508 reports
Krypt3ia assesses that North Korean cyber operations have shifted from separate espionage, financial theft, and disruptive tracks into an interconnected access-generation ecosystem. The report links fraudulent remote IT-worker schemes, developer-targeting…
Bitso described another suspected North Korean Chollima job applicant who attempted to interview for an engineering role under the claimed identity of Camilo Andrés Pantoja from Colombia. During the call, a Canary Token link exposed that the applicant con…
OpenSourceMalware found three malicious npm packages linked to the March 2026 Axios compromise through the shared XOR key OrDeR_7077, while using separate C2 infrastructure at 18.208.244.120:9999. The packages redeem-onchain-sdk, nicegui, and period-newli…
Attackers are sharpening established methods rather than abandoning them, using offensive tooling, infostealers, ransomware affiliates, social engineering, and trusted-platform abuse with greater speed and resilience. Bridewell highlights adversary infras…
A DPRK-linked TraderTraitor/UNC4899 actor stole 116,500 rsETH, worth about $292 million, from the KelpDAO rsETH bridge on April 18, 2026. The intrusion began with social engineering against a LayerZero Labs developer on March 6, enabling session-key theft…
DPRK-linked Contagious Interview activity is targeting cryptocurrency developers and blockchain companies through fake job interviews, poisoned GitHub repositories, and malicious npm packages. The report describes a multi-stage infection chain that abuses…
Red Asgard identifies OtterCookie as a separate JavaScript and Node.js RAT operating alongside BeaverTail and InvisibleFerret in Lazarus-linked Contagious Interview activity. Unlike BeaverTail’s stored-data theft model, OtterCookie uses Socket.IO over Eng…
NorthScan links Beejern, an active Oklahoma LLC, to a suspected DPRK IT worker network through GitHub identity cycling, DPRK-associated developer personas, exposed Beejern credentials, and reused company infrastructure. The GoldenDev321 account previously…
Logpresso analyzed four Kimsuky spear-phishing campaigns from early 2026 that used tailored lures against recruiters, business contacts, healthcare and insurance entities, cryptocurrency users and developers, defense-related personnel, and graduate-progra…
The episode examines the operator side of a Lazarus-attributed fake interview credential pipeline. The collection system reportedly captured material from operator workstations as well as targets, exposing social-engineering workflow, persona infrastructu…
Kimsuky has expanded its PebbleDash and AppleSeed-related operations with newly documented tooling, including the Rust-based HelloDoor backdoor, httpMalice, MemLoad/httpTroy, AppleSeed, HappyDoor, VSCode Remote Tunneling, and DWAgent. The campaigns use sp…
Krypt3ia assesses that enterprise AI systems are becoming high-value operational infrastructure because they ingest sensitive data, connect to internal workflows, and increasingly act with delegated authority. The North Korea-focused section argues that D…
CrowdStrike reports that DPRK-nexus actors drove a 51% year-over-year increase in digital asset theft in 2025, stealing a reported $2.02 billion across the financial sector. PRESSURE CHOLLIMA allegedly conducted the largest reported financial theft, takin…
Hybrid Analysis identified a VELVET CHOLLIMA-assessed infostealer operation distributing a signed Windows MSI that masquerades as the Tralert FX cryptocurrency trading application. The installer exposed live credentials and GitLab access tokens, revealing…
OpenSourceMalware shows how malicious packages and repositories abuse legitimate developer automation so payloads can run during `npm install` or when a repository is opened in VS Code. The DPRK-relevant section notes Lazarus-linked Contagious Interview a…