the threat gazette
Afternoon Update 2026-04-21
Intraday Update
Cloud

Vercel OAuth Chain Gains State Attribution: Lazarus, Storm-2372, UNC5537 Join Scattered Spider; CALENDAR + Trivy KEV in Scope

CVE-2026-33634 Lazarus Group Scattered Spider Storm-2372 TeamPCP UNC5537 T1078 T1078.004 T1087 T1199 T1213 T1550.001 T1552.001 CALENDAR

Since last coverage, the Vercel OAuth breach has escalated significantly: Lazarus Group, Storm-2372, and UNC5537 are now attributed alongside the previously reported Scattered Spider, with seven ATT&CK techniques mapped — all centered on credential and OAuth token abuse (T1078.004, T1550.001, T1552.001) and internal data collection (T1213). Storm-2372's known specialization in OAuth device code flow attacks maps precisely to the T1550.001 application access token technique documented here, making that cluster the most technically coherent participant. CVE-2026-33634 in Aquasecurity's Trivy scanner (EPSS 0.21, KEV-listed, past-due April 9 remediation window) is now associated with the operation — relevant because a vulnerability in a security scanning tool embedded in CI/CD pipelines creates a plausible vector for credential exfiltration from within trusted build infrastructure. CALENDAR malware attribution (a known DPRK implant family) and confirmed data breach status represent material escalations from the initial disclosure.

The four-actor attribution (Scattered Spider, Lazarus, Storm-2372, UNC5537) warrants scrutiny — Trend Micro's analysis of a complex incident routinely cites multiple actors as precedent or comparison, and not all will have been direct participants. Storm-2372 and Scattered Spider are the most coherent attributions given the OAuth attack chain; Lazarus's CALENDAR implant, if confirmed on Vercel infrastructure, suggests either independent DPRK access or downstream exploitation of credentials exfiltrated by the initial actor. What matters for financial services exposure is that Vercel is the steward of Next.js and a significant slice of JavaScript OSS ecosystem infrastructure — environment variable exfiltration from that position has potential blast radius well beyond Vercel's own internal systems if the threatened supply chain pivot materializes. The sibling stories (6585, 6586) cover the Scattered Spider initial access angle.

Four named actors on a single incident is attribution past the point of coherence — the most technically defensible reading is that Storm-2372's OAuth device-code specialty drove initial entry (T1550.001 maps cleanly), Scattered Spider owned the social-engineering front, and the Lazarus CALENDAR artefact reflects downstream exploitation of exfiltrated credentials rather than joint operation. The real story is unchanged from the morning and getting worse: DPRK implants showing up inside the Next.js steward's blast radius while the attacker publicly threatens cascading supply-chain moves into Vercel-owned JS libraries. CVE-2026-33634 in Trivy landing in this cluster is the confirmation that scanner-in-CI is a live credential-exfil surface, not a theoretical one.

2026-04-12
1 source
+ CVE-2026-33634 · + LAPSUS$ · + Scattered Spider · + TeamPCP · + UNC1069 · + UNC6780
The Hacker News
2026-04-17
1 source
Halcyon Blog
2026-04-21
1 source
+ Lazarus Group · + Storm-2372 · + UNC5537 · + T1078 · + T1078.004 · + T1087 · + T1199 · + T1213 · + T1550.001 · + T1552.001
Hacker News: Front Page

Editorial

Today's through-line is convergence at both the infrastructure and tradecraft layers. The spilled SystemBC C2 serving 1,570 victims across Akira, Cl0p, INC Ransom, and Qilin concurrently is not four coincidences — four nominally distinct RaaS programs homed on one node points to either a shared initial-access broker or a shared affiliate cohort, and either reading compresses the "independent crew" framing we apply to ransomware attribution. Sandworm picking up the macOS ClickFix/AppleScript stealer playbook Lazarus shipped earlier this cycle promotes that delivery from DPRK novelty to cross-actor tradecraft inside 24 hours — GRU and Pyongyang do not usually share notes, so the technique has reached commodity velocity considerably faster than the ClickFix-on-Windows arc did, and the exposed target class remains developer and DevOps macOS fleets.

The Vercel attribution expanded from two actors to four — Lazarus, Storm-2372, and UNC5537 now sit alongside Scattered Spider, with DPRK CALENDAR implant linked and Trivy (CVE-2026-33634, freshly KEV) in-scope as a plausible CI/CD credential-exfil path. That is not coherent single-incident attribution; treat it as credential resale out of the original intrusion into opportunistic state and e-crime buyers — the logical endpoint of the "tokens on secondary markets" note from the 20th — and note that DPRK tooling sitting downstream of the Next.js steward is a blast radius the ecosystem is not modelling. Tylerb's plea is the third Scattered Spider-adjacent prosecution in a week against an operation that is still live in Vercel telemetry, so the arrests-as-lagging-indicator read is sufficiently established that we should stop expecting prosecution cadence to perturb cohort tempo.

Notable

Social Engineering

First Guilty Plea from November 2024 Scattered Spider Indictment — Tyler Buchanan ('Tylerb')

Scattered Spider PLEAD

Tyler Robert Buchanan (handle: 'Tylerb'), 24, pleaded guilty to wire fraud conspiracy and aggravated identity theft covering SMS phishing campaigns from summer 2022 that compromised at least a dozen major technology companies and enabled tens of millions in cryptocurrency theft from investors. This is the first guilty plea from the five-defendant indictment unsealed by DOJ in November 2024, making it the most significant legal milestone in the Scattered Spider prosecution to date. Krebs on Security provides the richest public account, including Buchanan's specific handle and operational role.

Four co-defendants from the November 2024 indictment remain unresolved — whether they are contesting charges or outstanding warrants will affect the timeline of any cooperation intelligence. The fact that Buchanan's plea covers activity through April 2023 while Scattered Spider operations have continued actively since (including the concurrent Vercel breach) underscores that prosecution of this cohort has not degraded the group's broader operational capability.

Buchanan's plea covers activity through April 2023; Scattered Spider was executing against Vercel mid-plea. That is the entire story about The Com's structure — decentralised, pseudonymous, no single node whose prosecution degrades cohort capability. Cooperation terms, if any exist, are the piece to watch; the four unresolved co-defendants from the same indictment are the second. Stories 6777 and 6587 cover the same event at lower fidelity.

Supply Chain

Vercel Confirms Third-Party AI Tool as Entry Vector; Attacker Threatens Cascading Supply-Chain Attacks via Owned JS Libraries

Scattered Spider

Vercel disclosed an intrusion traced to a third-party AI tool installed on an employee device — a trusted relationship (T1199) entry vector that bypassed Vercel's own perimeter controls entirely. The threat actor, initially attributed to Scattered Spider, claimed possession of internal databases and multiple employee account credentials, and explicitly threatened cascading supply chain attacks via Vercel-owned libraries, including at least one already integrated into major downstream JavaScript projects. The Record's coverage confirms the basic incident timeline but is thin on technical specifics, consistent with an investigation still in early stages at time of publication.

The 'third-party AI tool' framing is deliberately vague — this is characterization for a live investigation under legal scrutiny. The operationally significant structural failure is identical to the UNC5537/Snowflake campaign pattern: employee-installed, presumably unblocked tooling serving as the entry point into cloud credential stores. Whether the AI tool was the actual breach vector or a cover story for a more complex initial access path will matter for downstream detection work.

The structural failure — employee-installed unblocked tooling as cloud-credential entry — is the UNC5537/Snowflake pattern rerun with AI tooling as the new unmanaged client. The explicit downstream threat against Vercel-owned JS libraries is the part worth modelling concretely: Next.js and SWC are the obvious targets, and any build pulling from Vercel-hosted infra during the compromise window inherits the exposure.

ICS/OT

BRIDGE:BREAK: 22 CVEs in Lantronix and Silex Serial-to-IP Converters, One Exploit Live Since 2015

CVE-2015-5621 CVE-2024-24487 CVE-2025-67034 CVE-2025-67035 CVE-2025-67036 CVE-2025-67037 CVE-2025-67038 CVE-2025-67039 CVE-2025-67041 CVE-2025-70082 CVE-2026-32955 CVE-2026-32956 CVE-2026-32957 CVE-2026-32958 CVE-2026-32959 CVE-2026-32960 CVE-2026-32961 CVE-2026-32962 CVE-2026-32963 CVE-2026-32964 CVE-2026-32965

Security research branded 'BRIDGE:BREAK' has disclosed 22 vulnerabilities across Lantronix and Silex serial-to-IP converter product lines, with approximately 20,000 devices estimated to be internet-exposed. CVE-2015-5621 is the most immediately actionable finding: EPSS 0.178, a known exploit available at EDB-45547, and a decade of patching inaction on what is now weaponized-available research. The 2025–2026 vintage CVEs (CVE-2025-67034 through CVE-2026-32965) are newly disclosed across the disclosure set with no exploit code and sub-0.001 EPSS, but their presence in internet-facing OT bridge devices changes the risk calculus regardless of score.

Serial-to-IP converters are the connective tissue between legacy serial-bus OT equipment and IP networks — compromise grants bidirectional access to both the IP network and the serial-connected industrial devices downstream. CVE-2015-5621 being exploit-available on 20,000 internet-exposed industrial devices in 2026 is the actual story here; the fresh 2026 CVEs are operationally secondary until weaponization materializes. Per our standard ICS posture, CVSS/EPSS are secondary signals for network-edge OT gear — any Lantronix DeviceLinx or Silex SX-series exposure on your network edge should be treated as priority regardless of score.

CVSS/EPSS are the wrong instruments on OT bridge devices — these are the connective tissue between IP and serial-bus industrial gear, and compromise is bidirectional lateral movement by design. The 2015 exploit-available-on-20k-internet-exposed figure is the actionable number; the 2025–2026 CVE set is secondary until weaponised. If Lantronix DeviceLinx or Silex SX-series sit anywhere on the edge, they need eyes regardless of score.

Ransomware

SystemBC C2 Compromise Spills 1,570-Victim Dataset Across Akira, Cl0p, INC Ransom, and Qilin

Akira Cl0p INC Ransom Qilin Akira Cobalt Strike Qilin

A compromised SystemBC C2 server attributed to an operation dubbed 'The Gentlemen' has yielded a victim database of 1,570+ entries spanning four active ransomware operations: Akira, Cl0p, INC Ransom, and Qilin. SystemBC is a well-established proxy/backdoor widely deployed by ransomware affiliates for C2 obfuscation and persistence, and its concurrent use across four named operations from a single infrastructure node suggests shared affiliate relationships or a common IAB supplying multiple gangs simultaneously rather than four independent campaigns. The Cl0p presence is specifically relevant to financial services given that group's demonstrated pattern of exploiting managed file transfer vulnerabilities (MOVEit, GoAnywhere) at scale.

The analytical signal here is the multi-gang infrastructure overlap from a single C2 node, which reflects contemporary ransomware affiliate market dynamics: the same individuals routinely operate across multiple RaaS programs, and their infrastructure overlaps accordingly. The 1,570-victim dataset's intelligence value decays rapidly as gangs cycle C2 infrastructure — the question is whether this has already been actioned by LE or researchers and whether affected organizations have been notified, which the current coverage doesn't establish.

Four active RaaS programs operating out of one SystemBC node is the contemporary affiliate-market signal made unusually legible — shared IAB feed or overlapping affiliate rosters, take your pick, both conclusions are uncomfortable. Cl0p's presence matters specifically because the group's MFT-appliance playbook (MOVEit, GoAnywhere) is the threat model that keeps regulated-data workloads awake. Victim-list intel perishes quickly as gangs cycle infrastructure; the structural read outlasts the IOCs.

Social Engineering

Sandworm Adopts macOS ClickFix for Credential and Wallet Stealers — Same Playbook as Lazarus This Cycle

Sandworm Team

Sandworm Team is running macOS-targeted ClickFix attacks delivering AppleScript-based credential and cryptocurrency wallet stealers. The delivery chain mirrors the Lazarus 'Mach-O Man' kit reported in this morning's digest — same platform, same social-engineering primitive, same target class (developer and DevOps macOS fleets and crypto-adjacent users), landing inside the same 24-hour window from an unrelated state-adjacent crew.

Cross-actor adoption on this timescale moves ClickFix-on-macOS out of the novelty column and into standard tradecraft. GRU and RGB converging on the same macOS delivery primitive on the same day is not coincidence — it's ambient technique diffusion catching up to a platform that finally has enough high-value endpoints to justify the investment. Detection engineering on ClickFix should generalise to macOS immediately if it hasn't already.

Briefs