2026_H1_APT_Report.pdf (1 MB)

DPRK-aligned operators continued using supply-chain compromise, fraudulent job-interview repositories, cryptocurrency theft, and overseas IT-worker infiltration to generate state revenue. Trend Micro says BlueNoroff compromised the Axios maintainer’s account to distribute a RAT through a package with more than 100 million weekly downloads, while Void Dokkaebi delivered malware through fake interview repositories. Likely DPRK-linked actors also stole US$285 million from Drift Protocol and US$292 million from KelpDAO. Sanctions and domestic infrastructure constraints have pushed these groups toward overseas servers and borrowed commercial AI models, which currently play a supporting role in their operations.