554 reports
North Korea places trained software developers in Western remote jobs under stolen or fabricated identities, using their salaries to generate state revenue while gaining access to corporate systems and data. AI-generated application materials, manipulated…
Elastic identified REF9403, a DPRK-aligned Contagious Interview campaign that delivered trojanized coding challenges through fake developer recruitment and concealed payload fragments in SVG flag images. Running the project reconstructed and executed an O…
Kimsuky continued spear-phishing operations in 2026 by impersonating diplomatic personnel and using malicious LNK attachments with diplomatic-themed decoy documents. The infection chains deployed PebbleDash for remote control, PrxClient to relay C2 traffi…
Stealer-log analysis exposed changes in the public and private network infrastructure supporting North Korean fake IT workers, including an apparent route through Russian exit nodes and VPN endpoints in the United States and Japan. Internal records linked…
Consensys hired a consultant using the alias “Tyler Knapp” who was subsequently identified through the company's investigation as connected to North Korea. The consultant contributed to core and mobile MetaMask code, including functionality related to cry…
OpenSourceMalware attributes the ChainVeil and ViteVenom npm supply-chain operations to PolinRider, a North Korean Lazarus Group campaign, based on identical TRON wallets, an Aptos address, XOR keys, campaign markers, and targeting patterns. The blockchai…
OpenSourceMalware identified 2,417 newly compromised repositories in July, bringing PolinRider's confirmed footprint to 4,367 repositories across 2,152 owners—roughly 6.5 times the March count. The source attributes PolinRider to the North Korean Lazarus …
APT-C-26 (Lazarus) added a dedicated keylogging component, KKernel.exe, to a previously observed custom remote desktop surveillance platform. It installs as KKernelService, escapes Session 0 by spawning an agent in the active user session, and restarts th…
Checkmarx identified seven malicious npm packages that impersonated Vite-related scopes and delivered an obfuscated remote-access trojan through Tron, Aptos, and Binance Smart Chain infrastructure. Shared wallets, XOR keys, loader structure, and payloads …
S2W attributes BirdCall to the North Korea-backed ScarCruft group and analyzes an Android spyware sample created by repackaging the legitimate Zangi messenger application. BirdCall uses separate Zoho WorkDrive accounts for command delivery and exfiltratio…
APT37 likely used spearphishing emails impersonating a real academic conference to deliver an ISO containing a PDF-disguised PIF loader. The EMBED_PAYLOAD_v2 loader displayed a legitimate decoy document while decoding shellcode and injecting an x64 RokRAT…
APT37 likely used spearphishing emails impersonating a real academic conference to deliver an ISO containing a PDF-disguised PIF loader. The EMBED_PAYLOAD_v2 loader displayed a legitimate decoy document while decoding shellcode and injecting an x64 RokRAT…
CYFIRMA assesses that Famous Chollima, also known as Lazarus Group, is expanding the PolinRider software supply-chain campaign beyond npm into Go Modules, Packagist, and Chrome extensions. The suspected activity compromises legitimate GitHub repositories …
`nodemon-sudo` v3.1.16 is a malicious npm lookalike that copies legitimate nodemon while adding an unused dependency on `tslint-conf`, a repackaged pino logger containing the backdoor. The payload avoids install hooks and import-time execution; it runs on…
PolinRider, a DPRK-linked Lazarus Group / Contagious Interview supply-chain campaign, expanded from compromised GitHub repositories into Go modules and Packagist packages because those ecosystems publish directly from git repositories and tags. OpenSource…