626 reports
CYFIRMA observed a Korean-speaking team preparing the June 2026 Minjun campaign to exploit CVE-2026-109618 and CVE-2026-109619 across internet-facing PHP systems, prioritising government, finance, manufacturing, logistics and aviation targets. The operato…
South Korean police are investigating the suspected employment of a North Korean IT worker at a domestic private company, described by MBC as the first identified case of its kind in South Korea. The individual allegedly stole another person’s identity, o…
APT-C-55 (Kimsuky) used multilingual LNK lures to execute layered batch or PowerShell chains that established scheduled-task persistence, collected host and user data, and exfiltrated it through attacker infrastructure. The campaign abused renamed copies …
DPRK operators are continuing Contagious Interview recruitment lures by inviting targets to private code repositories whose `.npmrc` files redirect npm to an alternate registry. A malicious dependency referenced in `package.json` does not resolve through …
Kaspersky attributed Operation FlashHole to the Lazarus Group, which targeted at least three South Korean organizations through tailored phishing sites and an infection chain involving the mandatory CrossWeb EX security product. The campaign used a largel…
Five DPRK-related cases caused $260,000 in reported losses, including three Contagious Interview fake-job-interview victims and one wallet compromise attributed to an unidentified campaign. Polin Rider malware was also discovered in 13 of 928 repositories…
An analyst traced a North Korea-linked JavaScript infection chain that modifies VS Code, Cursor, Discord, GitHub Desktop, and the global npm CLI to relaunch an implanted RAT whenever developers use those tools. The payload, assessed as an updated DEV#POPP…
The DPRK-linked Contagious Interview campaign used NullReceiver in malicious npm packages masquerading as Tailwind CSS plugins. The code recovered C2 IPv4 addresses from the recipient field of zero-value Ethereum transactions sent by a hardcoded wallet, a…
GhostAction compromised 94 GitHub repositories with a hidden VS Code task that executed a credential stealer disguised as a Font Awesome file and installed a five-minute cron command channel. The launcher closely copied a technique pioneered by North Kore…
North Korea-linked groups concentrated on developers and IT professionals through fake recruitment, technical interviews, coding assignments, malicious LNK files, and GitHub-based delivery. Famous Chollima’s Contagious Interview activity used OtterCookie …
North Korea-linked groups concentrated on developers and IT professionals through fake recruitment, technical interviews, coding assignments, malicious LNK files, and GitHub-based delivery. Famous Chollima’s Contagious Interview activity used OtterCookie …
360 Threat Intelligence Center attributes a multi-path espionage campaign to Kimsuky, with South Korea as the primary target and possible activity against Japanese, Vietnamese, German, and English-speaking users. Operators delivered malicious LNK files di…
The FBI and CrowdStrike disrupted several U.S. laptop farms used by DPRK-nexus adversary FAMOUS CHOLLIMA to place operatives in remote jobs at American companies. Facilitators received employer-issued devices and configured them for remote access, enablin…
The FBI warns that state-controlled North Korean IT workers are expanding their use of U.S. facilitators, distributed laptop farms, stolen identities, and subcontracted labor to obtain and retain remote jobs at Western companies. The workers generate reve…
U.S. authorities charged 14 people, arrested two alleged U.S.-based facilitators, and seized approximately 187 devices while disrupting more than 40 suspected Texas laptop farms supporting North Korean remote IT workers. The workers allegedly used stolen …