508 reports
S2W analyzed three malware clusters targeting South Korea that combine legitimate-process abuse, DLL side-loading, encrypted payload staging, and manual PE mapping. Two chains deploy SIGNBT v0.0.1 or v1.2 from service-registry blobs or embedded containers…
South Korean security authorities warn that state-sponsored hacking groups are targeting Korean individuals and companies through phishing emails disguised as resumes, recruitment proposals, donations, or investment materials. The attackers also compromis…
State-sponsored attackers compromised legitimate South Korean websites and inserted exploit code targeting vulnerabilities in locally deployed security software, enabling drive-by malware installation. The recovered chains used ChaCha20 or AES-CBC-128 enc…
A state-backed group exploited vulnerabilities in South Korean financial security software through watering-hole and spear-phishing attacks, installing Struggle (SIGNBT 3.0) and Brandoor (COPPERHEDGE) backdoors. A separate intrusion path used the same vul…
A state-sponsored threat group exploited vulnerabilities in Korean financial security software from 2025 through the first half of 2026, using watering holes and spear phishing to install Struggle (SIGNBT 3.0) and Brandoor (COPPERHEDGE) backdoors. AhnLab …
A search-driven malvertising chain displayed a fake macOS update and used ClickFix instructions to make victims paste a Node.js backdoor command into Terminal. The implant retrieved rotating C2 configuration from Ethereum smart contracts, executed JavaScr…
North Korean actors linked to the Lazarus ecosystem have shifted from destructive and SWIFT-focused operations toward large cryptocurrency thefts that target signing authority, employees, wallet providers, and operational infrastructure. The article highl…
DPRK-aligned operators continued using supply-chain compromise, fraudulent job-interview repositories, cryptocurrency theft, and overseas IT-worker infiltration to generate state revenue. Trend Micro says BlueNoroff compromised the Axios maintainer’s acco…
Amazon Threat Intelligence attributes the typo-crypto, debug, chalk, and axios NPM compromises with medium confidence to a DPRK-linked actor tracked under names including SAPPHIRE SLEET, STARDUST CHOLLIMA, BlueNoroff, CageyChameleon, and Alluring Pisces. …
Two malicious beta releases in the legitimate `@joyfill` npm scope executed an obfuscated loader when applications imported their production bundles. The loader resolved encrypted payloads through two successive Tron-to-BSC transaction chains, selected C2…
WhoisXML API analyzed infrastructure from an APT37 campaign that delivered the Python-based NarwhalRAT through spear-phishing messages and malicious LNK files. The malware supports keylogging, screen capture, USB collection, and remote command execution, …
Malicious prerelease builds of `@joyfill/components` and `@joyfill/layouts` executed an obfuscated Node.js loader when imported, bypassing protections focused on npm installation scripts. The implant used blockchain transactions to resolve later stages, d…
Two Joyfill beta packages contained an import-time JavaScript implant that used Tron, Aptos, and BNB Smart Chain transactions to resolve mutable payloads. The recovered chain delivered a DEV#POPPER Node.js RAT capable of remote command execution, file tra…
Historical WHOIS records, shared DNS infrastructure, exposed documents, product overlap, and linked personas place Hato Tsusin in the same DPRK-connected commercial network as Glocom and Future Tech Group. Glocom was identified by a UN Panel of Experts as…
Compromise of AFX Trade's off-chain validator signing system allowed five signatures to authorize a fraudulent withdrawal of approximately $24.15 million in USDC from its Arbitrum bridge on July 22, 2026. The attacker bridged the assets to Ethereum, conve…