"Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005)" published by Ahnlab. #CVE20178291, #Phishing, #LNK, #Xctdoor, #CRAT, #Larva26005, #Hansom https://asec.ahnlab.com/en/94847
Channel
lazarusholic
@lazarusholic
On this record: Topic · Growth · Engagement · Posts · Cite this entry
131subscribers
+16 since we began measuring on 7 August 2026
Risers and fallers across the register · movement among entries of Under 1,000.
Register entry
| Telegram ID | -1001889404138 |
|---|---|
| Type | Channel |
| Username | @lazarusholic |
| Created | Between 1 October 2022 and 30 September 2023 — estimated from Telegram’s id allocation, not measured. How this range is calculated. |
| First recorded | 9 August 2026 |
| Last confirmed live | 8 November 2026 |
| Measurements held | 8 |
| Confirmed unchanged | 1 time, most recently 8 November 2026 |
| On Telegram | t.me/lazarusholic |
Topic
Hacking & security — a classification, not a measurement. An on-box language model (Qwen3.6-35B-A3B-FP8, prompt version 1) read this channel’s own recent posts on 26 September 2026 and assigned it the closest of 31 fixed categories, at 92% confidence. This is a model’s judgement about what the channel is likely to be about, not a fact this register measured the way a subscriber count or a view count is measured — it can be revised on a later pass, and it carries no weight anywhere else on this page. How this classification works, and the other topics.
Growth
| Measured (UTC) | Subscribers | Change |
|---|---|---|
| 8 Nov 2026, 11:55 | 131 | +1 |
| 2 Nov 2026, 04:51 | 130 | -1 |
| 2 Oct 2026, 00:01 | 131 | +14 |
| 9 Sept 2026, 19:21 | 117 | +1 |
| 31 Aug 2026, 00:55 | 116 | +2 |
| 16 Aug 2026, 17:45 | 114 | -1 |
| 9 Aug 2026, 05:32 | 115 | no change |
| 7 Aug 2026, 17:35 | 115 | first reading |
Engagement
20 posts held, back to 30 July 2026 — the reader has not yet reached the start of this channel’s public history, so older posts may sit further back, unread. Read across 1 page of Telegram’s post history, 20 posts per page.
Nothing published in the last 30 days. ERR and ER are rolling 30-day measures, so there is nothing to compute — we hold 20 posts for this entry, the most recent from 6 August 2026. An engagement rate over an empty window would be a number about nothing.
Recent posts
"Two arrested in Wonsan for smishing, voice phishing crimes targeting donju" published by DailyNK. #News https://www.dailynk.com/english/wonsan-smishing-voice-phishing-donju-arrests/
"Xctdoor와 과거 CRAT 공격 사례의 연관성 분석 (Larva-26005)" published by Ahnlab. #CVE20178291, #Phishing, #LNK, #Xctdoor, #CRAT, #Larva26005, #Hansom https://asec.ahnlab.com/ko/94846
"A Security Pro Hacked North Korean Hackers. He Found They’d Breached Hundreds of Networks Worldwide" published by Wired. #News, #ContagiousInterview, #ITWorker https://www.wired.com/story/a-security-pro-hacked-north-korean-hackers-he-found-theyd-breached-hundreds-of-networks-worldwide/
"A Detailed Post-Mortem on the AFX Security Incident" published by AFXTrade. #DeFi, #UNC4899, #AFX https://medium.com/@AFXTrade/a-detailed-post-mortem-on-the-afx-security-incident-57d564ef812f
"2026 Threat Hunting Report" published by CrowdStrike. #Trend, #StardustChollima, #FamousChollima https://www.crowdstrike.com/en-us/resources/reports/threat-hunting-report
"Alert to Countries, Companies, and Other Entities Regarding North Korean IT Workers" published by USFBI. #Sanctions, #ITWorker https://www.ic3.gov/CSA/2026/260731.pdf
"NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding" published by OpenSourceMalware. #NPM, #ContagiousInterview, #EtherHiding, #NullReceiver https://opensourcemalware.com/blog/nullreceiver-dprk-c2-technique
"북한 IT 인력 관련 공동주의보 발표" published by KRMOFA. #Sanctions, #ITWorker https://www.mofa.go.kr/www/brd/m_4080/view.do?seq=377471&page=1&pitem=10
"A New SiliVaccine: North Korea’s Antivirus" published by NKInternet. #OpSec https://nkinternet.com/2026/08/01/a-new-silivaccine-north-koreas-antivirus
"ClickFix, EtherHiding & a DPRK Wallet Trail" published by Allsecure. #ContagiousInterview, #ClickFix, #UNC5342, #EtherHiding https://www.allsecure.io/blog/clickfix-etherhiding-dprk-wallet
"PolinRider Caused Dozens of npm and Go Compromises" published by OpenSourceMalware. #SupplyChain, #GitHub, #NPM, #InvisibleFerret, #OmniStealer, #PolinRider https://opensourcemalware.com/blog/polinrider-caused-dozens-of-npm-and-go-compromises
Showing the 12 most recent of 20 posts we hold for @lazarusholic. View and reaction counts are the latest single reading for each post, not a live figure, and a recent post is still accumulating both. A view count marked ≈ was rounded by Telegram before we ever saw it — t.me prints views in full below 1,000 and to three significant figures above, so ≈1,200,000 means somewhere between 1,150,000 and 1,249,999. Unmarked counts are exact. Text is reproduced from the public post preview and truncated for length.
Cite this entry
A live page changes as we take new readings, so a citation should name the measurement it is based on, not just the URL. The line below cites the subscriber count as measured 8 November 2026 — this entry's latest reading, not the date you are reading this.
“lazarusholic” (@lazarusholic), 131 subscribers as measured 8 November 2026. Telegram Register, tgregister.com/channel/lazarusholic.
Full measurement history, CC BY 4.0. Every reading this register holds for this entry, not just the latest one, as a dated, downloadable record: CSV · JSON. Free to use with attribution to tgregister.com. Each file carries its own generation timestamp, which is the figure to cite for exactly when the data was retrieved.