698 reports
AhnLab observed multiple LNK- and HWP-based spear-phishing chains targeting organizations in South Korea during August 2026. The chains used PowerShell, AutoIt, scheduled tasks, GitHub-hosted payloads, PubNub communications, DLL side-loading, Python backd…
Security Alliance handled two DPRK-related cases during the week, involving a fake Microsoft Teams link and a Telegram account-takeover report, with no reported financial losses. The organization published 11 newly identified domains associated with the D…
North Korean intelligence personnel assigned to diplomatic missions in China allegedly direct surveillance, arrest squads, secret detention, interrogation, and forced repatriation of defectors and other people considered threats to the regime. The brief i…
ZachXBT reported that Chinese illicit actors were seeking operational support in public Discord and Telegram channels while laundering funds from the $387 million Bitget exploit for alleged DPRK attackers. The funds were reportedly chain-hopped through br…
An investigation into a compromised Web3 and fintech GitHub repository found a malicious VS Code workspace task that invoked Node.js on an embedded WOFF2 file carrying an obfuscated JavaScript loader. The loader used an Ethereum wallet as a dead-drop reso…
PolinRider, a DPRK-linked cluster associated with Contagious Interview activity, is testing multiple infection variants across compromised GitHub repositories rather than replacing each build in a linear sequence. An eight-month Binary-Mindz infection inv…
Attackers stole an estimated USD 351.6 million from Bitget’s hot and warm wallets after allegedly compromising a backend system and manipulating transaction data presented to the exchange’s authorization process. The proceeds were divided among fresh wall…
The DPRK-attributed XCTDH campaign added HashHiding, also known as NullReceiver, as an always-on Ethereum channel for recovering its current command-and-control address. Malware decodes an IPv4 address and port from fabricated Ethereum transaction destina…
Elliptic assesses the theft of more than $350 million from Bitget as highly likely to be DPRK-linked, pushing its tracked total of North Korean cryptocurrency theft in 2026 above $1 billion. Attackers reportedly compromised a backend wallet-infrastructure…
Bitget said attackers transferred approximately $387.5 million in assets across Ethereum and other EVM networks, XRP Ledger, Zcash, and TRON after bypassing its security controls. The exchange identified four primary attacker-controlled receiving addresse…
Bitget reported losses across several assets and networks during a September 24 hot-wallet security incident, while confirming that its cold wallets and separately operated Bitget Wallet remained unaffected. Based on IP behavior and on-chain analysis, the…
A DPRK-affiliated IT worker cell used female callers alongside developers to obtain remote technology jobs under fabricated identities. The operation generated more than 1,200 female personas, used stolen U.S. identity data, isolated accounts through ixBr…
Graphalgo malware was distributed through two Terraform providers and two Go modules, using conditional activation to remain inert outside specially crafted runtime conditions. Its Go-based RAT collects host information and receives encrypted commands thr…
Security Alliance observed DPRK operators reactivating intrusions first established six to twelve months earlier and searching retained access for valuable opportunities. DPRK-related incidents caused losses of 1.7 BTC and 14.2 ETH, including a fake Micro…
SOCRadar attributes Operation Conflict Compass to Konni with moderate confidence, linking the campaign to Ukraine-focused espionage through malicious LNK files and trojanized Zoom installers. The infection chain deploys VelvetCake, a lightweight PowerShel…