553 reports
BlueNoroff used compromised Telegram accounts belonging to trusted industry contacts to direct cryptocurrency and Web3 personnel into operator-controlled Zoom and Microsoft Teams lures. The kit profiled browser wallets, relayed victims' webcams, displayed…
JUMPSEC recovered source code and malware from a BlueNoroff platform that impersonates Zoom and Microsoft Teams meetings, profiles cryptocurrency wallets, and delivers ClickFix payloads to Windows and macOS victims. Operators approached targets through hi…
Discharged veterans of a North Korean military intelligence cyber unit allegedly recruited elite university-trained IT personnel to breach the Chosun Central Bank and Foreign Trade Bank. The group reportedly diverted state trade funds in small increments,…
AhnLab observed June 2026 domestic APT activity delivered primarily through spear-phishing emails and malicious LNK files, and the source categorizes the analysis under Kimsuky. The documented chains used PowerShell, AutoIt, HTA files, GitHub-hosted paylo…
AhnLab's June 2026 monitoring found that APT attacks in South Korea predominantly began with work-themed spear phishing and malicious LNK files, and the source categorizes the activity under Kimsuky. The observed chains used PowerShell, AutoIt, curl, HTA …
Kimsuky is targeting foreign-affairs personnel with spearphishing lures that execute malicious LNK files and install PebbleDash, PrxClient, RDP tooling, UAC bypass utilities, and a keylogger. PebbleDash provides extensive remote command, file-transfer, pr…
AhnLab contrasts two endpoint-compromise paths observed in South Korea: targeted phishing that launches BAT, executable, VBScript, and PowerShell stages, and watering-hole attacks that exploit locally installed Non-ActiveX security software. The demonstra…
Enki WhiteHat links a series of compromises at South Korean groupware vendors and their customers to Kimsuky, with attackers exploiting server vulnerabilities and spear-phishing employees to establish initial access. The intrusions deployed Gomir, HttpTro…
Sapphire Sleet used a compromised Telegram contact and a fake Microsoft Teams meeting to persuade an ORO team member to run a malicious AppleScript on macOS. The intrusion captured the system password, deployed a browser extension for keylogging, clipboar…
DTEX analyzed records from an exposed internal DPRK payment server containing 390 accounts, chat logs, cryptocurrency transactions, and organizational self-identifications. Workers reported crypto or fiat transfers through luckyguys.site to administrator …
A malicious LNK disguised as a game-character design file launches a multistage PowerShell infection chain that checks the analysis environment and collects system information. The malware generates aes.js at runtime to steal cookies for command-and-contr…
Kimsuky compromised South Korean groupware developers through a mail-server vulnerability and suspected spearphishing, then used stolen internal information and credentials to reach downstream customer systems. The attackers deployed Gomir and HttpTroy al…
Kimsuky compromised South Korean groupware vendors from 2025 through early 2026 through mail-server vulnerability exploitation and likely spear-phishing, then used stolen vendor information to breach downstream customers. ENKI identified BirdTroy and Driv…
Famous Chollima, a North Korean-aligned actor also known as Wagemole, uses fake cryptocurrency and Web3 job interviews to pressure targets into executing clipboard-substituted ClickFix commands. Windows victims receive a Nuitka-compiled PylangGhost RAT, w…
North Korea places trained software developers in Western remote jobs under stolen or fabricated identities, using their salaries to generate state revenue while gaining access to corporate systems and data. AI-generated application materials, manipulated…