APT PROFILE – KIMSUKI

CYFIRMA profiles Kimsuki as a North Korea-linked APT active since at least 2012 and aligned with strategic intelligence collection priorities associated with the Reconnaissance General Bureau. The group is described as targeting South Korean and U.S.-base…

2025년 12월 APT 공격 동향 보고서(국내)

AhnLab's December 2025 domestic APT trend report says spear phishing dominated observed attacks against South Korean targets, with LNK files accounting for the largest share that month. One LNK-based pattern executed malicious PowerShell from compressed a…

VS Code Tasks Abuse by Contagious Interview (DPRK)

Security Alliance analyzes a malicious Bitbucket repository tied to the DPRK Contagious Interview campaign that targets developers through fake recruiting and partnership lures. The repository can execute malware when opened as a trusted VS Code workspace…

Hunting Lazarus: Inside the Contagious Interview C2 Infrastructure

Red Asgard maps active Lazarus Group infrastructure discovered while vetting a cryptocurrency Upwork project containing Contagious Interview-style malware. The repository used VS Code auto-execution, a malicious npm dependency, and backend Function.constr…

Unmasking the DPRK Remote Worker Problem

Silent Push describes the DPRK remote worker program as an insider-risk and revenue-generation operation that uses stolen identities, remote hiring, and deceptive network paths to enter Western companies. The report separates long-term infiltrators, who m…

North Korean Kimsuky Actors Leverage Malicious QR Codes in Spearphishing Campaigns Targeting U.S. Entities

The FBI FLASH warns that North Korean Kimsuky actors used malicious QR codes in 2025 spearphishing against NGOs, think tanks, academia, government entities, and foreign policy experts focused on North Korea. The quishing emails impersonated foreign adviso…

Inside the DPRK Fake IT Workers Network: IP Ranges, Proxies, and Internal Coordination

Kudelski Security links mail-dump material, Hudson Rock stealer logs, and public research to DPRK fake IT worker infrastructure and internal coordination. The excerpt maps Russian public IP ranges, a Hong Kong proxy pivot, and a private 192.168.91.x netwo…

We Hacked The North Korean Military!

The excerpt alleges North Korean government and military involvement in scams targeting Americans, but it provides only a YouTube description and timestamps rather than a technical intrusion report. It says anonymous sources provided evidence and material…

The Mac Malware of 2025

Objective-See’s 2025 macOS malware review shows information stealers as the dominant new macOS malware class, with victims’ cookies, passwords, certificates, cryptocurrency wallets, SSH keys, and related sensitive data as primary collection targets. The e…