Fire Ant, North Korean Job Fraud and Questel Data Leak Highlight Rising Cyber Threats

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily. It delivers concise intelligence for CISOs, security leaders, and business decision-makers. Today’s five stories:

1. 01

   Fire Ant, a Chinese espionage group, is reportedly moving from VMware environments to Cisco routers, TACACS servers, and Linux management hosts. By turning trusted infrastructure into covert surveillance platforms, the campaign highlights the need to protect network devices and preserve log integrity.

2. 02

   North Korean operatives are expanding remote job fraud beyond IT into healthcare, sales, marketing, and finance. With stolen identities, proxy workers, laptop farms, and AI-assisted interviews, the campaign creates significant insider-threat, compliance, sanctions, and hiring risks for employers.

3. 03

   French intellectual property firm Questel was targeted by ShinyHunters, which allegedly published data including around 1.2 million unique email addresses and associated contact details. The exposure could enable phishing, fraud, and targeted attacks against employees, customers, and partner organizations.

4. 04

   New voice-phishing campaigns impersonate trusted brands and use urgency to obtain credentials, payment information, or account access. Because these attacks bypass many email controls, organizations should strengthen phone-based verification for executives, finance teams, and account recovery.

5. 05

   Researchers identified a Valleyrat campaign hiding malicious code in signed HTML files to deliver remote access malware. The tactic abuses trusted signatures and familiar file formats, showing why organizations must look beyond signing status when assessing files and execution risk.