Decryption Digest

CVE Analysis & Threat Intelligence Briefings

In-depth analyses of zero-day vulnerabilities, CVE exploits, ransomware campaigns, and nation-state attack techniques affecting enterprise security. Filter by category, tag, or keyword.

Free daily briefing

Every article here lands in subscribers' inboxes the morning it drops.

Threat intel, active CVEs, and campaign alerts, distilled daily for practitioners. 50,000+ subscribers. No noise.

Free. No spam. Unsubscribe anytime.

Category:

4 results tagged APT28

LAMEHUG: APT28 Deploys Live LLM to Generate Attack Commands Mid-Operation

Video

AI WEAPONIZEDJune 6, 202611 min

LAMEHUG Malware APT28: LLM-Generated Attack Commands

LAMEHUG malware gives APT28 a live LLM that generates reconnaissance commands in real time, defeating signature-based detection entirely.

Eric Bang

Founder & Cybersecurity Evangelist

Read

5 APT Groups Deploy AI Malware That Writes Its Own Code Mid-Attack

Video

AI WEAPONIZEDApril 18, 202610 min

AI Malware 2026: 5 APT Groups Using Gemini Mid-Attack

Google GTIG confirms HONESTCUE and PROMPTSTEAL in active deployment, AI malware that generates fileless code via Gemini mid-execution, evading every static signature.

Eric Bang

Founder & Cybersecurity Evangelist

Read

CVE-2023-38831 Explained: WinRAR Remote Code Execution via Crafted Archive

CVE REFERENCEAugust 23, 202310 min

CVE-2023-38831 WinRAR: Code Execution via Crafted ZIP Archive

CVE-2023-38831 is a code execution vulnerability in WinRAR (< 6.23). An attacker creates a ZIP archive that displays an innocent filename, such as a PDF or image, but actually maps double-click to a hidden script. When the victim double-clicks the apparent document inside WinRAR, a script executes on their system. Exploited by Russian APT28 (Fancy Bear) and North Korean APT40 in targeted spear-phishing campaigns against financial traders and government officials. Affects all WinRAR versions prior to 6.23.

Eric Bang

Founder & Cybersecurity Evangelist

Read

CVE-2023-23397 Explained: The Outlook Zero-Click NTLM Hash Theft Vulnerability

CVE REFERENCEMarch 14, 20239 min

CVE-2023-23397 Outlook: Zero-Click NTLM Hash Theft

CVE-2023-23397 is a critical privilege escalation and credential theft vulnerability in Microsoft Outlook for Windows. A specially crafted calendar invitation with a UNC path in the reminder sound field causes Outlook to automatically connect to an attacker-controlled SMB server, leaking the victim's NTLM authentication hash. No user interaction is required, the exploit fires when the reminder triggers, even if the meeting invitation is never opened.