Phishing LNK files and GitHub C2 power new DPRK cyber attacks

Multiple high-impact incidents and active campaigns were reported: DPRK-linked actors are conducting phishing campaigns in South Korea using obfuscated .LNK files that drop a decoy PDF and PowerShell payloads and using GitHub repositories as C2 servers. German authorities (BKA) identified two alleged REvil operators tied to 130+ ransomware attacks. Thousands of F5 BIG‑IP APM appliances remain exposed and are being actively exploited via a critical RCE (CVE-2025-53521), and Fortinet issued emergency patches for an actively exploited FortiClient EMS vulnerability (CVE-2026-35616). U.S. CISA has: