504 reports
A suspected North Korean IT worker applying to Ump Labs used questionable names and locations but demonstrated credible blockchain-engineering and smart-contract security knowledge during an undercover interview. Researchers linked his profiles, email add…
The Wall Street Journal used leaked browser histories, emails, calendars, screen recordings, interviews, and previously unseen videos to trace a North Korean remote-worker cell that infiltrated at least eight U.S. companies within months. Thousands of DPR…
Kudelski Security linked a DPRK-associated operator known as Bismarck to gambling administration infrastructure and IP addresses that overlap earlier FakeCalls research. A separate fake IT worker manager held credentials for two systems later associated w…
North Korea is estimated to have stolen at least $2.8 billion in virtual assets between January 2024 and September 2025, with proceeds moving through decentralised services, third-party launderers, OTC and peer-to-peer traders, money mules and guarantee m…
Lazarus expanded Operation Dream Job against defense, aerospace, and aviation organizations by combining fraudulent recruitment lures with trojanized PDF viewers and impersonation websites. The campaign exploited the Windows AFD.sys zero-day CVE-2026-6882…
The FBI is investigating a North Korean remote IT worker recently discovered working for an unidentified U.S. federal agency, although the worker’s role, duration of access, and possible exposure of sensitive data remain unknown. The case extends a fraudu…
Six npm packages delivered an identical JavaScript loader, including three hijacked legitimate packages and three packages published with the malware already embedded. The loader used an Ethereum transaction as a dead drop, decoding command-and-control IP…
Gunra evolved from a Conti-derived ransomware variant first observed in April 2025 into a structured ransomware-as-a-service operation with Windows and Linux encryptors. Its affiliates exploit vulnerable or weakly secured VPN and firewall appliances, stea…
Researchers hired suspected Famous Chollima operatives into a controlled fake DeFi startup and monitored their behavior after onboarding. The workers used forged or stolen identities, mule banking details, remote-access software, AstrillVPN, AI services, …
North Korea combines nationwide network isolation, state-controlled application distribution, persistent device surveillance, cryptographic file restrictions, and physical enforcement to prevent citizens from accessing or sharing outside information. Andr…
BCA LTD, NorthScan, and ANY.RUN recruited DPRK-linked Famous Chollima IT workers into a controlled DeFi company and recorded their activity through monitored Windows sandboxes. The investigation exposed false-identity and facilitator arrangements, remote-…
Genians links Operation GitPower to Kimsuky, which uses spearphishing, malicious LNK files, obfuscated PowerShell, scheduled tasks, and Git repositories to collect system data and deploy encrypted AsyncRAT payloads. Infrastructure logs show the operators …
Genians links Operation GitPower to Kimsuky, which uses spearphishing, malicious LNK files, obfuscated PowerShell, scheduled tasks, and Git repositories to collect system data and deploy encrypted AsyncRAT payloads. Infrastructure logs show the operators …
Bybit filed a U.S. civil lawsuit against North Korea, its Reconnaissance General Bureau, and the Lazarus Group over the February 2025 theft from the exchange. A preliminary injunction freezes identified stolen assets and prohibits their transfer or dissip…
AhnLab linked recent Xctdoor distribution tracked as Larva-26005 to CRAT attacks against South Korean users dating to 2020, which other security firms attributed to Lazarus. Shared AppX installation paths, runtime code-obfuscation methods, and the earlier…