554 reports
Web3Firewall analyzes the reported 2026 KelpDAO exploit as a cross-chain DeFi infrastructure incident affecting rsETH bridge operations rather than a simple standalone smart-contract bug or phishing case. The article says the attack caused roughly $290–29…
FalconFeeds summarizes UNC1069 as a financially motivated North Korean actor linked to the Reconnaissance General Bureau and active in cryptocurrency and developer-supply-chain targeting. The February 2026 intrusion described in the excerpt began with a h…
AhnLab observed the Lazarus group exploiting an AnySign4PC vulnerability in a watering-hole attack against the financial-sector ecosystem, enabling remote code execution. Multiple watering-hole distribution sites remained in use, indicating continuing exp…
Axios maintainer access was compromised to publish malicious [email protected] and [email protected] releases that added the typosquatted dependency [email protected] without changing the main Axios source. The malicious dependency used a postinstall hook to ru…
Breakglass Intelligence maps a large Kimsuky credential-harvesting operation targeting South Korean users through Naver, National Tax Service, NHIS, NongHyup, National Pension Service, and Kakao impersonation themes. The investigation consolidates six inf…
The excerpt traces a confirmed DPRK IT worker using the GitHub identity icetrust0212 to primary development work on Verida Network’s proof-connector-dapp, which verifies zkPass proofs and issues Verida credentials for exchange KYC status. The author links…
An investigation maps a cluster of 14 or more DPRK-linked IT worker accounts that allegedly infiltrated Tokamak Network and contributed heavily to bridge, NFT marketplace, subgraph, and landing-page repositories. The excerpt identifies primary actor "jusd…
A thread links the fake identity "Taro Aikuchi" to a DPRK IT worker cluster labeled "215" through repeated numeric markers across GitHub handles, email addresses, commit metadata, and aliases. The excerpt connects 0xbomb215, xsen215, highgoal215, and rela…
South Korean authorities warn that Midnight and Endpoint ransomware infections have been observed against domestic SMEs, especially manufacturers, with additional cases in retail, energy, and public-sector environments. The attackers first compromise IT s…
Trend Micro’s 2025 APT report frames North Korea as an “Asymmetric Saboteur” using AI to automate cybercrime and support state priorities such as missile funding. The DPRK-relevant section is strategic rather than IOC-driven, emphasizing AI-assisted recon…
KrCERT and the Korean National Police Agency warn that Midnight, also called Endpoint, ransomware incidents against South Korean small and medium-sized businesses are increasing through malicious email campaigns. The advisory says attackers use lures disg…
Microsoft attributes a macOS intrusion chain to Sapphire Sleet, a North Korean state actor focused on cryptocurrency, finance, venture capital, and blockchain targets. The campaign uses recruiter-style social engineering to make victims run a fake “Zoom S…
A malicious npm package named js-logger-pack evolved from harmless probes into a full multi-platform infostealer and later a HuggingFace-hosted binary dropper. Weaponized versions installed a Linux SSH backdoor, exfiltrated Telegram Desktop sessions, stol…
The Justice Department said Kejia Wang and Zhenxing Wang were sentenced for helping North Korean remote IT workers pose as U.S. residents and obtain jobs at more than 100 U.S. companies. The scheme used stolen identities of at least 80 U.S. persons, shell…
The thread explains why the author assessed the “Taro Aikuchi” applicant as a suspected DPRK fraudulent IT worker rather than a legitimate Japanese candidate. Evidence included fresh and inconsistent online identities, two-word-plus-number Gmail and Teleg…