797 reports
Leaked data reviewed by WIRED and researcher SttyK exposes the internal workflow of an alleged North Korean IT-worker operation that tracks job applications, fake identities, hardware, earnings, and team budgets across Google, GitHub, Slack, and spreadshe…
A spear-phishing operation targeted a specific person at a South Korean nonprofit policy research institute by impersonating a domestic media employee during an otherwise plausible column-submission workflow. The attack delivered a password-protected ZIP …
S2W TALON attributes a postal-code update lure campaign against South Korean users to ChinopuNK, an internally tracked ScarCruft subgroup associated with Chinotto malware. The infection chain begins with a malicious LNK in a RAR archive, drops an AutoIt l…
CyberBlade Security examines how North Korea’s cyber apparatus is connected to education, military infrastructure, and regime-controlled facilities in Pyongyang’s Mangyongdae district. The analysis focuses on Kim Il Sung Military University, described as …
ANY.RUN analyzes PyLangGhost RAT as a Python-based evolution of GoLangGhostRAT linked in the excerpt to the Lazarus subgroup Famous Chollima. The malware is delivered through targeted ClickFix social engineering against technology, finance, and cryptocurr…
Bybit lost more than $1.4 billion in ETH after Lazarus-linked operators compromised Safe{Wallet} infrastructure and manipulated the multisignature transaction flow used for a routine cold-to-warm wallet transfer. The excerpt describes initial access throu…
Orbit Bridge suffered a December 30, 2023 theft estimated at roughly USD 81.5 million to USD 100 million, involving ETH, USDT, USDC, DAI, and wBTC. The article says the attacker dispersed the assets across wallets, held them for about six months, and late…
Radiant Capital lost about 1,900 ETH, estimated at USD 4.5 million, in a January 3, 2024 flash-loan attack against its Arbitrum lending protocol. The article attributes the loss to weaknesses in state validation and function sequencing, then says the atta…
A U.S. civil forfeiture complaint seeks approximately 1,008,902.606307 USDT tied to alleged identity theft, computer fraud, wire fraud, money laundering, and related conspiracies. The excerpt defines the legal basis for seizing virtual-currency property d…
CNN reports that thousands of North Korean IT workers use stolen or fabricated U.S. identities to pose as Western developers, engineers, and technology consultants. The operation relies on AI-generated resumes and headshots, face-masking tools, VPNs, remo…
BigONE reported that a July 16, 2025 attack drained about $27 million from its hot wallets without exposing private keys. HackenProof attributed the intrusion path to social engineering against a key developer, followed by compromise of the developer’s de…
The Chinese source uses a Lazarus-inspired ByBit/Safe{Wallet} scenario to explain how front-end tampering can redirect cryptocurrency transactions without crashing the service or visibly altering the user experience. The described attacker studies Next.js…
CrowdStrike reports that DPRK-nexus FAMOUS CHOLLIMA infiltrated more than 320 companies over the past 12 months, a 220% year-over-year increase. The activity centers on North Korean IT workers using generative AI throughout hiring and employment, includin…
The analysis attributes a malicious LNK file disguised as an HWP document to Kimsuky and shows it abusing PowerShell to locate a specific-size shortcut file and extract embedded data. The script reads bytes from offset 0x17DC, XOR-decrypts them with 0x8C,…
A SwimSec WeChat post maps DPRK Lazarus activity against Web3 and cryptocurrency exchanges at a high level. The preserved text says it summarizes related attack groups and invites discussion of Lazarus TTPs, IOAs, and IOCs, especially TraderTraitor/UNC489…