553 reports
A state-backed group exploited vulnerabilities in South Korean financial security software through watering-hole and spear-phishing attacks, installing Struggle (SIGNBT 3.0) and Brandoor (COPPERHEDGE) backdoors. A separate intrusion path used the same vul…
A state-sponsored threat group exploited vulnerabilities in Korean financial security software from 2025 through the first half of 2026, using watering holes and spear phishing to install Struggle (SIGNBT 3.0) and Brandoor (COPPERHEDGE) backdoors. AhnLab …
A search-driven malvertising chain displayed a fake macOS update and used ClickFix instructions to make victims paste a Node.js backdoor command into Terminal. The implant retrieved rotating C2 configuration from Ethereum smart contracts, executed JavaScr…
North Korean actors linked to the Lazarus ecosystem have shifted from destructive and SWIFT-focused operations toward large cryptocurrency thefts that target signing authority, employees, wallet providers, and operational infrastructure. The article highl…
DPRK-aligned operators continued using supply-chain compromise, fraudulent job-interview repositories, cryptocurrency theft, and overseas IT-worker infiltration to generate state revenue. Trend Micro says BlueNoroff compromised the Axios maintainer’s acco…
Amazon Threat Intelligence attributes the typo-crypto, debug, chalk, and axios NPM compromises with medium confidence to a DPRK-linked actor tracked under names including SAPPHIRE SLEET, STARDUST CHOLLIMA, BlueNoroff, CageyChameleon, and Alluring Pisces. …
Two malicious beta releases in the legitimate `@joyfill` npm scope executed an obfuscated loader when applications imported their production bundles. The loader resolved encrypted payloads through two successive Tron-to-BSC transaction chains, selected C2…
Two Joyfill npm prereleases published on 2026-07-28 contained an obfuscated DEV#POPPER-family RAT that executed when applications imported the packages, bypassing protections focused on npm install scripts. The implant obtained rotating command-and-contro…
WhoisXML API analyzed infrastructure from an APT37 campaign that delivered the Python-based NarwhalRAT through spear-phishing messages and malicious LNK files. The malware supports keylogging, screen capture, USB collection, and remote command execution, …
Malicious prerelease builds of `@joyfill/components` and `@joyfill/layouts` executed an obfuscated Node.js loader when imported, bypassing protections focused on npm installation scripts. The implant used blockchain transactions to resolve later stages, d…
Two Joyfill beta packages contained an import-time JavaScript implant that used Tron, Aptos, and BNB Smart Chain transactions to resolve mutable payloads. The recovered chain delivered a DEV#POPPER Node.js RAT capable of remote command execution, file tra…
Historical WHOIS records, shared DNS infrastructure, exposed documents, product overlap, and linked personas place Hato Tsusin in the same DPRK-connected commercial network as Glocom and Future Tech Group. Glocom was identified by a UN Panel of Experts as…
Compromise of AFX Trade's off-chain validator signing system allowed five signatures to authorize a fraudulent withdrawal of approximately $24.15 million in USDC from its Arbitrum bridge on July 22, 2026. The attacker bridged the assets to Ethereum, conve…
An attacker stole assets from AFX's custody bridge after compromising a developer through a malicious repository shared over Telegram. The intrusion spread into AFX's JFrog environment, where a malicious Groovy plugin and modified system components mainta…
Google Threat Intelligence Group’s unified actor-naming system will assign North Korea-attributed threat clusters the category word NEPTUNE as the second element of a two-word cryptonym. The first word will uniquely identify the tracked actor, while the s…