698 reports
KMSEC documents two accidental operational-security exposures linked to FAMOUS CHOLLIMA npm activity. Several malicious packages published between July and September 2025 included an `ordinary.txt` JavaScript source file that appears to have been a refere…
Recent Contagious Interview activity attributed in the source to North Korean threat actors targets cryptocurrency, Web3, and AI professionals through fake technical assessments and trojanized NPM packages. The updated first-stage JavaScript has been redu…
A FAMOUS CHOLLIMA operator accidentally included a Windows LNK file in multiple malicious npm packages published between May and June 2025. The shortcut metadata points to a VMware-based development setup with a shared host path under \\vmware-host\Shared…
Google Threat Intelligence Group observed government-backed actors, including DPRK-linked threat actors, using large language models in late 2025 to support technical research, targeting, reconnaissance, and phishing-lure development. The report says thes…
The article links DPRK hiring-market abuse to Contagious Interview activity aimed at job seekers, developers, and IT workers affected by layoffs and economic pressure. It describes fake interview assessments and malicious Visual Studio Code workspaces whe…
AhnLab’s January 2026 APT trend report highlights several DPRK-linked activities affecting developer, Web3, public-sector, activist, and supply-chain targets. Lazarus is reported to have replaced blocked Pastebin infrastructure with Polygon NFT contracts …
Group-IB’s 2026 trends material frames supply-chain compromise as a dominant cybercrime pattern in which attackers abuse trusted vendors, SaaS platforms, open-source projects, managed service providers, and identity integrations. In the threat-actor secti…
Rekt describes DPRK fake IT-worker and recruiter operations that weaponize both sides of the employment pipeline against Western companies, crypto firms, and job seekers. In the insider-worker scheme, North Korean operatives use stolen identities, fabrica…
CloudSEK infiltrated Gunra's newly launched ransomware affiliate program and obtained panel access, operator documentation, and a working locker sample. The analyzed Windows payload encrypts files with per-file ChaCha20 keys protected by RSA-4096, process…
Bybit lost more than $1.5 billion after attackers deceived multisig signers into approving a malicious change to the exchange’s ETH cold wallet logic. QuillAudits says the attack relied on social engineering and likely malware on signer devices, with a fa…
ReversingLabs identifies graphalgo, a Lazarus Group fake-recruiter campaign active from May 2025 that targets JavaScript and Python developers with cryptocurrency-themed interview tasks. The operators used social platforms, Reddit and Facebook job posts, …
Okta Threat Intelligence examines DPRK IT-worker fraud through two tracked personas drawn from a larger dataset of more than 130 actors and 6,500 interviews across 500 companies. The examples show actors using free webmail accounts, job and coding platfor…
Google Threat Intelligence describes a cryptocurrency-sector intrusion attributed to UNC1069, a financially motivated actor suspected with high confidence to have a North Korea nexus. The operation began through a compromised Telegram account, a Calendly …
CrowdStrike’s tracking separates Labyrinth Chollima activity into core Labyrinth Chollima for espionage and the Golden Chollima and Pressure Chollima clusters for cryptocurrency theft, with shared origins in Kordll, Hawup, and related tooling. Golden Chol…
ScarCruft is reported shifting recent ROKRAT delivery from its earlier LNK-based chain to Hangul HWP documents carrying OLE-embedded droppers, loaders, or downloaders. The cases described use DLL side-loading, hardcoded payload retrieval, steganographic s…