593 reports
An unnamed source allegedly provided data from an internal North Korean payment server containing 390 accounts, chat logs, crypto transactions, fake identities, and browser history tied to DPRK IT worker operations. The material describes luckyguys[.]site…
SectorA activity in March 2026 focused heavily on developer and cryptocurrency targets, using LinkedIn-style lures, malicious repositories, Visual Studio Code automation, npm package abuse, and legitimate platforms such as GitHub, Vercel, and Google Drive…
FortiGuard Labs identifies a Kimsuky campaign targeting South Korean organizations through phishing-delivered LNK files that abuse GitHub as command-and-control infrastructure. The LNK files display decoy PDFs while running obfuscated PowerShell that perf…
PhatomCandle tracked EtherRAT distribution through malicious MSI installers disguised as common IT administration tools, with TTP overlap to an APT group suspected of association with the DPRK. The lures targeted administrators and support personnel by sp…
The FBI IC3 2025 report recorded 1,008,597 cybercrime complaints and more than $20.8 billion in reported losses, with cyber-enabled fraud accounting for most losses. Investment fraud, business email compromise, tech support scams, phishing and spoofing, e…
Group-IB traced a DPRK IT worker ecosystem from a previously reported email address to GitHub accounts, portfolio sites, resume materials, freelance platform activity, and archived persona packages that supported fake remote developer identities. The acti…
SEAL attributed 164 blocked domains observed from February to April 2026 to DPRK-nexus UNC1069, also described as BlueNoroff, in campaigns targeting cryptocurrency and Web3 users. The actor conducts patient social engineering over Telegram, LinkedIn, and …
The Korean conference talk by a Zscaler APT researcher focuses on why North Korean cyber attribution is difficult and why analysts should not begin with a fixed actor assumption. The speaker warns that IP addresses, VPNs, reused infrastructure, planted fa…
The Korean KCTI presentation explains how analysts can use OSINT to move beyond lists of Gmail addresses associated with DPRK IT workers and infer who controls or actively uses them. The speaker describes classifying roughly 320 Gmail accounts from a larg…
eSentire reports that two malicious Axios npm versions, 1.14.1 and 0.30.4, were published through a compromised maintainer account and remained live for about three hours. The tampered packages added a malicious dependency that ran a postinstall payload, …
A suspected Kimsuky phishing operation used a Korean Army K-ICTC themed lure to target military, defense, diplomacy, and related research audiences. The victim-facing archive contained a convincing invitation PDF and a PDF-disguised LNK shortcut that down…
A cluster of malicious npm packages published between April 6 and April 9, 2026 delivered OtterCookie variants, described as a credential-theft and backdoor toolchain attributed to North Korean threat actors. The campaign used a two-layer supply-chain pat…
Socket identifies a new cluster in North Korea’s Contagious Interview operation that published malicious packages across npm, PyPI, Go Modules, crates.io, and Packagist. The packages impersonated developer tools while hiding loaders inside ordinary-lookin…
An investigation into the Mentonex GitHub organization found an active npm backdoor chain, fake developer personas, and facilitator-recruitment activity that the author says maps closely to documented DPRK tradecraft. The malicious chain used logkitx, log…
Jason Reaves links NodeJS stealer and backdoor infrastructure to activity resembling DPRK developer-targeting campaigns that use fake interviews or attacker-supplied code repositories. The excerpt shows an npm package, npm-doc-builder, executing a postins…