Full static analysis of HyperHives macOS Rust infostealer — 571 decrypted config values, C2 infrastructure, DPRK/Contagious Interview attribution, YARA/Sigma rules, STIX 2.1 bundle, ATT&CK Navigator layer

Threat intel package for Lazarus Group's 3-wave GitHub phishing campaign targeting developers (Mar-Apr 2026). YARA, Sigma, Suricata, Nuclei rules + STIX 2.1 bundle + ATT&CK Navigator layer + full C2 infrastructure map. Defensive use only.