AI adoption by North Korean threat actors largely supports existing goals and targeting priorities, including generating revenue for the regime, collecting strategic intelligence, and, in some cases, pursuing politically motivated disruptive or destructive objectives, rather than
- Microsoft Senior Security Program Manager Karina Sirota Goodley joins the Microsoft Threat Intelligence Podcast to examine the ecosystem-wide challenges of preparing certificates and trust systems for post-quantum cryptography. msft.it/6011a0zbh Karina discusses how
- A compromised LiteLLM 1.107.0 release added files that Python could execute during normal interpreter initialization. Applications did not need to import LiteLLM for the payload to run; starting Python in an affected environment could be enough. msft.it/6012axjt8 Microsoft
- The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Microsoft Threat Intelligence assesses that Storm-0940 was responsible for
- Microsoft Threat Intelligence is tracking an active supply chain attack in which a threat actor compromised the trusted OAuth App of the backup application ConnectWise Cloud Backup (AppId: 506e08f9-6e9a-4da4-942b-a099a03644ae), formerly SkyKick Backup, to obtain access tokens



