616 reports
North Korea-linked groups concentrated on developers and IT professionals through fake recruitment, technical interviews, coding assignments, malicious LNK files, and GitHub-based delivery. Famous Chollima’s Contagious Interview activity used OtterCookie …
North Korea-linked groups concentrated on developers and IT professionals through fake recruitment, technical interviews, coding assignments, malicious LNK files, and GitHub-based delivery. Famous Chollima’s Contagious Interview activity used OtterCookie …
360 Threat Intelligence Center attributes a multi-path espionage campaign to Kimsuky, with South Korea as the primary target and possible activity against Japanese, Vietnamese, German, and English-speaking users. Operators delivered malicious LNK files di…
The FBI and CrowdStrike disrupted several U.S. laptop farms used by DPRK-nexus adversary FAMOUS CHOLLIMA to place operatives in remote jobs at American companies. Facilitators received employer-issued devices and configured them for remote access, enablin…
The FBI warns that state-controlled North Korean IT workers are expanding their use of U.S. facilitators, distributed laptop farms, stolen identities, and subcontracted labor to obtain and retain remote jobs at Western companies. The workers generate reve…
U.S. authorities charged 14 people, arrested two alleged U.S.-based facilitators, and seized approximately 187 devices while disrupting more than 40 suspected Texas laptop farms supporting North Korean remote IT workers. The workers allegedly used stolen …
DPRK-linked activity accounted for $655,000 in losses during the week. A UNC1069 fake Microsoft Teams call caused a $385,000 loss, while a separate $270,000 seed compromise was suspected to involve DPRK actors. SEAL identified three UNC1069 phishing domai…
Vertex and Team Cymru assessed with high confidence that U.S. residential IP 172.120.254.49 supported the DPRK IT Worker ecosystem. The host exposed HTTP and SOCKS proxy services plus SSH, received connections from Astrill VPN infrastructure including an …
North Korea-linked actors accounted for roughly 95% of the losses in Security Alliance's Q3 2026 assessment, with publicly tracked DPRK-attributed theft exceeding $1 billion for the year. TraderTraitor/UNC4899 was publicly attributed with the Bitget and A…
Kimsuky distributed Funhouse ransomware through a malicious HWP resume that launched a multi-stage chain of batch, VBS, PowerShell, Python, and bitmap-embedded payloads. Quasar RAT served as the final loader for the ransomware, and its configuration, mute…
Kimsuky distributed Funhouse ransomware through a malicious HWP resume that launched a multi-stage chain of batch, VBS, PowerShell, Python, and bitmap-embedded payloads. Quasar RAT served as the final loader for the ransomware, and its configuration, mute…
Kimsuky expanded Operation GitPower against Ukrainian foreign-policy, security, and civil-society experts using reply-bait spearphishing that impersonated conference organizers and policy researchers. Follow-on payloads used PDF-disguised LNK files or a f…
Kimsuky expanded Operation GitPower against Ukrainian foreign-policy, security, and civil-society experts using reply-bait spearphishing that impersonated conference organizers and policy researchers. Follow-on payloads used PDF-disguised LNK files or a f…
Zscaler uncovered a July 2026 campaign using a trojanized Terraform provider to execute a Bash loader and deliver FLATROOF and ROOFDECK across macOS, Linux, and Windows. FLATROOF provides persistent command execution and deploys Python stealers for browse…
North Korea-affiliated actors are using poisoned open-source dependencies to steal cloud credentials and establish durable access through developer workstations and CI/CD pipelines. Unit 42 links Alluring Pisces-associated activity across the Axios, Mastr…