The Infostealer to APT Pipeline: How Lazarus Group Hijacked a Yemen Disinformation Network

**Infostealer to APT Pipeline:** Hudson Rock investigates how a RedLine-infested Windows 10 machine in Ta’izz, Yemen, exposed admin credentials for several fake-news WordPress sites (e.g., alnagm-press.com, azal-press.com, gulfnaw.com), enabling the Lazarus Group (APT38) to hijack these trusted domains and repurpose them as command-and-control and reconnaissance infrastructure for broader malicious operations.