554 reports
WhoisXML API mapped DNS infrastructure from the UNC1069 compromise of the axios NPM package, which delivered the cross-platform WAVESHAPER.V2 backdoor through malicious `plain-crypto-js` post-install execution. The analysis consolidated five subdomains, s…
Krypt3ia assesses that North Korean cyber operations have shifted from separate espionage, financial theft, and disruptive tracks into an interconnected access-generation ecosystem. The report links fraudulent remote IT-worker schemes, developer-targeting…
Bitso described another suspected North Korean Chollima job applicant who attempted to interview for an engineering role under the claimed identity of Camilo Andrés Pantoja from Colombia. During the call, a Canary Token link exposed that the applicant con…
OpenSourceMalware found three malicious npm packages linked to the March 2026 Axios compromise through the shared XOR key OrDeR_7077, while using separate C2 infrastructure at 18.208.244.120:9999. The packages redeem-onchain-sdk, nicegui, and period-newli…
Attackers are sharpening established methods rather than abandoning them, using offensive tooling, infostealers, ransomware affiliates, social engineering, and trusted-platform abuse with greater speed and resilience. Bridewell highlights adversary infras…
A DPRK-linked TraderTraitor/UNC4899 actor stole 116,500 rsETH, worth about $292 million, from the KelpDAO rsETH bridge on April 18, 2026. The intrusion began with social engineering against a LayerZero Labs developer on March 6, enabling session-key theft…
DPRK-linked Contagious Interview activity is targeting cryptocurrency developers and blockchain companies through fake job interviews, poisoned GitHub repositories, and malicious npm packages. The report describes a multi-stage infection chain that abuses…
Red Asgard identifies OtterCookie as a separate JavaScript and Node.js RAT operating alongside BeaverTail and InvisibleFerret in Lazarus-linked Contagious Interview activity. Unlike BeaverTail’s stored-data theft model, OtterCookie uses Socket.IO over Eng…
NorthScan links Beejern, an active Oklahoma LLC, to a suspected DPRK IT worker network through GitHub identity cycling, DPRK-associated developer personas, exposed Beejern credentials, and reused company infrastructure. The GoldenDev321 account previously…
Logpresso analyzed four Kimsuky spear-phishing campaigns from early 2026 that used tailored lures against recruiters, business contacts, healthcare and insurance entities, cryptocurrency users and developers, defense-related personnel, and graduate-progra…
The episode examines the operator side of a Lazarus-attributed fake interview credential pipeline. The collection system reportedly captured material from operator workstations as well as targets, exposing social-engineering workflow, persona infrastructu…
Kimsuky has expanded its PebbleDash and AppleSeed-related operations with newly documented tooling, including the Rust-based HelloDoor backdoor, httpMalice, MemLoad/httpTroy, AppleSeed, HappyDoor, VSCode Remote Tunneling, and DWAgent. The campaigns use sp…
Krypt3ia assesses that enterprise AI systems are becoming high-value operational infrastructure because they ingest sensitive data, connect to internal workflows, and increasingly act with delegated authority. The North Korea-focused section argues that D…
CrowdStrike reports that DPRK-nexus actors drove a 51% year-over-year increase in digital asset theft in 2025, stealing a reported $2.02 billion across the financial sector. PRESSURE CHOLLIMA allegedly conducted the largest reported financial theft, takin…
Hybrid Analysis identified a VELVET CHOLLIMA-assessed infostealer operation distributing a signed Windows MSI that masquerades as the Tralert FX cryptocurrency trading application. The installer exposed live credentials and GitLab access tokens, revealing…