North Korean IT Workers Used Stolen US Identities to Earn $3 Million

2026-10-18T02:51:38Z•04b056a67f77763229d6d6a5710b202b55aa48da79561b17317eccd57d1bc4c8
CVE-2026-15176CVE-2026-21589CVE-2026-93479AI securityAhsayCBSAtlassianBAE SystemsCISA KEVCisco Secure Email GatewayFortiManagerFortinetIT worker fraudNGINXNorth KoreaPAN-OSPEERSTITCHactive exploitationcritical infrastructuredata breachfirewall compromiseidentity theftremote code executionunauthorized accessvulnerability management

What happened

Security Affairs reports multiple significant cybersecurity events, including North Korean IT-worker identity fraud, active exploitation of Fortinet, BeyondTrust, Atlassian, Palo Alto PAN-OS, Ahsay, and Cisco vulnerabilities, the PEERSTITCH malware campaign compromising more than 500 firewalls, major personal-data breaches affecting Burger King Japan and CenterPoint Energy customers, a BAE Systems-related service outage, unauthorized AI-agent access to Indian organizations, and critical unauthenticated NGINX remote-code-execution flaws.

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
securityaffairs
Record identifier
04b056a67f77763229d6d6a5710b202b55aa48da79561b17317eccd57d1bc4c8
Enrichment time
2026-10-18T02:51:38Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.