The Hacker Diaries — Featuring Jennifer Hudsen: Case File No. 013

Subject 01 • DPRK job fraud

When the employee account is the initial access

What happened

Huntress reported that, during 2026, it supported investigations involving five people it assessed as likely DPRK workers in partner organizations; the reported roles included IT, sales and marketing, and the medical profession.^[1] That is an assessment from incident investigations, not a court finding about each person’s nationality, and “medical profession” should not be expanded into an unsupported claim that the people were doctors or delivered patient care.

Recorded Future’s Insikt Group separately described PurpleDelta clusters using at least 22 fabricated personas and applying to more than 1,100 companies, sometimes at a pace of 60 or more applications per day across at least eight job platforms.^[2] Approximately 41% of the companies applied to were in IT and software services, 26% in staffing and consulting, and 10% in healthcare and biotechnology; those percentages classify employer sectors, not the job roles obtained.^[2]

Evidence and timeline

Huntress said three suspected workers were associated with an Australian healthcare organization beginning in February 2026, described another investigation in financial services in August, and found an additional person who appeared to be a sales/marketing employee through proactive hunting.^[1] Recorded Future said one application cluster operated from late 2024 into early 2025 and assessed that related operators were highly likely employed at ten or more organizations.^[2]

On July 31, 2026, agencies from eleven countries issued a joint warning about DPRK IT-worker activity, false identities, facilitators, remote-access arrangements, unusual payment methods, and AI-supported deception.^[4] The alert remains framed around IT workers and does not independently prove Huntress’s specific non-IT cases. In historical background, DOJ announced on April 15 prison terms of 108 months and 92 months for two U.S. nationals who facilitated a different remote-IT-worker scheme that, DOJ said, used at least 80 stolen identities, obtained jobs at more than 100 U.S. companies, generated more than $5 million for the DPRK, and caused at least $3 million in employer costs and damages.^[3] Those adjudicated figures cover conduct from roughly 2021 through October 2024 and must not be added to the 2026 vendor datasets.^[3]

Exposure, in-the-wild status, and outcome

In the wild: confirmed investigations and official warnings. Huntress and Recorded Future report real investigations or observed operator data, while DOJ provides a completed historical facilitator case.^[1][2][3] Succeeded: Recorded Future assessed employment at ten or more organizations, and DOJ’s older case involved jobs at more than 100 companies.^[2][3] Unknown: the public record does not establish what every suspected 2026 worker accessed, whether every application was fraudulent, or whether data theft or extortion followed in each case.

Local small-business relevance

South Florida businesses recruit remote developers, marketers, bookkeepers, healthcare-support staff, and contractors, but no reviewed source identifies a local The IT Guys customer as affected. Recorded Future noted that many personas claimed U.S. locations and that many were centered on Florida; that is a vendor observation about claimed personas, not proof that Florida residents or businesses were uniquely compromised.^[2]

Immediate action, detection, and recovery/escalation

1. Preserve before confrontation. If a worker’s identity is seriously questioned, preserve onboarding records, interview artifacts, device and authentication logs, payment changes, equipment-shipping records, and relevant communications; involve counsel, HR, security, and appropriate authorities before termination or direct confrontation.^[1][2]
2. Verify the joined identity. Lawfully match the person interviewed, work authorization, payment beneficiary, equipment recipient, and corporate-account user. Verify employment and education directly with institutions rather than only the references supplied.^[1][2]
3. Correlate, do not stereotype. Huntress says few individual indicators prove DPRK involvement; combine endpoint, identity, browser, cloud, and authentication evidence.^[1] A VPN, translation extension, foreign accent, KVM, camera problem, or AI assistant alone is not a verdict.
4. Contain access after evidence is secured. If risk is credible, disable or constrain access through the incident process, preserve the device where lawful, scope repositories and customer systems touched, and rotate exposed secrets from clean administrative systems.^[1][2]
5. Rebuild trust. Reissue equipment and credentials only after identity, device custody, access scope, and business ownership are verified.^[1][2]

Good, bad, confidence, and direct sources

The good: the fraud crosses departments, which also creates several chances to catch inconsistencies. The bad: successful applicants receive legitimate access and may perform enough real work to look normal. Confidence: high in DOJ’s sentencing facts; moderate-to-high in the named vendors’ observations; lower for any conclusion that a particular person is a DPRK operator without a complete investigation. Direct sources: Huntress, Recorded Future, DOJ, and the joint government alert.^[1][2][3][4]

Subject 02 • ValleyRAT / QN Wallpaper

The signature was real; the trust conclusion was not

What happened

Kaspersky analyzed one customer-submitted installer that deployed a modified QN Wallpaper bundle and used the application’s developer-signed executable as a DLL-sideloading host for an adjacent malicious library, which decrypted and loaded ValleyRAT in memory.^[5] The report does not establish that QN Wallpaper’s developer, official website, or update channel was compromised or knowingly involved.^[5]

The signed executable was not a magic umbrella. Its signature applied to that executable, not to every neighboring file in the modified package. Kaspersky also said users often manually exclude adware they want to keep; neither Kaspersky nor the secondary coverage showed this installer automatically creating an antivirus exclusion.^[5]

Evidence and timeline

Kaspersky published the analysis on August 31, 2026.^[5] The installer used filename-dependent decoys, but every path deployed the modified wallpaper bundle, registered it for startup, placed a malicious libcef.dll beside the signed host, and added another persistence mechanism through a file association and Startup-folder artifact.^[5] The analyzed payload could collect keystrokes, focused-window information, and clipboard contents; take screenshots; alter command-and-control settings; wipe logs; and download additional modules.^[5] Capability does not prove every feature was used against the submitting client.

The installer wrote the legacy DisableAntiSpyware setting, which is evidence of an attempt to weaken Defender, not proof that Microsoft Defender Antivirus was disabled on every system.^[5] Microsoft documents that the legacy setting is ignored on Defender for Endpoint-onboarded systems beginning with antimalware platform 4.18.2108.4 and is protected by tamper protection available since Windows 10 version 1903.^[6]

Exposure, in-the-wild status, and outcome

In the wild: one confirmed customer-submitted route, with broader family activity. The exact QN Wallpaper path is supported by one analyzed installer; there is no published route-specific victim count, delivery channel, industry list, or proof of an upstream software supply-chain compromise.^[5] Kaspersky reported more than 100,000 2026 detections of ValleyRAT and associated malware affecting more than 1,500 unique users, primarily in China and India, but those numbers cover broader ValleyRAT activity and cannot be assigned to the QN route.^[5] Succeeded: the sample executed the infection chain in analysis. Unknown: whether the submitting client’s host completed every stage, what data was taken, and how many users installed this package.

Local small-business relevance

The disclosed geography was concentrated outside South Florida and no local incident is established.^[5] The defensive relevance is universal: small companies often allow staff to install utilities, suppress detections, or keep broad exclusions that turn a warning into a permanent blind spot.

Immediate action, detection, and recovery/escalation

1. Isolate and preserve. Network-isolate a confirmed or strongly suspected endpoint. Avoid casually killing the process because the analyzed backdoor had a configurable critical-process option that could crash the system; capture volatile memory, process and module trees, connections, autoruns, exclusions, the full application directory, and centralized logs first where feasible.^[5]
2. Hunt the chain. Correlate the QN path and version with hashes, signer data, adjacent libcef.dll, new autoruns, elevation attempts, protection-state changes, injection or restart behavior, and outbound traffic. Do not condemn the legitimate application by name alone.^[5][6]
3. Protect identities from a clean device. After evidence capture and scoping, revoke sessions and rotate credentials that were typed, copied, stored, or accessible during the suspected window. Review sign-ins, mailbox rules, remote management, and MFA changes.^[5][6]
4. Rebuild after scope. For confirmed ValleyRAT execution, a clean reimage from trusted media is safer than deleting one DLL or uninstalling the wallpaper tool, because additional modules and stolen credentials may outlive the visible package.^[5][6]
5. Restore and verify. Patch Windows and security tools, remove unauthorized exclusions through managed policy, restore tamper protection and EDR, return only scanned data, and monitor in a controlled segment before normal reconnection.^[6]

Good, bad, confidence, and direct sources

The good: the route leaves a connected story in module loads, persistence, security-state changes, and network activity. The bad: users and weak controls may over-trust the signed host or their own exclusion. Confidence: high in Kaspersky’s reverse engineering of the sample; low-to-moderate in its “likely Silver Fox” attribution because the family is used across activity sets; unknown for route prevalence and victim outcome.^[5] Direct sources: Kaspersky Securelist and Microsoft’s control documentation.^[5][6]

Subject 03 • Aurora / Cursor

An AI agent did not invent the key; an operator handed it one

What happened

Gambit Security reported observing an Aurora ransomware operator use Cursor Agent, running Claude Sonnet 4.5, across ten target-or-victim organizations between April 8 and May 21, 2026.^[7] In the documented sessions, the agent was given credentials or an existing route into the organizations and then tasked with reconnaissance or exploitation activity.^[7] The evidence therefore supports misuse after access existed, not the headline-friendly fiction that Cursor independently discovered and hacked ten companies.

Evidence and timeline

Gambit reviewed 28 agent sessions, charted ten organizations, and said most commands failed on the first attempt; some objectives eventually succeeded after refinement, while others ended only with reports of failed attempts.^[7] The ten rows are not ten proven ransomware outcomes. CloudSEK’s broader April-to-July operator dataset described activity involving more than 20 organizations, assessed that interactive or domain-level access was achieved at 17, and correlated four organizations with Aurora’s leak site.^[8] Those are different denominators and states, so 10, 17, 20, and 4 must not be summed.

Gambit also recovered a Linux encryptor with an ESXi mode and observed preparation directed at virtualized environments.^[7] A capable binary or target row does not prove that every organization lost data, had virtual machines encrypted, paid a ransom, or suffered an outage. Cursor was the agent product; Gambit says the sessions used an Anthropic model, which does not make Anthropic the operator or prove the model provider authorized the activity.^[7]

Exposure, in-the-wild status, and outcome

In the wild: vendor-observed misuse with recovered operational data. Succeeded: Gambit says some agent objectives eventually succeeded, and CloudSEK assessed access at a subset of organizations.^[7][8] Failed: many attempts failed initially, and some sessions produced only a failure report.^[7] Unknown: the agent’s exact contribution to each intrusion, the initial-access source, and the theft, encryption, payment, or disruption outcome for each row.

Local small-business relevance

No reviewed source identifies a local victim. The local lesson is about delegated authority: a small MSP or software shop may give an agent production tokens, VPN reach, cloud credentials, or customer repositories because the tool is “for coding.” The product label does not reduce the privilege.

Immediate action, detection, and recovery/escalation

1. Preserve sessions and surrounding logs. If agent misuse is suspected, isolate the initiating host or identity while retaining transcripts, prompts, tool calls, shell history, EDR events, VPN records, cloud audit data, and target-side logs. Treat transcripts as sensitive because they may contain credentials or customer data.^[7][8]
2. Scope the supplied access. Determine which credentials, tunnels, repositories, hosts, and administrative planes were available. A session failure does not clear the credential; a refusal does not prove no other route was used.^[7][8]
3. Revoke after capture. From clean administrative systems, revoke exposed tokens and sessions, rotate secrets, and invalidate unauthorized routes once responders have preserved what they need.^[7][8]
4. Contain ransomware separately. Isolate affected segments, protect backups, and preserve encryption or exfiltration evidence before rebuild. Do not equate a leak-site listing with proof of encryption or payment.^[7][8]
5. Reintroduce agents with guardrails. Use task-specific identities, short-lived credentials, network allowlists, human approval for privilege or destructive actions, and monitored execution environments.^[7][8]

Good, bad, confidence, and direct sources

The good: agent transcripts can provide unusually detailed reconstruction when they are retained and trustworthy. The bad: an operator can delegate repetitive iteration and make an existing foothold more efficient. Confidence: high in Gambit’s session observations and recovered capability; moderate in CloudSEK’s access-state assessment; unknown for complete victim outcomes and the agent’s marginal speed or causality.^[7][8] Direct sources: Gambit Security and CloudSEK.

Subject 04 • Claude Compliance API governance

The camera records the hallway; it does not decide who may enter

What happened

Anthropic’s August 26 update made Compliance API session coverage generally available for Claude Cowork on desktop, web, and mobile and for Claude Code through the CLI and desktop app; Claude Science and Microsoft 365 add-ins were listed as beta surfaces.^[9] The session records can include prompts, responses, tool-call content, and associated session, user, and organization metadata.^[9]

Evidence and timeline

Anthropic’s documentation says the Activity Feed is available to Claude Enterprise and Claude Console customers with the required scope, but a Compliance Access Key can reach the broader endpoint set while an Admin API key reaches the Activity Feed only.^[10] A standalone Claude Console organization is limited to that Activity Feed rather than the Enterprise content and session endpoints.^[10] Anthropic’s help material says Public Sector organizations are excluded from this availability.^[11]

Coverage does not include Claude Code on the web, Claude Code accessed through the Claude Platform, or sessions run through Amazon Bedrock, Google Cloud Vertex AI, or Microsoft Foundry.^[9] The Compliance API retrieves retained records after activity; Anthropic contrasts it with beta inference hooks that can deny a governed prompt before inference and with OpenTelemetry that streams event telemetry as activity happens.^[10] Retrospective visibility is evidence, not preventive authorization.

Sponsored/vendor perspective: Token Security says 68.6% of agents observed in its customer environments are local agents and that a local agent averages more than ten configuration files.^[12] The public page does not provide enough customer-count, sampling-period, or representativeness detail to generalize those figures to all enterprises. A separate online survey of 418 IT and security professionals in January 2026 reported that 68% had high confidence in AI-agent visibility while 82% said previously unknown agents had been discovered during the prior year.^[13] Token Security commissioned and financed that survey and co-developed the questionnaire; CSA analysts performed the analysis and interpretation.^[13] “Previously unknown” does not mean “malicious.”

Exposure, in-the-wild status, and outcome

Status: generally available on named surfaces, beta on others, explicitly excluded on several routes.^[9] Succeeded: the API can return covered activity and session content to appropriately scoped customers.^[10] Failed or absent by design: it is not a complete endpoint inventory and cannot show unused local skills, plugins, hooks, configuration files, agent-launched processes outside captured sessions, or activity on excluded model/deployment paths. Unknown: a transcript alone cannot establish that an action was authorized, appropriate to the person’s job, or harmless.

Local small-business relevance

Many small firms will not have the Enterprise licensing, staff, or SIEM pipeline needed for these endpoints. Their practical control is simpler: inventory who may use agents, on which devices, with which repositories and credentials, and require approval for production or customer access. For more local defensive guidance, readers can use the canonical Search Articles page; organizations needing hands-on help can review Our Services. Those links follow the accepted series pattern and do not imply a local incident.

Immediate action, detection, and recovery/escalation

1. Inventory before enabling feeds. List Claude surfaces, authentication types, devices, third-party model routes, local configurations, plugins, skills, hooks, and MCP connections.^[9][10]
2. Protect the evidence channel. Scope Compliance Access Keys, restrict retrieval and deletion rights, log their use, and define retention for source code, customer data, prompts, files, and secrets that may appear in transcripts.^[10]
3. Test known benign sessions. Generate controlled activity on every approved surface and verify both what arrives and what does not. Record gaps as coverage boundaries, not monitoring failures.^[9][10]
4. Use preventive controls for high-risk action. Put human approval, operating-system permissions, short-lived credentials, network restrictions, and pre-inference policy in front of destructive or privileged work. Do not ask an after-the-fact transcript to be a lock.^[9][10]
5. Respond in order. Preserve relevant sessions and external telemetry, isolate affected identities or devices, scope activity, revoke keys from a clean system, repair policy and configuration, and only then restore access.^[9][10]

Good, bad, confidence, and direct sources

The good: covered session transcripts can materially improve audit and investigation. The bad: blind spots remain, and the records themselves can be sensitive. Confidence: high in Anthropic’s documented product boundaries; limited to the named vendor’s customer telemetry for Token’s figures; survey confidence is bounded by the 418-person sponsored sample and self-reporting.^[10][12][13] Direct sources: Anthropic documentation and announcement, Token Security’s vendor page, and CSA’s disclosed survey report.

Subject 05 • Fire Ant

When the infrastructure that keeps the books starts editing them

What happened

Sygnia reported that Fire Ant, first described in 2025, remained active into 2026 and expanded from hypervisor-focused activity into Cisco IOS XR routers, TACACS authentication infrastructure, Linux management hosts, and virtualized management systems.^[14] The report describes compromise of trusted infrastructure, not a newly disclosed Cisco or VMware vulnerability; the public initial-access path into the routers remains unknown.^[14]

Evidence and timeline

Sygnia’s canonical research article displayed August 27, 2026, while its related press release was dated August 30; those are separate publication surfaces, not evidence that the intrusion began on either date.^[14] Investigators found router-specific components associated with persistence, outbound connectivity, selective logging suppression, altered command output, and packet capture; the report says multiple router captures were uploaded externally using an administrative account.^[14]

On the TACACS system, Sygnia recovered a multicomponent toolset that injected into the authentication process, intercepted accepted sessions, and produced an obfuscated credential artifact.^[14] That means the authentication server’s own records and account attribution cannot be treated as independent ground truth. On Linux management hosts, artifacts created in 2025 remained available and were used again for hands-on activity in 2026, demonstrating durable access across the reporting periods.^[14]

Sygnia observed repeated connection attempts and service probing through a compromised Linux tunnel endpoint toward reachable high-value environments, including systems associated with critical infrastructure.^[14] It did not establish successful entry into those critical-infrastructure systems, operational disruption, or compromise of an industrial process. Sygnia tracks the actor as Fire Ant and says the activity strongly overlaps public reporting on the China-nexus cluster UNC3886.^[14] Google/Mandiant has said UNC3886 is distinct from Salt Typhoon and Volt Typhoon and found no technical overlap supporting equivalence.^[15]

Exposure, in-the-wild status, and outcome

In the wild: incident-response and forensic observation. Succeeded: Sygnia reports compromise and durable access in routing, authentication, and Linux management layers, with traffic and credential collection capabilities.^[14] Failed or unproven: repeated probes do not establish successful compromise of every destination. Unknown: initial router access, the complete set of credentials captured or reused, and the actor’s success against connected critical-infrastructure-associated systems.

Local small-business relevance

No local incident is established. The practical relevance is concentrated among MSPs, larger offices, hosting environments, and organizations that depend on centralized network authentication or shared management hosts. Smaller firms may not run TACACS or ESXi, but they still rely on routers and remote-management systems whose logs are too often assumed trustworthy without independent confirmation.

Immediate action, detection, and recovery/escalation

1. Isolate carefully and preserve volatile state. Coordinate containment so cutting one router or jump host does not erase reachability evidence or cause uncontrolled outage. Capture memory where feasible, live processes, modules, connections, routes, packet captures, running configuration, commit history, AAA state, and external flow records.^[14][15]
2. Use independent witnesses. Compare router output with out-of-band collectors, TACACS records with identity and endpoint data, Linux logs with EDR and network telemetry, and hypervisor events with guest and management-plane evidence.^[14][15]
3. Scope relationships, not just boxes. Identify every customer, zone, peer, administrative path, or high-value environment reachable through compromised routing and management trust.^[14][15]
4. Rotate after evidence capture. Assume credentials crossing a compromised authentication layer may require replacement, but perform revocation and rotation from clean systems after preserving artifacts and mapping dependencies.^[14][15]
5. Rebuild layered infrastructure. Prefer trusted rebuilds, firmware or software updates, clean configuration restoration, and credential replacement over deleting one implant. Verify with out-of-band traffic and configuration observation before restoring full trust.^[14][15]

Good, bad, confidence, and direct sources

The good: discrepancies between configuration, memory, traffic, and logs created investigative seams. The bad: the actor occupied systems that route, authenticate, and record administrator activity. Confidence: high in Sygnia’s forensic observations; moderate in the Fire Ant-to-UNC3886 overlap assessment; unsupported for equating the activity with Salt Typhoon or Volt Typhoon or claiming a critical-infrastructure breach.^[14][15] Direct sources: Sygnia and Google/Mandiant.

Subject 06 • DOJ / QTFY correction

Targets, not victims: the word that kept the record honest

What happened

DOJ announced court-authorized seizures on August 26, 2026, involving domains used by QScan and QTRouter, which it alleged were operated by a PRC state-sponsored group it called QTFY and used to target U.S. critical infrastructure and other sensitive networks.^[16] The page was updated August 28 with a note saying edits had been made so the release accurately reflected the government’s allegations in the seizure affidavit.^[16] The corrected language says named U.S. agencies and the Senate were targets, not confirmed victims.^[16]

Evidence and timeline

According to DOJ’s account of the court documents, QScan scanned and automatically infected thousands of IoT devices worldwide, while QTRouter combined compromised IoT devices, commercial proxy-service devices, and leased virtual private servers into an obfuscation network.^[16] DOJ said the seized domains were hard-coded into both malware platforms and essential for communication and authentication, and that the seizures made QScan and QTRouter inoperable.^[16] “Inoperable” is the government’s point-in-time disruption claim, not a guarantee that all operators, customers, replacement infrastructure, or previously compromised devices disappeared.

Lumen’s Black Lotus Labs described a broader “quartermaster” model linking reconnaissance, proxy orchestration, and operational routing, with QScan used for profiling and QTRouter/Fast Labyrinth used to obscure traffic through compromised, leased, and commercial infrastructure.^[17] Lumen said it shared intelligence with the government and null-routed known infrastructure points.^[17] Its telemetry described many probes and some bidirectional sessions; neither state should be automatically rewritten as a successful compromise of every named target.

Exposure, in-the-wild status, and outcome

In the wild: court-authorized disruption plus vendor network telemetry. Succeeded: the government says the domain seizures disabled the named platforms at that time.^[16] Targets: NASA, the Federal Reserve, the departments of Energy, Justice, and Health and Human Services, the National Institutes of Health, and the U.S. Senate were listed among QTFY’s targets.^[16] Unknown or corrected: the release does not establish that those bodies were successfully breached or suffered victim impact merely because they were scanned or targeted.

Local small-business relevance

A home-office router, camera, storage appliance, or small-business gateway may be valuable to an operator because it provides a residential or local-looking relay, not because the owner is the final target. That possibility is a reason for maintenance and segmentation, not a claim that any particular local device participated.

Immediate action, detection, and recovery/escalation

1. Preserve before reboot or reset when compromise is suspected. Save device model, firmware, configuration, logs, leases, DNS, flows, exposure history, and upstream-provider evidence. A reset can destroy volatile or forensic state.^[16][17]
2. Contain the device and route. Remove unneeded internet management, isolate suspect IoT and edge devices, block confirmed indicators with time and ownership context, and coordinate with the provider if the equipment is managed.^[16][17]
3. Patch or replace after scope. Update supported firmware and applications; replace end-of-life devices. Change administrative credentials and related sessions from a clean device after evidence capture.^[16][17]
4. Hunt behavior, not nationality or IP alone. Look for unusual bidirectional sessions, unexpected management access, scanning patterns, proxy software, new accounts, and configuration drift. Commercial proxy addresses also carry legitimate traffic.^[17]
5. Verify disruption locally. A federal seizure may break central infrastructure, but defenders must still confirm that their own device is clean, supported, correctly configured, and no longer communicating unexpectedly.^[16][17]

Good, bad, confidence, and direct sources

The good: the correction narrowed the claim and the seizure attacked a shared infrastructure chokepoint. The bad: compromised consumer and commercial infrastructure can make malicious traffic resemble ordinary local or proxy traffic. Confidence: high that DOJ made and documented the correction and seizure claim; high that Lumen observed the described network architecture in its telemetry; unknown for compromise or impact at every named target.^[16][17] Direct sources: DOJ and Lumen Black Lotus Labs.