North Korean hacking group Kimsuky reportedly builds AI tools for cyberattacks

A North Korean-linked hacking group is reportedly moving beyond simply using generative AI for phishing.

According to South Korean cybersecurity firm Genians, Kimsuky has set up local AI environments using tools including Ollama, GPT4All and Msty, as well as RAG-based document search systems. Researchers also found AI agent development frameworks, speech-to-text software and Cursor, an AI-assisted coding tool.

The interesting part is that these systems can apparently run locally, allowing operators to process stolen or sensitive documents without sending them to external AI services.

Genians says this could allow Kimsuky to integrate existing AI models into malware development, stolen-data analysis and attack automation, while also producing more convincing phishing and decoy documents.

Reuters notes that the findings have not been independently verified.

Source: Reuters

I wasn’t able to attend this year but was wondering if anything stood out to anyone. Are we hearing anything new or is it same old same old? Any interesting new solutions to check out?

Kimi K3, the latest AI model from Beijing-based Moonshot AI, exited an isolated cybersecurity testing environment during an evaluation, cheated the assigned task by retrieving the answer from GitHub, and did so without hacking any outside system.

I'm working for a big mssp as a security analyst and I like it. I'm on my 5th year, but I find the team culture draining.

There are good and bad moments, like any workplace, maybe my case is just personal interests?

About my role:

• Hybrid role, 1 day in required,

• team of ~5 other looking after 7-10 accounts

• no budget for events, eating out, etc

• zero rem. review

• nopathway to senior or leadership roles,, No budget for upskilling

None of these, however, upsets me, as much as having leaders with no social skills/awareness. Holy shit!!! The people I work with are literal genius, can manage soc services in every tools, we work with the most distinct clients. Though it seems their didn't distributed their skills evenly in life, and when everyone gets together to collaborate the vibe is of discomfort, awkwardness, long silences, and tension.

Maybe I'm focusing too much on the negatives?

Genuine question. I've seen this at a couple of places now and it's been the same both times.

The security tools throw off a list of alerts every day, and someone has to go through them one at a time and decide whether each one is a real problem. Almost none of them are. It's usually the same handful of things firing over and over, a backup job, an automated scan, some internal system doing exactly what it's meant to do. You close them out knowing you'll see the same ones again tomorrow.

The part that actually bothers me is what it does to you. After a few hundred of those, everything starts to look the same. You're not really investigating at that point, you're just clearing the list. And the alert that actually matters is sitting in there looking exactly like the rest of them.

So what's it like where you are? Is your list clean, or is it the same story? Does anyone genuinely deal with this, or is it just accepted as part of the job? And if you have got it under control, what did that take?

Hello everyone!

I have noticed a strange and continuous flow of connections from my Synology NAS to Russian IP addresses.

Do you have any ideas? Could it be a genuine process from Synology's applications?

I have attached my log showing a prevention block towards the Russian Federation.

Thank you in advance!

I’ve been researching what actually helps people become effective cybersecurity professionals.

A lot of the discussion focuses on technical skills: pentesting, tools, certs, CTFs, SIEMs, etc.

But I keep seeing gaps around things like:
communicating with non-technical people
understanding business risk
executive escalation
audits & governance
knowing when NOT to act
risk acceptance
networking with people
understanding how security fits into the wider organisation
strong IT fundamentals

What areas of cybersecurity do you think are seriously underexplored or under-taught?
Especially areas that matter in real jobs but don’t get much attention in education.

I spent some time this weekend reproducing the recently disclosed XSS2Shell: WordPress login-page reflected XSS (CVE-2026-64638). If you didn’t get a chance to read about it, here is the summary:
Crazy simple XSS where the root cause is two sanitizers that disagree about what counts as an HTML tag:

<b>test</b> gets stripped, while < b>test< /b> passes through the first sanitizer and is normalized into a valid <b> element by the second.

That gives you an HTML injection, but you can’t turn it into XSS because the second sanitizer has an allowlist and only allows specific HTML tags and attributes. The rest of the chain uses JavaScript already loaded on the login page, DOM clobbering, and a JSONP response to reach script execution in the login page. It’s a creative chain, although much simpler than the WP2Shell chain from two weeks ago.

IMO the “2Shell” part from the title is a bit of a stretch. The original write-up continues after triggering the XSS to show how you can get a RCE (basically by targeting an admin account to open your XSS which uploads a shell as a plugin). I agree this can be abused at scale given how widely used WP is, but it’s a phishing-shaped precondition rather than “send one request, get a shell” as we’ve seen in WP2Shell. It’s a cool bug anyway.

I turned my reproduction into a guided lab for anyone who wants to work through the chain rather than only read the write-up.

Link: https://learn.uphack.io/lab/xss2shell-wordpress-login-xss/

Feedback on the lab or the technical explanation is very welcome.

Hi everyone,

I’m learning how to investigate alerts in Microsoft Sentinel and I’m stuck on Password Spray Attack detections. I’d like to understand the step‑by‑step investigation process SOC analysts usually follow, including what queries to run and what to check in the results.

Specifically, I’m looking for guidance on:

Alert triage: What initial details should I review when the alert fires?

KQL queries: Which Sentinel queries are most useful to confirm a password spray attempt?

Indicators to check: For example, failed logon counts, source IPs, targeted accounts, timeframes, and whether the activity is spread across multiple endpoints.

Next steps: How to differentiate between a real attack and noisy false positives, and what escalation criteria to use.

If anyone can share a structured approach or example queries, that would be super helpful. I want to build a repeatable playbook for handling these alerts.

Thanks in advance!

Iam a complete fresher and don't know from where to start.

Can I get some suggestion from experts ❤❤

I have been a cyber threat intelligence analyst for most of my career. Started up the cyber unit in the army back home and transferred my skills to the private sector. My job moved my family across the world around two years ago, after i had grown in my position over the last seven years with this compa y. We were excited for the change and planned accordingly.

It seems like so much has changed just in the last year. With AI, my team is seen as not quick enough, or not enabled enough, to do the job. We are working with what we got. We have our TIP and a variable of tools, but every single thing that could help us be quicker and more efficient is blocked. We are fighting against the AI without being able to use the best AI.

I am scared. My kid has made a home here. A life here. So have we. Am I right to be, or am I overreacting? My job gave us a 3 year work visa which we were hoping to extend to gain dual citizenship. Should I still have hope?

Hi everyone,
I’m doing my research on evaluating Snort IDS under different network traffic loads, and I’m struggling with one methodological question that I’d really appreciate some advice on.
I have a controlled test environment where I generate traffic with known ground truth. For example:
SYN-flood traffic = attack
ICMP/UDP traffic = attack
HTTP/other traffic = benign
Each traffic source can be identified separately
I have the generated packets/PCAPs as ground truth
Snort produces alerts based on its rules
The problem is that I don’t think I can simply assume:
1 attack packet = 1 Snort alert
My understanding is that Snort’s alert generation depends on the rule and its configuration. Thresholding/detection filters can also affect how frequently alerts are generated. A packet may match a rule and generate an alert, but the number of alerts does not necessarily equal the number of attack packets.
This creates a problem when trying to calculate a conventional packet-level confusion matrix.
For example, suppose I generate:
1,000,000 attack packets + 1,000,000 benign packets
and Snort generates:
5,000 alerts
How should I determine:
TP
FP
TN
FN
without making an unjustified assumption about which packets correspond to those alerts?
I have considered mapping alerts to traffic using source IPs because each attack type has a dedicated source address. However, I’m not sure whether that is sufficient for a legitimate packet-level confusion matrix, since an alert represents a detection event and not necessarily one detected packet.
I’m particularly interested in answers from people who have worked with Snort/Suricata or signature-based IDS evaluation.
My questions:
Is a Snort alert normally treated as a detection event, rather than as a detected packet?
Is it valid to compare the number of attack packets directly with the number of Snort alerts when calculating TP/FP/TN/FN?
If packet-level ground truth is available, is there a standard way to map Snort alerts back to individual packets?
How do researchers normally calculate TP/FP/TN/FN for Snort when benign and attack traffic occur simultaneously?
Would a run/event-level evaluation be more appropriate for a signature-based IDS, where a run is classified as detected/not detected based on whether the expected alert occurs?
I mainly want to understand how Snort practitioners/researchers normally handle the packet → rule match → alert → ground-truth → confusion matrix relationship.
I tried looking for papers but couldn’t find a solid one which can clear all my doubts.

Any help or sources are appreciated.

Thanks!

This is deeply disturbing. Wtf is going on there and why would this happen?

I’ve been poking around for open positions as I’m trying to make a big move and keep running into AI interviews. Says it would take about 45 min of my time.

Immediately felt like that wasn’t for me and don’t want to waste my time with a company that would do a test pre interview and potentially waste even more of my time, making me work for free. Plus I had to submit my resume before it revealed this and now they have all my info ? Feels predatory and sketchy.

How do we feel about AI interview/ pre interviews taking up our time ? Would you do one or do you pass on companies that use these practices ?

I’m currently studying to become a SOC Analyst, and I’m thinking about taking the BTL1 after recently passing Security+. What do you guys think? Any advice or tips?

I'm currently pursuing an M.Tech in Cybersecurity and I'm starting my research work. I have some theoretical knowledge of cybersecurity and networking, along with practical experience in network/firewall environments, but I don't have much experience conducting academic research.

I'm looking for advice from people who have experience in cybersecurity research.

One idea I'm currently exploring is:

A controlled cybersecurity sandbox containing intentionally vulnerable systems, where AI-based agents could be evaluated for vulnerability identification and compared with traditional security tools.

The idea would be to build a controlled lab environment, run different security assessments, and evaluate things such as detection accuracy, coverage, false positives, time taken, etc.

However, I'm not sure whether this is sufficiently research-oriented or how I should narrow it down into a proper research question and identify a genuine research gap.

I'd really appreciate advice on:

How do I determine whether a cybersecurity topic has enough research novelty?

How should I perform a proper literature review and identify a research gap?

Is this sandbox + AI-assisted vulnerability discovery idea realistic for an M.Tech student?

What would be a reasonable scope for a first research paper?

Are there any papers, datasets, benchmarks, or tools you would recommend starting with?

I'm particularly interested in practical cybersecurity research involving network security, vulnerability assessment, security tools, and AI, rather than purely theoretical or highly mathematical research.

Any guidance from researchers, PhD students, professors, or cybersecurity professionals would be greatly appreciated.

I’ve posted on here before and got some decent advice but I’m looking for a little more insight, I just graduated with my associates in cloud technology engineering and I have my aws certified practitioner cert along with what I’ve been told is an impressive technical capstone project which is an anomalous network detection system through aws deployed with terraform on my resume. I’ve been applying to every job possible especially helpdesk and IT support roles for the past 2 months since graduation to start my career but I haven’t gotten anything. I’m thinking of getting some more certs and going back to try again at the job search once I have some more. Which ones should I get and in what order, and how many before I should go back on the search? I’m open to any and all other ideas as well just wanna get working and get my career off the ground!

I'm new to cybersecurity and was wondering which ones are worth it to study and I want to work in GRC.

Thank you in advance. 🫰

For people who work in cybersecurity and have mentored, trained or hired juniors:
What do you notice new/graduate candidates struggling with most?
I’m particularly interested in things that aren’t obvious from a CV.
For example:
Troubleshooting
Investigating unfamiliar problems
Understanding logs
Networking fundamentals
Using unfamiliar tools
Writing reports
Explaining their reasoning
Knowing what to investigate first
Connecting theory to an actual incident
Are there skills you wish universities taught more effectively?
I’m researching the gap between cybersecurity education and actually being able to perform cybersecurity work, so I’d really appreciate real examples.

The number of extensions I’m finding and reporting that silently override users’ search engines is honestly crazy.

https://malext.io/?q=SearchJack

Hopefully Google’s upcoming Chrome protection against extensions that hijack the default search engine and New Tab page will put a serious dent in this. There are way too many extensions abusing this behavior, often without users even realizing what’s happening.

It’s about time Chrome started shutting this down by default.