--- title: "Steven Stone (@redsheep) | Hashnode" description: "Sharing things that matter. Read the latest articles by Steven Stone on Hashnode." url: "https://hashnode.com/@redsheep" --- @redsheep # Steven Stone @redsheep · Hawaii, USA · Joined March 2026 Sharing things that matter. ### [APT41's Expanding Arsenal: Google Calendar C2, Silver Dragon, and the Persistent Threat to U.S. Defense and Healthcare](https://redsheeptrends.hashnode.dev/apt41s-expanding-arsenal-google-calendar-c2-silver-dragon-and-the-persistent-threat-to-us-defense-and-healthcare?utm_source=hashnode&utm_medium=feed) APT41 deploys TOUGHPROGRESS malware with Google Calendar C2, launches Silver Dragon sub-cluster, and continues targeting U.S. defense and healthcare infrastr... 29 min read · [redsheeptrends.hashnode.dev](https://redsheeptrends.hashnode.dev/apt41s-expanding-arsenal-google-calendar-c2-silver-dragon-and-the-persistent-threat-to-us-defense-and-healthcare?utm_source=hashnode&utm_medium=feed) [Mar 18](https://hashnode.com/posts/apt41s-expanding-arsenal-google-calendar-c2-silver-dragon-and-the-persistent-threat-to-us-defense-and-healthcare/69ba7ef852ffd67f055f2f0b) ### [CL-STA-1087: China-Linked Espionage Cluster Targets Southeast Asian Militaries with Custom Backdoors](https://redsheeptrends.hashnode.dev/cl-sta-1087-china-linked-espionage-cluster-targets-southeast-asian-militaries-with-custom-backdoors?utm_source=hashnode&utm_medium=feed) Unit 42 exposes CL-STA-1087, a multi-year Chinese cyberespionage campaign using AppleChris and MemFun backdoors to steal military intelligence from Southeast... 14 min read · [redsheeptrends.hashnode.dev](https://redsheeptrends.hashnode.dev/cl-sta-1087-china-linked-espionage-cluster-targets-southeast-asian-militaries-with-custom-backdoors?utm_source=hashnode&utm_medium=feed) [Mar 17](https://hashnode.com/posts/cl-sta-1087-china-linked-espionage-cluster-targets-southeast-asian-militaries-with-custom-backdoors/69b9382f2a262cffb373aec7) ### [Handala Weaponizes Microsoft Intune to Wipe 200,000 Stryker Devices Across 79 Countries](https://redsheeptrends.hashnode.dev/handala-weaponizes-microsoft-intune-to-wipe-200000-stryker-devices-across-79-countries?utm_source=hashnode&utm_medium=feed) Iran-linked Handala group compromised Stryker admin accounts and abused Microsoft Intune to remotely wipe 200,000+ devices globally. Full technical breakdown... 8 min read · [redsheeptrends.hashnode.dev](https://redsheeptrends.hashnode.dev/handala-weaponizes-microsoft-intune-to-wipe-200000-stryker-devices-across-79-countries?utm_source=hashnode&utm_medium=feed) [Mar 13](https://hashnode.com/posts/handala-weaponizes-microsoft-intune-to-wipe-200000-stryker-devices-across-79-countries/69b3c6893c1c294549dc0834) ### [FortiGate Exploitation Campaign: How Stolen Service Accounts Enable Rogue Workstation Deployment and Full AD Compromise](https://redsheeptrends.hashnode.dev/fortigate-exploitation-campaign-how-stolen-service-accounts-enable-rogue-workstation-deployment-and-full-ad-compromise?utm_source=hashnode&utm_medium=feed) Active exploitation of three FortiGate CVEs lets attackers extract LDAP credentials, join rogue workstations to Active Directory, and exfiltrate NTDS.dit files. 9 min read · [redsheeptrends.hashnode.dev](https://redsheeptrends.hashnode.dev/fortigate-exploitation-campaign-how-stolen-service-accounts-enable-rogue-workstation-deployment-and-full-ad-compromise?utm_source=hashnode&utm_medium=feed) [Mar 12](https://hashnode.com/posts/fortigate-exploitation-campaign-how-stolen-service-accounts-enable-rogue-workstation-deployment-and-full-ad-compromise/69b347c25fea8ec5b1690996) ### [North Korean Hackers Poisoned Polyfill.io Library to Target 100,000 Websites](https://redsheeptrends.hashnode.dev/north-korean-hackers-poisoned-polyfillio-library-to-target-100000-websites?utm_source=hashnode&utm_medium=feed) A massive supply chain attack compromised the popular polyfill.io JavaScript library, affecting over 100,000 websites with malicious code linked to North Korea. 5 min read · [redsheeptrends.hashnode.dev](https://redsheeptrends.hashnode.dev/north-korean-hackers-poisoned-polyfillio-library-to-target-100000-websites?utm_source=hashnode&utm_medium=feed) [Mar 12](https://hashnode.com/posts/north-korean-hackers-poisoned-polyfillio-library-to-target-100000-websites/69b346e17ea3a1c3435d45f7)