508 reports
Kimsuky, also tracked as APT-C-55 and BabyShark, is described as an espionage-focused actor that targets government, diplomatic, think tank, media, and academic organizations tied to the Korean Peninsula and other regions. The observed campaign begins wit…
APT45 used AI at scale to recursively analyze CVEs and validate proof-of-concept exploits, showing DPRK-linked interest in AI-augmented vulnerability research and exploit development. GTIG also observed PRC and DPRK-associated clusters using persona-drive…
Arkham describes Lazarus Group as a North Korean state-sponsored hacking unit under the Reconnaissance General Bureau with a long record of major cyber operations, including Operation Troy, Sony Pictures, WannaCry, bank thefts, and cryptocurrency exchange…
A recruiter attributed to North Korea offered $300 per month for a US citizen, or $150 for an EU citizen, to create an Upwork account for his use. The pitch included follow-on compensation of 15% of monthly income after four months, with payment offered i…
An attacker attributed by LayerZero to the DPRK drained about $292 million in rsETH from KelpDAO's LayerZero-powered OFT bridge on April 18, 2026. The excerpt says the attacker compromised Unichain RPC infrastructure used by LayerZero Labs' Gasolina DVN s…
A suspected DPRK IT worker allegedly gained employment at THORSwap and submitted eight pull requests to the official swapkit/SwapKit repository between July and September 2024, with at least three merged. The merged PRs changed wallet integration code for…
Genians links this campaign to suspected APT37 activity, describing spearphishing emails that deliver ZIP archives containing malicious LNK files. The lures include airline e-tickets, North Korea research event invitations, and impersonation of defense or…
Genians links this campaign to suspected APT37 activity using spear-phishing emails that deliver ZIP archives containing malicious LNK files. The lures included airline e-ticket confirmations, North Korea research event invitations, and impersonation of d…
LayerZero said the Lazarus Group attacked internal RPCs used by the LayerZero Labs DVN and poisoned their source of truth while an external RPC provider was simultaneously DDoS’d. The protocol itself was described as unaffected, but the incident impacted …
Lazarus Group's Contagious Interview / TaskJacker activity has shifted part of its persistence chain into Git hooks while still using VS Code `task.json` loaders. The episode says observed variants use concatenated Git commands to create `pre-commit` and …
CSIS argues that North Korean cyber operations, alongside activity from China and Russia, are creating a transnational threat environment that current U.S.-ROK cyber cooperation is not yet structured to deter or withstand. The core recommendation is a joi…
Nisos links DPRK IT worker employment fraud to active targeting of cryptocurrency companies, using a suspected operative who applied for a remote Lead AI Architect role as a case study. The investigation tied the applicant to stolen or appropriated U.S. i…
The episode follows a DPRK-linked fake interview in which a malicious contractor-style repository behaved like normal development work until it contacted attacker infrastructure. The lure depended on developer trust in workspaces, dependency installation,…
Red Asgard ties the Hetzner host at 195.201.104.53 to more than BeaverTail FTP exfiltration, showing it also exposed six Express.js services on non-standard ports. Port 21 ran FileZilla Server 1.12.1 with TLS session resumption enforced and held seventy v…
Two U.S. nationals helped DPRK remote IT workers pose as U.S.-based employees by receiving company laptops, hosting them at their residences, and installing remote desktop software for overseas co-conspirators. The Justice Department said the separate sch…