797 reports
Cyble profiles Lazarus Group as a North Korean state-sponsored actor conducting financially motivated intrusions, espionage, ransomware, supply-chain compromise, and cryptocurrency and fintech targeting alongside broader activity against defense, governme…
FalconFeeds analyzes a leaked Kimsuky operator workstation and related VPS that exposed backdoors, source code, internal documents, browsing history, credentials, and phishing infrastructure. The attribution discussion cites Korean Standard Time configura…
Fox-IT and NCC Group analyzed a Lazarus subgroup targeting financial and cryptocurrency organizations, overlapping with activity linked to AppleJeus, Citrine Sleet, UNC4736, and Gleaming Pisces. In a 2024 DeFi intrusion, the actor used Telegram social eng…
Kimsuky is attributed in the source to a Korean-language lure named “donation receipt.pdf.lnk,” which masquerades as a Hangul document and child-welfare donation receipt. When executed, the LNK launches hidden PowerShell, decodes embedded Base64 content, …
NK Internet examined an Arirang 182 North Korean feature phone, a rugged IP68-rated handset with a 2.4-inch display, removable battery/SIM compartment, and domestic support references such as the 999 subscription number. The device could be switched to En…
A phishing email sent to a South Korean energy-company domain delivered a RAR attachment containing a .NET executable disguised as an air cargo waybill. The executable was identified as a PureCrypter first-stage loader that contacted 158.247.250[.]251 for…
Kimsuky activity is described using a password-protected ZIP containing a PDF-themed LNK named Update Schedule_INVITATION - 250625 UNC Ambassador's Roundtable.pdf.lnk. The lure impersonated a United Nations Command ambassador roundtable invitation and was…
Seqrite links Operation HanKook Phantom to APT37, a North Korean state-backed espionage actor also known as InkySquid, ScarCruft, Reaper, Group123, TEMP.Reaper, and Ricochet Chollima. The campaign used a National Intelligence Research Society newsletter d…
KuCoin links recent fake-recruiter phishing against cryptocurrency-sector personnel to Lazarus Group/APT38, with lures delivered through LinkedIn, Telegram, and X. Non-technical victims are pushed through a fake interview site that claims a missing camera…
The research identifies suspected DPRK IT worker activity across GitHub, code-sharing sites, freelancing platforms, forums, personal portfolio pages, and resume-hosting services. It frames the activity as part of North Korean remote-job fraud, with worker…
Qianxin attributes a recent ClickFix campaign to Lazarus, tracked internally as APT-Q-1, based on overlap with prior Lazarus reporting and deployment of BeaverTail and InvisibleFerret. The campaign uses fake recruiting and interview sites to persuade vict…
A Linux variant of Gunra ransomware derived from Conti reduces its effective ChaCha20 key space to only 256 possibilities by repeatedly reseeding C's `rand()` with the same second-resolution timestamp. This fills the 32-byte key and 12-byte nonce with one…
SK Shieldus reports that Gunra ransomware, first seen in April 2025, attacked a South Korean financial institution in July 2025, causing roughly four days of service disruption and alleged theft of 13.2 TB of database material. The group operates a Tor le…
OFAC sanctioned Russian national Vitaliy Sergeyevich Andreyev for allegedly facilitating payments to Chinyong Information Technology Cooperation Company, a previously sanctioned DPRK-linked organization employing North Korean IT workers in Russia and Laos…
Anthropic reports that North Korean operatives misused Claude to support fraudulent remote-employment schemes targeting US Fortune 500 technology companies. The activity involved creating convincing false identities, completing technical and coding assess…