Do Son Amazon ties North Korean hackers to open-source supply chain attacks on the axios, debug, and chalk NPM packages. Here's how the campaign worked.
Amazon Threat Intelligence
Amazon threat intel reveals Interlock ransomware is actively exploiting a critical 10.0 CVSS Cisco zero-day (CVE-2026-20131) to hijack firewall networks.
Sandworm (APT44) has shifted tactics, favoring misconfigured edge devices over complex exploits to breach energy and telecom sectors via credential replay.
Amazon uncovered an advanced APT simultaneously exploiting Cisco ISE RCE (CVE-2025-20337) and Citrix Bleed Two (CVE-2025-5777) as zero-days. The attacker deployed a custom in-memory web shell on Cisco ISE.