797 reports
The article presents an adversary simulation based on Labyrinth Chollima activity targeting people in the energy and aerospace sectors with job-description lures. The simulated chain uses a password-protected ZIP containing an encrypted PDF and a trojaniz…
The write-up analyzes Moonstone Sleet activity involving a trojanized PuTTY installer delivered through platforms such as LinkedIn and Telegram. The installer checks the victim-entered password against a hardcoded value before decrypting the next-stage pa…
SOCRadar's 2024 APT roundup profiles Lazarus Group as a North Korean state-sponsored actor tied to espionage, disruptive activity, and large-scale financial theft. The Lazarus section says the group intensified fake recruitment and developer-focused opera…
S2W TALON analyzed LINKON malware associated with the North Korea-backed KONNI group, delivered as an LNK file disguised as a South Korean Financial Services Commission virtual-asset inspection document. The January 2025 sample used PowerShell to drop and…
Moonlock describes a fake-interview campaign that lures job seekers into running commands from malicious recruiting sites, with a focus on cryptocurrency theft. The macOS chain downloads ffmpeg.sh, selects an ARM or Intel VCam archive from attacker infras…
The source reports a hacking email campaign that impersonated a Seoul city official and was suspected to be the work of North Korea-linked Kimsuky. Although the archived body is sparse, the report provides incident-level evidence of government-themed soci…
ESRC reported a spear-phishing campaign in which attackers impersonated business counterparts by abusing reply-chain context and spoofed sender names to make malicious emails appear trustworthy. The emails carried EGG archives containing PIF executables, …
Securonix observed the DEEP#DRIVE campaign attributed to Kimsuky targeting South Korean businesses, government entities, and cryptocurrency users with Korean-language phishing lures disguised as work logs, insurance documents, and crypto-related files. Th…
SecurityScorecard’s STRIKE team attributes Operation Marstech Mayhem to Lazarus Group and describes Marstech1 as an implant aimed at software developers and cryptocurrency wallets through manipulated open-source repositories. Attackers used fake GitHub re…
A sample shared as possible Lazarus malware was assessed as a North Korean backdoor likely representing a newer version of PEBBLEDASH. The campaign used a 64-bit dropper with a PDF icon and a decoy Oracle scheduled maintenance report tied to South Korean …
Recorded Future describes North Korean IT-worker operations that use false identities and remote employment to generate regime revenue while creating insider risk for international companies. Insikt Group links the broader threat to PurpleBravo activity o…
Secureworks CTU describes DPRK nationals posing as legitimate IT professionals to obtain employment inside unwitting organizations. The webinar frames the activity as an infiltration scheme with distinct applicant behavior, tooling, and warning signs that…
The second Nurilab analysis continues the Lazarus ClickFix malware chain and focuses on the final C# binary, Tvooly.exe, produced after seven stages of de-obfuscation, decryption, and C2 communication. Tvooly.exe uses obfuscation, AES-based resource decry…
The Malware Analysis Space post examines a Kimsuky/APT43 PowerShell sample associated with ASEC reporting on forceCopy malware used in spear phishing. The sample, identified by MD5 1e9d94d88fdac3c4a0a47a3a1d07e329, uses heavy obfuscation with reversed str…
CYFIRMA profiles APT43 as a North Korean state-sponsored operator linked to the Reconnaissance General Bureau and associated with aliases including Kimsuky, Emerald Sleet, TA427, Thallium, and Velvet Chollima. The profile emphasizes strategic intelligence…