797 reports
NuriLab reports a Lazarus-attributed NetSupport RAT campaign that used fake CAPTCHA instructions to push victims into running a PowerShell command. The chain created C:/Users/Public/as, downloaded a ZIP from 147.45.xx.200, extracted NetSupport Manager com…
A CyberDefenders 3CX supply-chain write-up walks through analysis of malicious 3CX Desktop App updates that triggered antivirus alerts, degraded performance, and unusual network traffic. The exercise identifies Windows 3CX versions flagged as malicious, t…
SentinelLABS describes new macOS FlexibleFerret samples tied to the DPRK Contagious Interview campaign, where victims are lured through fake job or developer interactions into installing malware. The versus.pkg installer drops InstallerAlert.app and a mal…
NSHC summarizes October 2024 threat-actor activity, including SectorA clusters associated with North Korea linked operations. The report notes activity against government and commercial targets, with North America and Europe among the most frequently targ…
Genians analyzes an APT37 campaign that used identity impersonation and a Korean messenger group chat channel to deliver malicious HWP and LNK files. The report highlights spear phishing, lateral-movement risk after initial endpoint compromise, evasion-fo…
The report analyzes a phishing email attributed as likely Kimsuky that impersonates Kakao customer support and warns recipients that an account will become dormant. It identifies suspicious sender infrastructure, mismatched Kakao branding, and mail-header…
The report analyzes a suspected Kimsuky phishing email that impersonates a Korean tax payment notice delivered through a Naver-style electronic document theme. The lure pressures users to open the notice before an authentication deadline while the sending…
Socket found a malicious npm package, postcss-optimizer, that impersonated the legitimate postcss library and contained BeaverTail malware linked to North Korean Contagious Interview activity within the broader Lazarus ecosystem. The package targeted deve…
Google Threat Intelligence Group examined how government-backed APT and information-operations actors attempted to use Gemini for operational support. The source says actors used the tool mainly for research, troubleshooting, content generation, localizat…
SecurityScorecard describes Operation Phantom Circuit as a Lazarus Group campaign that embedded malware in trusted development tools to compromise cryptocurrency and technology developers worldwide. The infrastructure used C2 servers active from late 2024…
Hunt.io identifies additional SparkRAT infrastructure tied to a suspected DPRK macOS campaign previously observed using fake meeting-themed lures. The activity includes open directories serving bash scripts and Mach-O SparkRAT clients, with delivery paths…
Farnsworth Intelligence lists IP addresses allegedly used by North Korean IT-worker farms to connect into U.S. companies through remote desktop tooling, including RustDesk and AnyDesk-style access. The source warns that the operators also abuse legitimate…
NuriLab analyzes Maui ransomware, a file-encryption malware family reported in U.S. advisories as affecting public health and healthcare organizations since 2021. The report says Maui likely spread through X-PopUp, an open-source messenger used by small a…
KISA analyzes four malware types attributed to Lazarus activity observed in 2024 incidents affecting South Korean private-sector organizations, including IT companies and a major media company. The first type uses DLL side-loading, MachineGuid-based CRC32…
Securr describes the Phemex incident as a January 2025 hot-wallet breach that caused at least $37 million in unauthorized withdrawals across multiple blockchain networks. The report says attackers executed more than 125 suspicious transactions on chains i…