698 reports
OFAC designated ten individuals and the First Financial and Technical Development Center for supporting North Korean government-run IT worker schemes targeting US businesses. The designated network includes Russia-based DPRK workers and facilitators who a…
OFAC sanctioned ten individuals and one entity for supporting North Korean government-run IT worker schemes that defrauded businesses and generated cryptocurrency revenue for the DPRK regime. Chainalysis traced worker payments through stablecoin and ETH t…
OFAC sanctioned 10 individuals and the DPRK-controlled First Financial and Technical Development Center for supporting North Korean IT worker networks operating partly from Russia. Treasury said these workers use stolen identities and fabricated personas …
North Korea-aligned actors continued targeting technology and cryptocurrency companies, software developers, and increasingly Ukraine. Lazarus resumed recruitment-themed attacks against the drone sector, potentially seeking knowledge useful to North Korea…
PolinRider, a developer-repository malware campaign originally attributed to a DPRK threat actor, appeared in repositories also compromised by GhostAction. Investigators found 188 GhostAction commits rewritten to include PolinRider loaders, while GhostAct…
SEAL triaged three DPRK-linked incidents with combined losses of $3.22 million, including a delayed $3.19 million theft from a device whose wallet extension had been replaced after an April 2026 infection. Two Contagious Interview victims lost another $34…
Wiz observed three Gheist-affected victims re-pushing commits modified with PolinRider loaders on October 19 and 20, providing a concrete overlap with malware the source identifies as DPRK-linked. Gheist itself is a broader automated campaign that uses st…
Australia designated YU Pu Ung, SIM Hyon Sop, Korea Mangyondae Computer Technology Company, and Chinyong Information Technology Cooperation Company under its autonomous DPRK sanctions regime. The action imposes targeted financial sanctions on all four des…
CYFIRMA observed a Korean-speaking team preparing the June 2026 Minjun campaign to exploit CVE-2026-109618 and CVE-2026-109619 across internet-facing PHP systems, prioritising government, finance, manufacturing, logistics and aviation targets. The operato…
South Korean police are investigating the suspected employment of a North Korean IT worker at a domestic private company, described by MBC as the first identified case of its kind in South Korea. The individual allegedly stole another person’s identity, o…
Lazarus targeted at least three South Korean organizations in Operation FlashHole, using tailored phishing sites and the mandatory CrossWeb EX financial-security software as the likely initial infection path. The memory-focused chain deployed TechHub, Tou…
APT-C-55 (Kimsuky) used multilingual LNK lures to execute layered batch or PowerShell chains that established scheduled-task persistence, collected host and user data, and exfiltrated it through attacker infrastructure. The campaign abused renamed copies …
DPRK operators are continuing Contagious Interview recruitment lures by inviting targets to private code repositories whose `.npmrc` files redirect npm to an alternate registry. A malicious dependency referenced in `package.json` does not resolve through …
Kaspersky attributed Operation FlashHole to the Lazarus Group, which targeted at least three South Korean organizations through tailored phishing sites and an infection chain involving the mandatory CrossWeb EX security product. The campaign used a largel…
Five DPRK-related cases caused $260,000 in reported losses, including three Contagious Interview fake-job-interview victims and one wallet compromise attributed to an unidentified campaign. Polin Rider malware was also discovered in 13 of 928 repositories…