At a glance.
- US Justice Department shutters suspected North Korean laptop farms.
- Google patches Chrome zero-day.
- Event manager Nth Degree discloses breach.
US Justice Department shutters suspected North Korean laptop farms.
The US Justice Department announced raids against 29 laptop farms across 16 states in an operation targeting North Korea's fraudulent IT worker schemes. The operation resulted in the seizure of 29 financial accounts used for money laundering, 21 websites, and around 200 computers. The Justice Department also arrested a US citizen and indicted several Chinese, Taiwanese, and North Korean nationals in connection with the schemes.
The DOJ stated, "[C]ertain U.S.-based individuals enabled one of the schemes by creating front companies and fraudulent websites to promote the bona fides of the remote IT workers, and hosted laptop farms where the remote North Korean IT workers could remote access into U.S. victim company-provided laptop computers. Once employed, the North Korean IT workers received regular salary payments, and they gained access to, and in some cases stole, sensitive employer information such as export controlled U.S. military technology and virtual currency."
Google patches Chrome zero-day.
Google has issued a patch for an actively exploited zero-day in Chrome that can allow "a remote attacker to perform arbitrary read/write via a crafted HTML page." The vulnerability (CVE-2025-6554) is a type confusion flaw and has been assigned a severity of "High." BleepingComputer notes that this is the fourth Chrome zero-day discovered this year.
Chrome users should ensure their browsers are updated to the latest version.
Event manager Nth Degree discloses breach.
Nth Degree, a major US event manager, has disclosed a data breach affecting 39,000 individuals, Beyond Machines reports. Affected data included full names, Social Security numbers, driver's license numbers, government-issued identification numbers (including passports and state ID cards), financial account information and credit or debit card numbers, health insurance information, medical records, and financial account details. The breach occurred in December 2024 and was discovered in March 2025. The company began notifying affected individuals in April.
It's unclear who is affected by the incident, but it's worth noting that Nth Degree's clients include the RSA cybersecurity conference and multiple Fortune 100 firms.
