The Untold Stories: North Korean Hacks, Exploited Vulnerabilities & Cybersecurity Legends

Forecast: Expect increased malicious activity targeting enterprise network infrastructure and remote work platforms.

‍

In this episode of Storm⚡️Watch, the crew tackles some of the most pressing stories in cybersecurity and tech.

First, we explore the case of Christian Marie Chapman, an Arizona woman who faces federal prison time for orchestrating a scheme that allowed North Korean IT workers to pose as U.S.-based employees. This operation, which generated over $17 million for North Korea, involved Chapman running a "laptop farm" that enabled remote access to U.S. company networks. The scheme not only compromised sensitive company data but also funneled money to North Korea’s weapons programs. This story underscores the critical need for robust identity verification and background checks in hiring processes, especially in remote IT roles, to avoid inadvertently aiding malicious actors.

Next, we discuss GreyNoise's findings on the active exploitation of a high-severity vulnerability in Palo Alto Networks PAN-OS (CVE-2025-0108). This authentication bypass flaw allows attackers to execute unauthorized PHP scripts, posing significant risks to unpatched systems. Organizations are urged to apply security patches immediately and restrict access to firewall management interfaces to mitigate potential breaches. GreyNoise’s real-time intelligence highlights the importance of staying vigilant against evolving threats.

In our featured segment, we sit down with Dennis Fisher, a celebrated journalist with over two decades of experience in cybersecurity reporting. Fisher shares insights from his career, including his work as co-founder of *Threatpost* and Editor-in-Chief at *Decipher*. Known for his analytical approach, Fisher has covered major cybersecurity events and delved into the motivations behind both attackers and defenders. His expertise offers a unique perspective on the complexities of information security.

Finally, we touch on broader issues in vulnerability management and encryption policies. From GreyNoise’s observations of exploitation surges in vulnerabilities like ThinkPHP and ownCloud to Censys’ argument against weakening encryption standards, these discussions emphasize the need for proactive measures and smarter prioritization in cybersecurity strategies. Whether it's patching overlooked vulnerabilities or resisting calls to weaken encryption under the guise of security, staying informed is key to navigating today’s threat landscape.

Storm Watch Homepage >>

Learn more about GreyNoise >>