In Other News: AI Used in Korean Bank Breaches, Poem-Guided Botnet, Empire Admin Gets 40 Years

This week's security digest covers a wide range of incidents. South Korean President Lee Jae Myung indicated that artificial intelligence may have been involved in recent attacks against local banks that exposed customer data, with CrowdStrike linking the intrusions to a likely Chinese-speaking, financially motivated group that left behind Claude Code and ARTEX-related files. Separately, researchers at Black Lotus Labs uncovered PoeLLM, a cryptomining botnet that hides its command server address inside a GitHub-hosted poem, allowing operators to relocate infrastructure simply by editing the verses. GitGuardian reported that the GhostAction supply-chain campaign has now hit 772 additional GitHub repositories, stealing over 2,500 credentials, while Socket and Sonatype flagged a compromised Tensorlake npm SDK release carrying a Shai-Hulud-style credential-stealing worm. On the vulnerability side, CVE-2026-47483 was disclosed in Nvidia's DCGM Exporter, exposing telemetry from more than 12,000 GPUs across roughly 2,100 internet-facing hosts before being fixed in version 4.8.2. The roundup also notes legal outcomes, including a 40-year prison sentence for Empire Market co-founder Raheim Hamilton and a jury conviction against a hacker behind the Uranium Finance crypto thefts, plus CISA's revised cyber retention pay rules and a new OT security proposal for federal agencies.