North Korean Group ScarCruft Expands From Spying to Ransomware Attacks

S2W researchers report that North Korean APT ScarCruft (ChinopuNK) executed a July phishing campaign in South Korea delivering a multi-stage payload — including a Rust backdoor using PubNub C2, various info-stealers, a ChillyChino variant, and a new VCD ransomware — indicating a shift from espionage-only operations toward blended financially motivated attacks.