698 reports
A malicious ZIP contained a PDF-disguised Windows shortcut using a Japanese foreign-policy questionnaire as its lure. The shortcut retrieved VBScript and PowerShell stages from GitLab, established 15-minute scheduled-task persistence, collected system and…
Attackers transferred approximately $6.3 billion from 17 Binance hot wallets after compromising a DevOps laptop and reaching infrastructure capable of submitting transactions to Binance's signer. On Ethereum, 50 pre-obtained EIP-7702 authorizations enable…
Jamf linked the USD 6.4 billion Binance theft to the DPRK developer-targeting playbook described by Chainalysis and TRM Labs, which attributed the operation to TraderTraitor. Binance said a compromised DevOps laptop may have enabled unauthorized withdrawa…
Elliptic estimates that attackers drained $6.43 billion from Binance hot wallets across 11 blockchains, with the largest losses occurring on Ethereum. The attackers abused EIP-7702 delegation and apparently manipulated Binance's signing infrastructure, wh…
AhnLab observed spear-phishing campaigns against South Korean entities in September 2026, with malicious LNK files serving as the dominant entry vector. The documented chains used PowerShell, AutoIt, HTA files, scheduled tasks, GitHub-hosted payloads, Pub…
ASEC observed that most domestic APT activity during September 2026 began with spear-phishing messages, with LNK files serving as the most prevalent execution mechanism. The documented chains used PowerShell, malicious AutoIt scripts, HTA files, scheduled…
Chainalysis attributes the $6.4 billion Binance theft to North Korean cybercrime group TraderTraitor, with its strongest evidence coming from stolen Binance funds commingling on-chain with assets from the DPRK-attributed Bitget exploit. The attackers rapi…
Binance said a compromised DevOps engineer laptop may have allowed an attacker to access a service container and submit unauthorized withdrawal transactions, while finding no evidence of a wallet private-key leak. The exchange estimated the impact at abou…
Protos’ live coverage records the October 29 Binance theft, subsequent withdrawal suspension, asset freezes, and recovery claims. It reports that the FBI officially attributed the incident to North Korea’s TraderTraitor group, while Protos’ provisional bl…
TRM attributed the theft of approximately USD 6.36 billion from Binance wallets across ten blockchains to the North Korean state-sponsored group TraderTraitor with high confidence. The attacker used pre-signed EIP-7702 authorizations to delegate an Ethere…
A compromised npm maintainer account published nine PolinRider-linked package versions on May 4, 2025, predating the campaign's previously documented victims by eight months. Recovered packages used blockchain transactions to deliver JADESNOW, an INVISIBL…
DPRK's Contagious Interview campaign combined fake recruiter and interview lures with ErrTraffic-style ClickFix overlays on compromised WordPress sites and fake cryptocurrency-company pages. These routes delivered portable Node.js loaders that resolved C2…
Microsoft assesses that North Korean threat actors have reached a high level of AI adoption, using generative and agentic systems to accelerate reconnaissance, social engineering, fraudulent employment, malware development, and post-compromise analysis. J…
A U.S. defense contractor employee with an active Top Secret clearance pleaded guilty to conspiracy to commit wire fraud after allowing foreign individuals to use his identity and another stolen identity for remote-job applications. The scheme targeted U.…
DPRK operators are extending their fake-font technique from WOFF and WOFF2 files to TTF and OTF files that actually contain JavaScript. Some newer variants were force-pushed over existing malicious repositories while older fake-font artifacts remained vis…