797 reports
The archived thread reports on-chain links between the Bybit, Phemex, and BingX theft clusters attributed in the thread to Lazarus Group. It cites commingling between Bybit and Phemex theft addresses, test transactions, connected wallets used before the B…
OpenAI says it has disrupted malicious uses of its AI systems and is publishing case studies to support wider defensive work by governments, industry partners, and other stakeholders. The excerpt frames the threat set broadly, including authoritarian-stat…
Qi An Xin's 2024 annual threat report says APT activity most often targeted government, defense, and financial sectors, with major activity concentrated in Ukraine, China, the United States, Israel, and South Korea. It identifies Kimsuky, Lazarus, Patchwo…
TRM assessed with high confidence that North Korean hackers were behind the Bybit theft of about USD 1.5 billion in Ethereum tokens, citing substantial overlaps between attacker-controlled addresses and addresses linked to prior North Korean thefts. The a…
Bybit published an incident update about unauthorized activity involving an ETH cold wallet. The excerpt does not provide technical details about actor attribution, infection chain, infrastructure, IOCs, or recovery actions. Based only on the available te…
Trail of Bits frames the February 2025 Bybit theft as an operational-security compromise rather than a smart-contract exploit, with attackers allegedly manipulating what multisig signers saw while collecting valid approvals. The article connects the Bybit…
The DPRK-relevant section analyzes a Kimsuky malicious LNK sample used for initial access and payload staging. The shortcut points to mshta.exe, a legitimate Windows utility, and uses obfuscated JavaScript to run PowerShell with execution policy bypass. T…
A Korean security firm reported that a suspected nation-state hacking group stole a product code-signing certificate, creating a supply-chain risk because signed malware can appear to be legitimate software and bypass some security controls. The source sa…
ESET tracks DeceptiveDevelopment as a North Korea-aligned cluster that targets freelance software developers, especially people working on cryptocurrency and DeFi projects. Operators pose as recruiters or headhunters on job and freelancing platforms, then…
The sample is attributed in the source to North Korea's KONNI group and uses a large Windows shortcut disguised as a virtual-asset business inspection and party-government meeting HWP document. The LNK launches obfuscated PowerShell that searches for a Po…
Kandji analyzes DriverEasy.app, a Swift and Objective-C macOS application attributed in the source to North Korea’s Contagious Interview activity. The app masquerades as a Google Chrome or Google-related prompt, asks for microphone permission, then displa…
APT-C-28 (ScarCruft), also known as APT37, Reaper, and Group123, targeted South Korean government and enterprise personnel with phishing archives containing malicious LNK files. The LNK files used PowerShell to extract decoy documents, malicious BAT and P…
NSHC’s December 2024 report lists four SectorA groups active in DPRK-linked operations, with activity observed in South Korea, Russia, and South Korea-focused targeting. SectorA01 used LinkedIn hiring-manager impersonation and fake job opportunities, with…
IGLOO analyzed two GitHub accounts, CryptoNinja0331 and ican0220, as likely infrastructure for North Korean IT worker fake-employment activity. The repositories held resume and portfolio material, fake profile images, email and Upwork account data, projec…
Chollima Group tracks a North Korean IT worker cell using open-source data, photos, and logs discovered in an exposed Dropbox folder. The reporting places the cluster in Laos from roughly September 2021 to February 2024, with some members later appearing …