698 reports
PolinRider compromised development branches of the Packagist package `visanduma/nova-two-factor` by hiding an executable loader inside `tailwind.config.js`. The loader derives rotating C2 addresses from Ethereum transaction recipient fields, then download…
Jade Sleet compromised a DevOps engineer at an India-based IT services provider through a fake interview repository whose Terraform lockfile redirected `terraform init` to typosquatted provider registries. FLATROOF and ROOFDECK remained dormant for eleven…
Atlassian attributes Contagious Interview with high confidence to North Korea's Famous Chollima group, citing job-lure tradecraft, BeaverTail, OtterCookie and InvisibleFerret use, infrastructure overlap, and Astrill VPN activity. Hundreds of malicious rep…
SlowMist linked malicious development branches of the Packagist package visanduma/nova-two-factor to PolinRider and found a loader concealed after 507 spaces in tailwind.config.js. Laravel Mix execution queries Ethereum transactions to derive rotating C2 …
Synaptic Security maps Hangro, a North Korean state VPN, email, and real-time chat product derived from SoftEther and distributed to DPRK trade representatives abroad. The research documents a broken 2024 elliptic-curve certificate hierarchy alongside a s…
CloudSEK linked the GHAPPIER loader operation to the DPRK-associated PolinRider campaign after finding a byte-identical loader beside a payload that used PolinRider's published Ethereum dead-drop wallet. The operator compromised developer credentials, mod…
SentinelOne linked an intrusion at an Indian IT services provider to the DPRK-sponsored TraderTraitor group, finding the same FLATROOF and ROOFDECK macOS backdoors previously observed in the LayerZero compromise. Weaponized GitHub coding assignments used …
Japanese, U.S., Australian, and German authorities identify WaterPlum, commonly known as Contagious Interview, as a North Korean cyber actor operating under the 313 General Bureau alongside some DPRK IT workers. The group compromised at least 30,000 devic…
North Korea-linked actors focused on developers, software supply chains, remote hiring, and defense targets during August 2026. Famous Chollima continued PolinRider supply-chain activity and used Ethereum for covert command and control, while Jasper Sleet…
North Korea-linked actors focused on developers, software supply chains, remote hiring, and defense targets during August 2026. Famous Chollima continued PolinRider supply-chain activity and used Ethereum for covert command and control, while Jasper Sleet…
Socket identified PolinRider malware in four development versions of the Packagist package `visanduma/nova-two-factor`, tracing the changes to a compromised GitHub developer account that also accessed private repositories. The North Korea-linked operators…
UNC5342 used public blockchains to deliver credential-stealing malware to cryptocurrency developers targeted through fraudulent job interviews. Chainalysis linked the DPRK operation to a redundant relay in which TRON and Aptos transactions direct infected…
OpenSourceMalware found 11 malicious npm packages delivering WeaselBiscuit, a compact Node.js infostealer that executes an Npoint-hosted payload in memory and communicates with an HTTP C2 at 103.170.217.184:8787. It profiles infected systems, steals Chrom…
Kimsuky, a DPRK state-sponsored espionage group, has expanded its social-engineering arsenal with AI-assisted lure development and QR-code phishing that directs victims to credential-harvesting portals or malicious Android packages. Its August 2026 Operat…
The Multilateral Sanctions Monitoring Team estimates that North Korea deployed 35,600 to 101,280 overseas labourers across at least 17 countries and generated roughly $450 million to $800 million for the DPRK government in 2025. The report documents wage …