North Korean cyber-espionage group ScarCruft adds ransomware in recent attack

ScarCruft (APT37), a North Korean state-linked actor, conducted a multi-malware campaign that for the first time included a newly observed ransomware (identified as VCD) alongside info-stealers (FadeStealer, LightPeek), a PubNub-based backdoor (NubSpy), and a new Chinotto variant (ChillyChino); researchers attribute the activity to the ChinopuNK subgroup and warn the ransomware deployment could indicate a shift toward financially motivated or disruptive extortion operations targeting entities in South Korea and other countries.