797 reports
SOCRadar's crypto and NFT threat overview includes the Ronin Network breach as a major DPRK-linked case. The article says attackers stole about 173,600 ETH and 25.5 million USDC from the Axie Infinity Ronin bridge after compromising five of nine validator…
NSHC's JSAC presentation describes a June 2024 Kimsuky social-engineering operation that used LinkedIn reconnaissance against Republic of Korea Navy-related personnel and then moved into spear phishing. The actors prepared VPS/VDS infrastructure, used mai…
The JSAC/KrCERT presentation analyzes attacks against centralized management solutions by separating attacker-leased infrastructure from victim-environment activity. The source describes evidence from a retained Google account, North Korean wording, acces…
The JSAC source presents Lazarus-focused CTI methods for following clues across malware, infrastructure, and external knowledge bases such as Malpedia and the Pyramid of Pain. The report is useful as analytic tradecraft for strengthening Lazarus attributi…
The report analyzes Kimsuky malware delivered as a Windows LNK file disguised as a public service citation personal form. The lure executes PowerShell commands after the victim opens the shortcut, indicating a social-engineering intrusion path consistent …
ENKI tracks a Lazarus-attributed Contagious Interview variant that continues to target job seekers through fake recruitment activity with an apparent cryptocurrency-theft objective. The newer flow replaces coding-test package lures with a fake Willo-style…
ScarletShark reported a Kimsuky, also known as Emerald Sleet, approach against a United States-based think tank using a free Proton Mail account to impersonate an employee of the Japanese Embassy in Washington, D.C. The message invited the target to a mee…
360 describes APT-C-26, also tracked as Lazarus, using Electron-packaged malicious applications against cryptocurrency users and organizations. The campaign reportedly poisoned a uniswap-sniper-bot project and delivered an installer masquerading as an aut…
SentinelOne's macOS malware review highlights DPRK-linked activity against job seekers and cryptocurrency targets during 2024. The BeaverTail section describes North Korean operators impersonating recruiters on LinkedIn, X, and Freelancer, then pushing tr…
The Springer study analyzes DPRK cyber activity by mining more than 2,000 public reports from 2009 through May 2024. It clusters vendor naming conventions into 160 actor code names, maps those names into seven widely recognized DPRK threat groups, and ext…
This Kimsuky profile summarizes DPRK Reconnaissance General Bureau-linked espionage activity, aliases, objectives, and observed vulnerability references. The source identifies Kimsuky as a North Korea-aligned threat actor focused on intelligence collectio…
JPCERT/CC warns that Lazarus-linked operators have repeatedly used LinkedIn as an initial contact vector against organizations in Japan since around 2019, including cases tied to cryptocurrency theft and earlier operations documented by the center. The so…
JPCERT/CC discusses the practical attribution problem created by treating Lazarus as a single threat actor label rather than a collection of DPRK-aligned subgroups. The report argues that subgroup-level classification matters for incident response because…
Please note that simple phishing exploits were excluded due to the challenges associated with tracking criminal funds. In most cases, this vulnerability allows exploiters to abuse the authorization that has been set to the target contract. We aimed to pro…
NSHC's September 2024 intelligence review says 47 hacking-group activity cases were observed from August 21 to September 20, with SectorA accounting for the largest share and activity most often affecting finance and government targets. The North Korea-li…