Unmasking DPRK Cyber Threat Actors: Fake IT Worker Infrastructure

Team Cymru examines infrastructure tied to DPRK-linked fake IT worker activity after ZachXBT connected luckyguys[.]site to related cryptocurrency payments. The domain resolved to 163.245.219[.]19, where network telemetry showed concentrated Astrill, Mullv…

North Korea Stole $7.5 Billion From Crypto. Here's Their Playbook.

QuillAudits frames Lazarus Group's cryptocurrency theft as an industrialized DPRK state capability, estimating more than $7.5 billion stolen through social engineering, insider-style access, UI poisoning, laundering infrastructure, and off-chain verificat…

KelpDAO Hacker Moving Funds: Attacker Transfers $175M to New Addresses

Arkham tracked the suspected Lazarus Group-linked KelpDAO attacker moving 76,000 ETH, worth about $175 million, from the $292 million theft into new on-chain addresses. The movement followed containment on Arbitrum, where about $71 million in stolen ETH l…

A Third Vultr Seoul Box: 60+ Kimsuky Domains, 18 Months of DDNS Rotation, and a 5-Year Infrastructure Trail

Breakglass Intelligence attributes 158.247.210.58, a Vultr Seoul VPS, to the same Kimsuky-aligned infrastructure cluster as two previously documented Vultr Seoul systems. Passive DNS showed more than 60 domains over an 18-month window, with 31 still resol…

Void Dokkaebi Uses Fake Job Interview Lure to Spread Malware via Code Repositories

Trend Micro found Void Dokkaebi, also tracked as Famous Chollima, turning fake recruiter interviews into a worm-like supply chain campaign against software developers. Victims are lured into cloning repositories that abuse VS Code folder-open tasks, and c…

Detection strategies across cloud and identities against infiltrating IT workers

Microsoft describes how Jasper Sleet, a North Korea-aligned fraudulent IT worker operation, exploits remote hiring workflows to gain trusted organizational access. The actors use stolen or fabricated identities, AI-assisted personas, and role-specific app…

New Lazarus APT Campaign: “Mach-O Man” macOS Malware Kit Hits Businesses

ANY.RUN attributes an active ClickFix-style macOS campaign to Lazarus Group, with fake meeting lures delivered through Telegram and impersonated Zoom, Teams, or Google Meet pages. Victims are instructed to run terminal commands that install the Go-based M…

SlowMist on Kelp DAO × LayerZero Systemic Risk

SlowMist frames the Kelp DAO rsETH and LayerZero incident as a cascading DeFi failure involving liquid restaking tokens, cross-chain bridge verification, and lending-protocol collateral assumptions. The interview says LayerZero attributed the attack to La…

How a Single LayerZero DVN Compromise Drained $292M from KelpDAO

A forged LayerZero message authenticated by KelpDAO's sole configured DVN caused its Ethereum OFTAdapter to release 116,500 rsETH, worth about $292 million, on April 18, 2026. The token, adapter, and LayerZero on-chain contracts operated as designed; the …

Initial Takeaways on LayerZero DVN Security Incident

Security Alliance reports that DPRK-linked actors stole 116,500 rsETH on April 18, 2026 by fraudulently triggering an attestation from the LayerZero DVN configured as the sole validator for the Kelp DAO OApp. Kelp blocked the attacker within about an hour…

April 18 Incident: Additional Context

Kelp says rsETH was drained on April 18 through a forged cross-chain message after two LayerZero-hosted RPC nodes were compromised and a third RPC node was hit by a simultaneous DDoS attack. The statement frames the incident as an attack on LayerZero infr…

Supply Chain Compromise Impacts Axios Node Package Manager

CISA warns that compromised Axios npm releases [email protected] and [email protected] injected the malicious dependency [email protected] into developer environments. The dependency downloads multi-stage payloads from actor-controlled infrastructure, including…

Inside the computers of DPRK IT workers

NoxHunt uses infostealer telemetry and ZachXBT’s prior findings to examine compromised systems tied to suspected DPRK overseas IT worker operations. The activity centers on fraudulent remote development work supported by VPN obfuscation, fake identities a…

KelpDAO Incident Statement

KelpDAO’s April 18, 2026 exploit involved about $290 million in losses and is described as likely attributable to DPRK’s Lazarus Group, specifically TraderTraitor. The incident was isolated to KelpDAO’s rsETH configuration because it used a 1-of-1 LayerZe…

KelpDAO Exploit Explained: How It Happened & How to Prevent It

Web3Firewall analyzes the reported 2026 KelpDAO exploit as a cross-chain DeFi infrastructure incident affecting rsETH bridge operations rather than a simple standalone smart-contract bug or phishing case. The article says the attack caused roughly $290–29…