in Six Months: How Lazarus Operates and Where the Evidence Runs Out
In the first half of 2026, analysts at TRM Labs attributed roughly $643 million to groups linked to North Korea, about 66% of everything stolen from the cryptocurrency industry, out of some $972 million lost across 207 incidents. Almost all of it came from two April attacks on DeFi protocols: the roughly $292 million breach of KelpDAO and the $285 million hit on Drift Protocol. A year earlier the shape was similar but the scale was not. Chainalysis put 2024 losses to DPRK-linked hackers at $1.34
LegacyHive: Unpatched Windows Zero-Day PoC Dropped Hours After Patch Tuesday
Within hours of July's Patch Tuesday, a researcher going by Nightmare Eclipse (also seen as Chaotic Eclipse) published a proof-of-concept exploit for a new Windows vulnerability dubbed LegacyHive. No patch existed at the time of release, and the exploit works on the latest build of the system, assembled with July's updates already applied. The vulnerability lives in the Windows User Profile Service (ProfSvc) and its registry hive loading mechanism. When a user signs in, Windows mounts the UsrCl
Ill Bloom: A Weak Seed-Phrase Generator Drained Over $5M From Crypto Wallets
Researchers at Coinspect have disclosed Ill Bloom, a vulnerability in how several cryptocurrency wallets generate their mnemonic recovery phrases (seed phrases). Exploiting it, attackers emptied hundreds of wallets in a single pass and made off with more than $5.1 million. The problem is not one specific wallet but the phrase-generation method used by a handful of lesser known apps, mobile and browser extensions, some dating back to 2018. These wallets relied on a weak random number generator,
Crypto Theft Fell to $972M in H1 2026, but North Korea's Share Climbed to Two-Thirds
In the first half of 2026, attackers stole about $972 million from the cryptocurrency industry across 207 incidents, according to a mid-year report from analytics firm TRM Labs. The figure is down by more than half from the same period in 2025, when losses were put at $2.3 billion. Despite the overall decline, the share tied to North Korea has actually grown. Analysts attribute roughly $643 million, about 66% of the half-year total, to the Lazarus Group and its TraderTraitor subunit. Almost all
Silver Fox Levels Up: The Chinese Crew Switches to Rust
Known for its fake installers, the China-linked group Silver Fox has a new tool, MODBEACON. Judging by the engineering, the fox is done playing the amateur.
Lazarus Hides a RAT in npm: Six Fake Rollup Polyfill Packages
The North Korean group is going after developers again. In late June, six malicious npm packages posing as a popular build tool turned up in the registry, each carrying a full remote access trojan.
A $10 Million Price Tag: Meet Wazawaka, One of the FBI's Most Wanted
Mikhail Matveev is accused of ransomware attacks around the world, and the US will pay up to 10 million dollars for information on him. He lives openly in Russia, taunts the FBI, and has now been charged by the Kremlin too.
The EU and UK Hit Russia With Their First Joint Cyber Sanctions
The sanctions target FSB Centre 16, the arm of Russian intelligence behind one of the world's most durable hacking operations, over a decade of attacks on Europe including an attempt to black out Poland in winter.
The Gentlemen Hit 18 Companies in 24 Hours, Now the Second Busiest Ransomware Crew
The Gentlemen, a ransomware crew spun out of a Qilin payment dispute, has scaled to record volumes. On July 10 it claimed 18 fresh victims in a single day, outpacing even Qilin.
CrashStealer: macOS Malware Passed Apple's Checks and Posed as a System App
A macOS infostealer disguises itself as Apple's own CrashReporter and lands on Macs with a valid, notarized developer signature that Gatekeeper waves through without a warning.
Fake FSB Officer Tried to Shake Down the Conti Ransomware Gang
A Moscow man allegedly posed as an FSB officer and demanded money from one of the most dangerous ransomware crews in history. He is now in jail.