508 reports
An on-chain researcher documented a suspected DPRK IT worker who applied as "Ming Cheng" using the hodlwarden persona and supplied inconsistent employment and location details. The researcher linked the hodlwarden GitHub account to the Contagious Trader c…
Moonlock Lab analyzed an active Contagious Interview chain targeting macOS users with a fake Git helper shell script that downloads a Node.js runner and an obfuscated OtterCookie payload. The payload steals browser passwords and Keychain data, scans files…
A fake Web3 recruiter compromised a cryptocurrency employee through a Google Apps Script assessment that delivered a signed ClickOnce package, two credential stealers, and a persistent Go RAT with hVNC. Exact overlap in an SSL.com signing certificate and …
A suspected North Korean IT worker applying to Ump Labs used questionable names and locations but demonstrated credible blockchain-engineering and smart-contract security knowledge during an undercover interview. Researchers linked his profiles, email add…
The Wall Street Journal used leaked browser histories, emails, calendars, screen recordings, interviews, and previously unseen videos to trace a North Korean remote-worker cell that infiltrated at least eight U.S. companies within months. Thousands of DPR…
Kudelski Security linked a DPRK-associated operator known as Bismarck to gambling administration infrastructure and IP addresses that overlap earlier FakeCalls research. A separate fake IT worker manager held credentials for two systems later associated w…
North Korea is estimated to have stolen at least $2.8 billion in virtual assets between January 2024 and September 2025, with proceeds moving through decentralised services, third-party launderers, OTC and peer-to-peer traders, money mules and guarantee m…
Lazarus expanded Operation Dream Job against defense, aerospace, and aviation organizations by combining fraudulent recruitment lures with trojanized PDF viewers and impersonation websites. The campaign exploited the Windows AFD.sys zero-day CVE-2026-6882…
The FBI is investigating a North Korean remote IT worker recently discovered working for an unidentified U.S. federal agency, although the worker’s role, duration of access, and possible exposure of sensitive data remain unknown. The case extends a fraudu…
Six npm packages delivered an identical JavaScript loader, including three hijacked legitimate packages and three packages published with the malware already embedded. The loader used an Ethereum transaction as a dead drop, decoding command-and-control IP…
Gunra evolved from a Conti-derived ransomware variant first observed in April 2025 into a structured ransomware-as-a-service operation with Windows and Linux encryptors. Its affiliates exploit vulnerable or weakly secured VPN and firewall appliances, stea…
Researchers hired suspected Famous Chollima operatives into a controlled fake DeFi startup and monitored their behavior after onboarding. The workers used forged or stolen identities, mule banking details, remote-access software, AstrillVPN, AI services, …
North Korea combines nationwide network isolation, state-controlled application distribution, persistent device surveillance, cryptographic file restrictions, and physical enforcement to prevent citizens from accessing or sharing outside information. Andr…
BCA LTD, NorthScan, and ANY.RUN recruited DPRK-linked Famous Chollima IT workers into a controlled DeFi company and recorded their activity through monitored Windows sandboxes. The investigation exposed false-identity and facilitator arrangements, remote-…
Genians links Operation GitPower to Kimsuky, which uses spearphishing, malicious LNK files, obfuscated PowerShell, scheduled tasks, and Git repositories to collect system data and deploy encrypted AsyncRAT payloads. Infrastructure logs show the operators …