ScarCruft Uses Zoho WorkDrive and USB Malware to Breach Air-Gapped Networks

A diverse set of high-impact threats and vulnerabilities was reported: multiple state-aligned and criminal groups (ScarCruft, Lazarus, UNC2814, APT28, MuddyWater, etc.) are deploying novel tooling and TTPs — e.g., Zoho WorkDrive C2, removable-media implants to breach air-gapped networks, blockchain-based C2 (Aeternum on Polygon), and Medusa ransomware. Supply-chain and developer-targeting campaigns continue to spread in-memory malware and credential/secret stealers via trojanized packages and malicious repos (NuGet, npm, StripeApi.Net impersonation, fake Next.js assessments). Several high-sev/