News related to
attack

A North Korean operative’s attempt to infiltrate Kraken, a prominent cryptocurrency exchange, through a deceptive job interview has been successfully thwarted, highlighting the increasing sophistication of state-sponsored cyber-espionage tactics targeting the digital asset industry.

The incident involved an individual posing as a qualified IT professional, leveraging fabricated credentials and a falsified identity to secure a remote position within Kraken. The operative’s strategy included the use of advanced social engineering techniques, such as deepfake technology and AI-generated documentation, to bypass standard hiring protocols. However, Kraken’s vigilant recruitment team identified inconsistencies during the interview process, leading to the exposure of the applicant’s true affiliation.

This event underscores a broader pattern of North Korean cyber operations aimed at the cryptocurrency sector. The Lazarus Group, a hacking collective linked to North Korea’s Reconnaissance General Bureau, has been implicated in numerous cyberattacks resulting in substantial financial losses. Notably, the group orchestrated a $37 million theft from CoinsPaid in July 2023 by deceiving an employee into downloading malware under the guise of a job-related task.

The United Nations has reported that North Korea employs over 4,000 IT workers globally, generating approximately $600 million annually to fund its nuclear weapons program. These operatives often assume false identities and secure positions in tech firms, exploiting the remote work culture to mask their true origins.

In the United Kingdom, authorities have urged companies to conduct in-person or video interviews to mitigate the risk of hiring imposters. A recent analysis revealed that a single North Korean agent operated under 12 different personas across Europe and the U.S., infiltrating sensitive sectors including defense and government.

The FBI has also issued warnings about North Korean schemes involving fake job offers and investment opportunities designed to trick individuals into downloading malware. These social engineering attacks are characterized by their complexity and the use of sophisticated technical acumen to compromise even well-versed cybersecurity professionals.

Cybersecurity experts emphasize the need for rigorous hiring practices, including thorough background checks and identity verification, to counteract these threats. Companies are advised to be wary of applicants who avoid video interviews, request payment through unconventional means, or exhibit inconsistencies in their professional histories.

The Instagram accounts of several high-profile Pakistani actors, including Hania Aamir and Mahira Khan, have been blocked in India, igniting a wave of speculation regarding the reasons behind the sudden move. The affected profiles, which boasted millions of followers, are now inaccessible to users across the border, while others, like Fawad Khan and the Pasoori singers Ali Sethi and Shae Gill, remain unaffected.

This action has raised questions about the influence of geopolitics on social media platforms, with many linking it to the ongoing tensions between India and Pakistan. The rationale behind the selective restriction of some accounts while allowing others to remain online has fueled debate about whether these moves are politically motivated or driven by different factors.

Reports suggest that the blocking of certain accounts, including those of Aamir and Khan, is likely connected to the complex political dynamics between the two nations. While both actors enjoy immense popularity in India, their affiliations with Pakistan have led to their profiles becoming targets amid heightened nationalist sentiments. The decision to block their accounts, however, has sparked an outcry from fans and industry insiders alike, with many expressing their concerns over the restrictions imposed on artists who have long been cultural icons.

Interestingly, despite the suspension of several profiles, some accounts, like those of Fawad Khan, Ali Sethi, and Shae Gill, continue to operate without hindrance. These artists have not faced similar restrictions, which has prompted some to speculate that Instagram’s decisions may not solely be influenced by national political relations but also by other internal policies or even the specific content shared by the users involved.

Fawad Khan, known for his roles in popular Indian television dramas, has remained an important figure in cross-border entertainment, particularly after the success of his shows and films in India. Despite the political challenges faced by the entertainment industry, Khan continues to maintain a strong fanbase in both countries. Similarly, the Pasoori track, which gained significant traction on global music platforms, has kept Ali Sethi and Shae Gill in the spotlight, with their Instagram accounts still accessible in India.

The differing treatment of these celebrities has led to further confusion, as critics point to the selective nature of the blocks. Some observers argue that it may not be a coincidence that the artists who still have access to their social media accounts tend to be those with a more neutral or apolitical public image. For instance, Fawad Khan’s involvement in humanitarian causes, and Sethi and Gill’s focus on music rather than overtly political statements, could have played a role in their profiles escaping the restrictions.

Social media platforms like Instagram have increasingly become an arena for diplomatic and political clashes. Over the past few years, the divide between India and Pakistan, exacerbated by conflicts and tensions over various issues, has had a marked impact on the entertainment industry. Artists from both sides of the border, especially those who have gained recognition in India or Pakistan, have faced scrutiny or even censorship, depending on the prevailing political climate.

This trend, however, has also highlighted the growing influence of digital platforms in shaping public opinion. As people increasingly turn to social media to connect with celebrities, access entertainment, and share opinions, the role of platforms like Instagram in regulating content has come under scrutiny. Critics argue that blocking accounts of artists could have broader implications, affecting the cultural exchange and soft power that both India and Pakistan have historically shared through film, music, and television.

India and Pakistan have a long history of cultural exchange, with artists from both countries enjoying success across the border. Pakistani dramas, films, and music have found a loyal audience in India, while Bollywood actors and singers have been embraced by fans in Pakistan. These cross-border collaborations have often been seen as a bridge between the two countries, offering a form of soft diplomacy that transcends politics. However, the rise of nationalist sentiments in both nations has led to growing restrictions on such collaborations, particularly in the wake of the 2016 Uri attack and subsequent tensions between the two governments.

With the blockage of these Instagram accounts, many are questioning whether the entertainment industry is being used as a tool for political statements, and whether the social media restrictions are an extension of these sentiments. The selective blocking of celebrity accounts could potentially signal the prioritisation of nationalistic policies over the freedom of expression, as the state’s influence over digital platforms grows.

The broader impact of these social media restrictions on the entertainment industry remains to be seen. For artists who have built their careers through online platforms, such as Instagram, the sudden loss of access to millions of followers in a major market like India is a blow to their brand and reach. The effect on their career prospects in India may be significant, as the platform serves as a primary means of communication with fans, especially during the promotional phases of their work.

Marks & Spencer faced a significant digital disruption that impacted its click-and-collect services and in-store contactless payments, raising fresh concerns about cyber vulnerabilities across the global retail landscape. The incident underlined the increasing exposure of retail giants to cybersecurity threats, urging businesses, especially across emerging markets, to reevaluate their digital defences.

The British retailer confirmed that a cyberattack had interfered with its operational systems, temporarily disabling key customer services. Shoppers were unable to collect online orders or make contactless payments across several outlets, forcing stores to rely on manual processing where possible. Though Marks & Spencer worked swiftly to restore functionality, the attack exposed glaring weaknesses that could have far-reaching implications for retailers heavily dependent on digital infrastructure.

Cybersecurity analysts described the attack as a “wake-up call” for retailers worldwide, emphasising that operational continuity can no longer be taken for granted. While Marks & Spencer managed to contain the damage and reported no compromise of customer data, the event demonstrated how even non-financial hacking attempts could paralyse critical retail functions. The attack appears to have targeted internal systems rather than consumer databases, but the operational disruption caused significant inconvenience to customers and operational stress on store teams.

The UK-based company has yet to disclose specific details regarding the nature of the cyberattack or the group responsible, although preliminary assessments suggest the involvement of sophisticated malware designed to penetrate commercial transaction systems. Cybersecurity experts point out that retail chains are increasingly becoming attractive targets for cybercriminals seeking either financial ransom or operational chaos, with attackers focusing not only on stealing data but on interrupting services to exert pressure.

The disruption at Marks & Spencer also resonates strongly across global retail markets, particularly in countries like India, where digitalisation has accelerated dramatically over the past decade. Retail operations across the country are embracing online ordering, contactless payments, and digital inventory systems at an unprecedented pace. Yet the investments in cybersecurity have not always kept pace with the technological expansion, leaving significant vulnerabilities that could be exploited by malicious actors.

Industry experts warn that India’s retail sector, in its rush to modernise, must prioritise building robust cyber resilience strategies. The cyberattack on Marks & Spencer serves as a stark reminder that operational security is as critical as data protection. Retailers must not only guard customer information but ensure that their core business functions can withstand digital assaults without crippling their ability to serve consumers.

Retailers in India, from large conglomerates to smaller regional chains, have increasingly relied on digital payment platforms and integrated online-to-offline models. However, security audits and penetration testing, critical components of cyber defence, are often treated as secondary concerns. The focus on speed and growth has sometimes eclipsed the need for thorough cybersecurity frameworks, an oversight that experts say could prove costly if not urgently addressed.

The disruption of click-and-collect services at Marks & Spencer also illustrates the interconnectedness of digital and physical retail operations. When digital systems falter, physical stores quickly become vulnerable, as manual fallback options are seldom equipped to handle high volumes. In densely populated and high-transaction retail environments such as those in India, the consequences of a similar disruption could be even more severe, with longer downtimes and greater financial losses.

Cybersecurity firms have consistently highlighted retail as one of the sectors most at risk from targeted cyberattacks, given the volume of personal and financial data handled daily. However, incidents like the one affecting Marks & Spencer show that the objective of cybercriminals is shifting. Operational disruption can have as much reputational and financial impact as a data breach, if not more, by immediately affecting customer trust and satisfaction.

Amid evolving threats, there is growing advocacy for a shift towards cyber resilience rather than simple cyber defence. Cyber resilience focuses on building systems capable of absorbing and recovering from attacks without significant interruption to business activities. Experts suggest that this model is more suitable for modern retail, where zero-downtime expectations dominate consumer behaviour.

Leading cybersecurity professionals recommend that retailers invest in dynamic risk assessments, employee training, multi-layered security architectures, and incident response simulations. Retailers must also rethink their supply chain security, ensuring that third-party vendors do not become weak links in their cyber resilience strategy. Given the interconnectedness of suppliers, logistics, and payment partners in retail ecosystems, an attack on one entity can have cascading effects.

While Marks & Spencer’s swift response minimised some of the long-term reputational damage, the event highlights the importance of transparent communication during cyber incidents. Customers expect prompt updates, clear explanations, and assurances regarding the safety of their data and the reliability of services. Retailers that are prepared with crisis communication plans are better equipped to navigate the aftermath of cyberattacks without lasting damage to their brand reputation.

The disruption also underscores the urgent need for regulatory frameworks to catch up with the changing nature of cyber risks. Governments and industry bodies must work together to establish clear guidelines on cybersecurity requirements, reporting obligations, and liability frameworks. Without coordinated efforts, fragmented standards could leave critical vulnerabilities unaddressed, allowing attackers to exploit regulatory gaps.

A militant assault in the Baisaran meadow near Pahalgam, Jammu and Kashmir, resulted in the deaths of 28 tourists and injuries to over 20 others on Tuesday afternoon, marking the deadliest civilian attack in the region since 2019.

The attack occurred around 2:50 PM when four to six assailants, dressed in military-style uniforms, emerged from the surrounding deodar forests and opened fire on tourists enjoying the popular meadow, often referred to as “Mini Switzerland” for its scenic beauty. Eyewitnesses reported that the attackers initially posed as security personnel, asking for identification and religious affiliations before selectively targeting non-Muslim men. Survivors recounted being asked to recite Islamic declarations and undergoing physical checks; those who failed were shot at close range.

The Resistance Front , an offshoot of the Pakistan-based Lashkar-e-Taiba, claimed responsibility for the massacre. In a statement, the group cited opposition to the settlement of over 85,000 non-locals in the Kashmir Valley, alleging it as a demographic alteration. This incident underscores the ongoing tensions following the revocation of Jammu and Kashmir’s special status in 2019, which allowed greater settlement of outsiders in the region.

Among the deceased were 24 tourists from various Indian states, including Karnataka, Kerala, Maharashtra, Odisha, Gujarat, Haryana, West Bengal, and Uttar Pradesh. Two locals from Jammu and Kashmir and two foreign nationals from Nepal and the United Arab Emirates were also killed. The injured, numbering over 20, were airlifted to military hospitals in Srinagar for treatment.

Prime Minister Narendra Modi, cutting short his visit to Saudi Arabia, condemned the attack as a “dastardly and inhuman act” and vowed to bring the perpetrators to justice. Union Home Minister Amit Shah traveled to Srinagar to assess the situation and coordinate the security response. Security forces launched a massive manhunt, deploying helicopters and imposing a temporary lockdown in parts of Pahalgam to apprehend the attackers.

The international community reacted swiftly. U.S. President Donald Trump expressed support for India, while U.N. Secretary-General António Guterres and leaders from Germany, Israel, and the European Union condemned the attack and offered condolences to the victims’ families.

The assault occurred during a period of increased tourism in Kashmir, with projections estimating around two crore visitors to the Union Territory this year. Pahalgam, a gateway to the Amarnath Yatra, had seen a surge in tourist footfall, signaling a return to normalcy after decades of insurgency. This attack threatens to derail these developments, casting a shadow over the region’s stability and economic recovery.

Opposition leaders criticized the government’s narrative of restored normalcy in Kashmir. Congress MP Priyanka Gandhi labeled the attack a “crime against humanity,” while Leader of Opposition Rahul Gandhi described it as “horrific,” emphasizing the need for a reassessment of the region’s security situation.

Eyewitness accounts painted a grim picture of the attack’s aftermath. Videos from the scene showed bloodied individuals lying on the ground, with others pleading for help. One woman was seen screaming for assistance for her husband, while others were seen lying motionless in the meadow. Survivors described the attackers’ methodical approach, with one assailant allegedly telling a woman that she was being spared so she could “narrate the horrors” to Prime Minister Modi.

The attack’s timing, coinciding with U.S. Vice President JD Vance’s visit to India, raised concerns about its potential geopolitical implications. While no direct link has been established, the incident echoes prior high-profile attacks timed with foreign dignitary visits, suggesting a possible strategy to garner international attention.

Bybit, the Dubai-based cryptocurrency exchange, is grappling with the aftermath of a massive cyberattack that resulted in the theft of approximately $1.4 billion worth of digital assets. The breach, attributed to the North Korean-linked Lazarus Group, has been described as the largest in the history of the crypto industry.

The hackers exploited vulnerabilities in Bybit’s cold wallet infrastructure, which is typically considered more secure than online hot wallets. Bybit’s CEO, Ben Zhou, disclosed that the attackers manipulated transaction interfaces and hijacked the cold wallet, redirecting its contents to unidentified addresses. The stolen assets, primarily Ethereum, have been rapidly converted into Bitcoin and dispersed across thousands of wallets to obfuscate their trail.

Zhou provided a detailed breakdown of the stolen funds: approximately 77% remain traceable, 20% have “gone dark,” and 3% have been successfully frozen. The term “gone dark” refers to funds that have been laundered through complex methods, making them untraceable. The traceable portion, roughly $1.07 billion, offers a glimmer of hope for recovery efforts.

The hackers employed sophisticated techniques to launder the stolen assets, including the use of decentralized exchanges like THORChain. Approximately 83% of the stolen Ethereum was converted into Bitcoin and distributed across nearly 7,000 wallets, each holding an average of 1.71 BTC. This fragmentation strategy complicates tracking and recovery efforts.

Bybit has initiated a bounty program to incentivize the recovery of stolen funds, offering up to 10% of the recovered assets to individuals who assist in freezing or retrieving the stolen cryptocurrencies. The exchange has also assured its users that it remains solvent and is taking measures to compensate for any unrecovered coins.

The incident has raised significant concerns about the security of cryptocurrency exchanges and the evolving tactics of cybercriminals. The Lazarus Group, known for its cybercrime operations linked to North Korea, has been implicated in several high-profile crypto thefts in recent years. Their methods often involve spear-phishing attacks and the use of malware to infiltrate systems.

A compromised administrative account within ZKsync’s infrastructure has been identified as the source of an exploit that diverted approximately $5 million worth of unclaimed ZK tokens from the platform’s airdrop contract. The breach, attributed to a compromised private key, was confined to the token airdrop mechanism, according to the project’s security team. An investigation into the incident remains ongoing.

The vulnerability was exploited during the initial phase of ZKsync’s token distribution, which aimed to allocate 17.5% of its total 21 billion ZK token supply to eligible users. The airdrop, intended to reward early adopters and contributors, has been marred by criticisms over its susceptibility to Sybil attacks—a method where an individual creates multiple wallets to illegitimately claim tokens. Reports indicate that one user managed to generate over 21,000 wallets to exploit the airdrop, highlighting significant flaws in the platform’s anti-Sybil measures.

Industry experts have voiced concerns regarding the airdrop’s design. Mudit Gupta, Chief Information Security Officer at Polygon, described the event as potentially the most “farmed” airdrop to date, citing a lack of effective Sybil filtering. Similarly, Adam Cochran of Cinneamhain Ventures criticized the eligibility criteria, suggesting they were easily manipulated by automated scripts, thereby disadvantaging genuine users.

The airdrop’s execution has also been scrutinized for its distribution methodology. Despite the intention to decentralize token ownership, data reveals that a significant portion of the tokens was claimed by a small group of wallets. Approximately 41% of the top recipient wallets have already liquidated their entire allocations, contributing to a 34.5% decline in the token’s value shortly after its launch.

Compounding the situation, the airdrop’s announcement and subsequent distribution were accompanied by a surge in phishing scams and malicious decentralized applications . These fraudulent entities impersonated official ZKsync channels, luring unsuspecting users into compromising their wallets. Security firm Blockaid reported a fivefold increase in malicious dApp activity targeting ZKsync users during this period.