698 reports
Kimsuky expanded Operation GitPower against Ukrainian foreign-policy, security, and civil-society experts using reply-bait spearphishing that impersonated conference organizers and policy researchers. Follow-on payloads used PDF-disguised LNK files or a f…
Kimsuky expanded Operation GitPower against Ukrainian foreign-policy, security, and civil-society experts using reply-bait spearphishing that impersonated conference organizers and policy researchers. Follow-on payloads used PDF-disguised LNK files or a f…
BlueNoroff, a DPRK-controlled financial threat cluster also tracked as Sapphire Sleet, compromises cryptocurrency executives through fake Zoom and Microsoft Teams meetings. Operators cultivate trusted contacts, reproduce legitimate meeting interfaces, cap…
Zscaler uncovered a July 2026 campaign using a trojanized Terraform provider to execute a Bash loader and deliver FLATROOF and ROOFDECK across macOS, Linux, and Windows. FLATROOF provides persistent command execution and deploys Python stealers for browse…
North Korea-affiliated actors are using poisoned open-source dependencies to steal cloud credentials and establish durable access through developer workstations and CI/CD pipelines. Unit 42 links Alluring Pisces-associated activity across the Axios, Mastr…
A new searchable directory maps North Korean companies, products, contacts, locations, and relationships using ten years of data from *Foreign Trade of the DPRK*. Shared contact information connects 42% of the companies into 57 clusters, including several…
SEAL handled three DPRK cases during the reporting week, including two UNC1069 fake-meeting intrusions that caused no reported losses. A third DPRK case involved a key compromise resulting in an $86,700 loss. Investigators identified seven new high-confid…
OpenSourceMalware reconstructed a DPRK-linked PolinRider compromise of the nestjsx/nest-access-control repository by comparing forged commit metadata with GitHub server events and npm publication records. Malware operating through a victim developer accou…
ZachXBT infiltrated a Chinese laundering network by transacting with an operator using the alias Jimmy Green after the $1.5 billion Bybit exploit attributed to the DPRK-linked TraderTraitor cluster. Addresses and messages supplied by the operator exposed …
An archive of roughly two million Slack messages from 1,236 accounts exposes daily life inside North Korean IT-worker compounds assessed to be in Rason. Workers followed U.S. business hours, lived under screen monitoring, used Astrill and remote-access in…
DPRK-attributed threat actors stole $387 million from Bitget on September 24, 2026, moving the assets through 23 initial transfers across Ethereum, XRP Ledger, Zcash, and Tron. Chainalysis used investigator-directed AI automation to reconcile cross-chain …
SafeDep confirmed PolinRider loaders in 35 GitHub repositories, where frequently executed build and test scripts resolved rotating C2 addresses from Ethereum transactions. Two operator wallets exposed 11 servers, and related infrastructure delivered Node.…
Attackers exploited a zero-day in an unnamed third-party security product, obtained privileged internal access, and moved laterally to Bitget's production wallet job server. A custom withdrawal tool forged risk-control parameters and caused the exchange's…
SlowMist said its investigation of the Bitget hot-wallet theft found prior compromise activity involving two third-party security products and a wallet application host. The investigation recovered a customized withdrawal tool that forged risk-control par…
AhnLab documented six spear-phishing patterns targeting organizations in South Korea during August 2026, with LNK files accounting for the largest share of detected attacks. The chains used PowerShell, AutoIt, scheduled tasks, GitHub-hosted payloads, PubN…