lazarus.day
VCD Ransomware · 2025-08
S2W TALON attributed a South Korea-focused postal-code update lure campaign to ChinopuNK, a ScarCruft subgroup, with malicious LNK files in RAR archives dropping an AutoIt loader and retrieving follow-on payloads from external infrastructure. The payload set included VCD ransomware alongside NubSpy, LightPeek, TxPyLoader, FadeStealer, and the Rust-based CHILLYCHINO backdoor, showing ScarCruft expanding from espionage tradecraft into ransomware deployment and modernized malware development.