North Korea Walks Off With $387 Million

Singaporean crypto exchange Bitget confirmed this week that hackers stole $387.5 million from its platform, according to The Record. The company's CEO, Gracy Chen, held a public town hall after the breach and said IP addresses, behavioural patterns, and on-chain signatures all point to North Korea's Lazarus Group — a state-backed operation responsible for some of the largest crypto heists on record.

The attack began when hackers breached a backend system handling Bitget's wallet services and exploited vulnerabilities to push through a wave of unauthorised transfers. Blockchain security firms caught $175 million moving out before the larger withdrawals were complete. The final figure came to $387.5 million in ETH, XRP, USDC, and other cryptocurrencies.

Withdrawals are currently suspended while security firms Mandiant and SlowMist assist with the investigation. Several platforms have already frozen funds linked to the hackers' wallets. Bitget has launched a recovery bounty program offering a 5% reward to any platform that voluntarily freezes attacker funds, and another 5% if funds are actually recovered.

The company says its User Protection Fund, which holds over $464 million, will cover all losses — so customers should not be out of pocket. North Korea stole more than $2 billion from cryptocurrency platforms in 2023 alone, and $3 billion between 2017 and 2023 according to United Nations investigators. Chen drew a direct comparison to last year's $1.5 billion Bybit theft, noting that exchange survived, and Bitget intends to as well.

What you should do: If you hold funds on Bitget, monitor the platform's official communications for updates on when withdrawals resume. For your other exchange accounts, enable withdrawal address whitelisting where available — it prevents transfers to addresses you have not pre-approved, which limits damage if credentials are ever compromised.

Researchers at Flashpoint have published analysis of "process parameter poisoning," a technique that slips malicious code past EDR (endpoint detection and response — software that monitors computers for signs of attack) tools on Windows machines, according to Dark Reading.

Most EDR products watch for a specific set of Windows system calls associated with process injection (inserting code into another running program). This technique bypasses that entirely — instead hiding a malicious payload inside the startup structures Windows automatically creates when launching a new process.

When Flashpoint combined the base technique with DLL unhooking (restoring Windows functions that security software has modified to monitor activity), the test produced no alerts and no blocks from the security platform under review. The technique has not yet been seen in real-world malware. Flashpoint recommends defenders shift focus to monitoring what processes actually do — watching for code running from unusual memory locations and unexpected changes to memory permissions — rather than relying solely on known API call patterns.

What Roundcube is: Roundcube is a free, open-source webmail client used by organisations and hosting providers worldwide to give users a browser-based email interface.

What it is: A SQL injection (an attack where a hacker inserts malicious database commands into an input field, tricking the system into running them) flaw in Roundcube's virtuser_query plugin is being actively exploited in the wild, as confirmed by the Canadian Centre for Cyber Security.

Who's at risk: Any organisation running Roundcube below version 1.6.16 or 1.7.1 with the virtuser_query plugin active. Over 500,000 Roundcube servers are publicly accessible — how many remain unpatched is unknown.

CVSS: 8.1 (High — patch this week)

Root cause: The virtuser_query plugin resolves email addresses to mailbox usernames. It tries to block SQL injection using a backslash-escaping filter on the preg_replace() function. The flaw exists because specially crafted backslash sequences in attacker input defeat the filter entirely, allowing quote characters to reach the underlying SQL query unmodified. The database then executes whatever the attacker appended.

Attack vector: An unauthenticated attacker sends a crafted request to the Roundcube server that targets the virtuser_query plugin. The malicious input traverses the broken filter and injects SQL commands directly into a query sent to the database. From there, the attacker can read user emails, address books, and identity data, tamper with database records, and map out authentication and admin workflows — all without a valid login.

Detection strategies:

1. Check your mail server logs for unusual query patterns targeting the virtuser_query plugin, particularly requests containing backslash sequences in email address fields.
2. Look for unexpected database read operations on user identity and message tables outside of normal login windows.
3. Monitor for new or anomalous admin-level activity in Roundcube's database, which may indicate an attacker is mapping authentication functions.

Recommended actions:

1. Upgrade to Roundcube 1.6.16 or 1.7.1 immediately — patches have been available since late May.
2. If you cannot patch immediately, disable the virtuser_query plugin as a temporary mitigation.
3. Audit access logs for suspicious requests and restrict external access to the Roundcube admin interface.

The Salt Typhoon breach — covered in today's Compliance section — gave Chinese government hackers access to call records, call timing, location data, and in some cases live audio and texts from nine major US telecoms. If you are a Verizon, AT&T, or Lumen customer, your metadata may have been collected.

The FCC's Salt Typhoon resource page at fcc.gov lists confirmed carriers and guidance on what was accessed. Check whether your carrier is on the list, then review whether you were in any circle of communication with senior government contacts — that was the targeting focus.

More broadly: if you have sensitive conversations by phone, consider switching to an end-to-end encrypted messaging app such as Signal for those exchanges. Encrypted messaging is outside the scope of what Salt Typhoon collected.

Senators Mark Warner and Ted Cruz have introduced the Telecommunications Cybersecurity and Resilience Act, according to The Record. The bill would establish a working group inside the NTIA (National Telecommunications and Information Administration) to develop cybersecurity best practices for telecoms — but participation is voluntary.

The bill follows the Salt Typhoon campaign, in which Chinese government hackers spent years inside nine major US carriers. Critics note that mandatory rules introduced after Salt Typhoon were scrapped last year, and voluntary frameworks without penalties may not compel meaningful change.