source_4091.pdf (2 MB)

North Korea-aligned actors continued targeting technology and cryptocurrency companies, software developers, and increasingly Ukraine. Lazarus resumed recruitment-themed attacks against the drone sector, potentially seeking knowledge useful to North Korea’s drone-production capabilities. ScarCruft targeted an African country, while DeceptiveDevelopment shifted from fake interviews to credential theft and software supply-chain compromises that injected malicious code into public and private repositories.