698 reports
An analyst traced a North Korea-linked JavaScript infection chain that modifies VS Code, Cursor, Discord, GitHub Desktop, and the global npm CLI to relaunch an implanted RAT whenever developers use those tools. The payload, assessed as an updated DEV#POPP…
The DPRK-linked Contagious Interview campaign used NullReceiver in malicious npm packages masquerading as Tailwind CSS plugins. The code recovered C2 IPv4 addresses from the recipient field of zero-value Ethereum transactions sent by a hardcoded wallet, a…
An independent researcher describes a months-long engagement with a person assessed as a suspected DPRK IT worker who used the Jason Kwon and Roy Hensley names and the 0xm00n, hightechrun, and bluesky0309 handles. The author posed as a blockchain-startup …
GhostAction compromised 94 GitHub repositories with a hidden VS Code task that executed a credential stealer disguised as a Font Awesome file and installed a five-minute cron command channel. The launcher closely copied a technique pioneered by North Kore…
North Korea-linked groups concentrated on developers and IT professionals through fake recruitment, technical interviews, coding assignments, malicious LNK files, and GitHub-based delivery. Famous Chollima’s Contagious Interview activity used OtterCookie …
North Korea-linked groups concentrated on developers and IT professionals through fake recruitment, technical interviews, coding assignments, malicious LNK files, and GitHub-based delivery. Famous Chollima’s Contagious Interview activity used OtterCookie …
360 Threat Intelligence Center attributes a multi-path espionage campaign to Kimsuky, with South Korea as the primary target and possible activity against Japanese, Vietnamese, German, and English-speaking users. Operators delivered malicious LNK files di…
The FBI and CrowdStrike disrupted several U.S. laptop farms used by DPRK-nexus adversary FAMOUS CHOLLIMA to place operatives in remote jobs at American companies. Facilitators received employer-issued devices and configured them for remote access, enablin…
The FBI warns that state-controlled North Korean IT workers are expanding their use of U.S. facilitators, distributed laptop farms, stolen identities, and subcontracted labor to obtain and retain remote jobs at Western companies. The workers generate reve…
U.S. authorities charged 14 people, arrested two alleged U.S.-based facilitators, and seized approximately 187 devices while disrupting more than 40 suspected Texas laptop farms supporting North Korean remote IT workers. The workers allegedly used stolen …
DPRK-linked activity accounted for $655,000 in losses during the week. A UNC1069 fake Microsoft Teams call caused a $385,000 loss, while a separate $270,000 seed compromise was suspected to involve DPRK actors. SEAL identified three UNC1069 phishing domai…
Vertex and Team Cymru assessed with high confidence that U.S. residential IP 172.120.254.49 supported the DPRK IT Worker ecosystem. The host exposed HTTP and SOCKS proxy services plus SSH, received connections from Astrill VPN infrastructure including an …
North Korea-linked actors accounted for roughly 95% of the losses in Security Alliance's Q3 2026 assessment, with publicly tracked DPRK-attributed theft exceeding $1 billion for the year. TraderTraitor/UNC4899 was publicly attributed with the Bitget and A…
Kimsuky distributed Funhouse ransomware through a malicious HWP resume that launched a multi-stage chain of batch, VBS, PowerShell, Python, and bitmap-embedded payloads. Quasar RAT served as the final loader for the ransomware, and its configuration, mute…
Kimsuky distributed Funhouse ransomware through a malicious HWP resume that launched a multi-stage chain of batch, VBS, PowerShell, Python, and bitmap-embedded payloads. Quasar RAT served as the final loader for the ransomware, and its configuration, mute…