North Korea Archives • Daily CyberSecurity

Kimsuky Spear Phishing Targets Ukrainian Diplomacy and Security Experts in Operation GitPower Kimsuky spear phishing email with fake KCSCON speaker invitation targeting Ukrainian experts in Operation GitPower

Kimsuky spear phishing email with fake KCSCON speaker invitation targeting Ukrainian experts in Operation GitPower

Kimsuky Spear Phishing Targets Ukrainian Diplomacy and Security Experts in Operation GitPower

Do Son October 13, 2026

At a glance Actor Kimsuky, a North Korea-linked threat group (assessed by Genians) Activity Reply-baiting spear phishing,...

Trojanized Terraform provider attack chain linked to suspected TraderTraitor hackers delivering FLATROOF and ROOFDECK malware

Suspected TraderTraitor Hackers Use Trojanized Terraform Provider to Deliver FLATROOF and ROOFDECK

Do Son October 12, 2026

At a glance Actor Suspected TraderTraitor (Jade Sleet, UNC4899, Pressure Chollima, Slow Pisces) Activity Trojanized developer tool...

Konni Launches Operation Conflict Compass Against Ukraine Diagram of Konni Operation Conflict Compass showing the Operation Conflict Compass infection chain

Diagram of Konni Operation Conflict Compass showing the Operation Conflict Compass infection chain

Konni Launches Operation Conflict Compass Against Ukraine

Do Son September 28, 2026

At a Glance Attribute Details Actor or Group Konni (also tracked as TA406 and Opal Sleet; suspected...

The WaterPlum Cyber Actor Group Targets Global IT Professionals A diagram detailing the North Korean WaterPlum cyber actor group infection chain

A diagram detailing the North Korean WaterPlum cyber actor group infection chain

The WaterPlum Cyber Actor Group Targets Global IT Professionals

Do Son September 23, 2026

At a Glance Summary Attribute Details Actor or Group North Korean WaterPlum cyber actor group (Contagious Interview)...

Kimsuky Spear Phishing Abuses Remote Control Tools Kimsuky spear phishing campaigns abusing remote control tools

Kimsuky Spear Phishing Abuses Remote Control Tools

Do Son August 31, 2026

At a glance Actor / Group Kimsuky (suspected North Korea-linked threat actor) Activity Type Spear phishing, email...

Amazon Links North Korean Hackers to NPM Supply Chain Attacks North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

Amazon Links North Korean Hackers to NPM Supply Chain Attacks

Do Son August 4, 2026

At a glance Actor DPRK-linked group (Sapphire Sleet, Stardust Chollima, BlueNoroff, UNC1069) Activity NPM supply chain compromise...

Fake Job Interviews Deliver PylangGhost and GolangGhost RATs to Crypto Workers ClickFake Interview campaign delivering PylangGhost RAT and GolangGhost RAT to crypto professionals

ClickFake Interview campaign delivering PylangGhost RAT and GolangGhost RAT to crypto professionals

Fake Job Interviews Deliver PylangGhost and GolangGhost RATs to Crypto Workers

Do Son July 28, 2026

At a glance Threat actor Famous Chollima, also called Wagemole; North Korea-aligned Activity type Social engineering via...

Kimsuky Hacked South Korean Groupware Vendors With New Gomir Variants Kimsuky Gomir variant attack chain showing the DriveTroy backdoor using Google Drive as a covert C2 channel

Kimsuky Gomir variant attack chain showing the DriveTroy backdoor using Google Drive as a covert C2 channel

Kimsuky Hacked South Korean Groupware Vendors With New Gomir Variants

Do Son July 27, 2026

At a glance Actor or group Kimsuky, a North Korea-linked group also tracked as Springtail, Thallium and...

North Korean Contagious Interview Campaign Hides Malware in Fake Coding Tests AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

North Korean Contagious Interview Campaign Hides Malware in Fake Coding Tests

Do Son July 24, 2026

At a glance Actor / group DPRK-aligned group behind the Contagious Interview campaign (Elastic tracks it as...

RokRAT Malware Hides in Fake PDF Files to Spy on Academics APT37 RokRAT malware delivered via fake PDF in Operation Capsule Vault spear-phishing

APT37 RokRAT malware delivered via fake PDF in Operation Capsule Vault spear-phishing

RokRAT Malware Hides in Fake PDF Files to Spy on Academics

Do Son July 17, 2026

At a glance Malware family RokRAT variant (x64) Threat actor Assessed highly likely APT37 (suspected, not confirmed)...

Lazarus-Linked npm Malware Masquerades as Rollup Polyfills Lazarus npm malware masquerading as Rollup polyfill packages in a supply chain attack

Lazarus npm malware masquerading as Rollup polyfill packages in a supply chain attack

Lazarus-Linked npm Malware Masquerades as Rollup Polyfills

Do Son July 3, 2026

At a glance Actor Suspected North Korean Lazarus-linked group (attribution by TTP similarity) Activity npm supply chain...

UNK_DeadDrop Phishing Campaigns Target Developers

UNK_DeadDrop phishing campaigns Contagious Interview, Overlord malware

UNK_DeadDrop Phishing Campaigns Target Developers

Do Son June 16, 2026

In the ever-evolving landscape of cyber warfare, software developers have become prime targets for state-sponsored threat actors....

North Korean “Laptop Farms” Infiltrated 70 U.S. Companies North Korean Laptop Farm DPRK Insider Threat North Korea WMD Cyber Funding, Australia Sanctions Insider threat, North Korean hackers Kimsuky, cyber-espionage NPM Malware, North Korea Cyber-espionage North Korea, Remote IT Job Scam Laptop Farm - DriverEasy - Kimsuky Watering Hole Attack

North Korean Laptop Farm DPRK Insider Threat North Korea WMD Cyber Funding, Australia Sanctions Insider threat, North Korean hackers Kimsuky, cyber-espionage NPM Malware, North Korea Cyber-espionage North Korea, Remote IT Job Scam Laptop Farm - DriverEasy - Kimsuky Watering Hole Attack

North Korean “Laptop Farms” Infiltrated 70 U.S. Companies

Do Son May 8, 2026

The corporate perimeter has been breached, and the threat isn’t coming through an external firewall—it’s sitting on...

The Malware Factory: Unmasking the 108-Package North Korean Siege on npm npm Supply Chain Attack DPRK Malware Factory

The Malware Factory: Unmasking the 108-Package North Korean Siege on npm

Do Son April 29, 2026

Cybersecurity researchers at Panther Threat Research have released a detailed exposé on a massive, coordinated npm malware...

Beyond Gatekeeper: How Sapphire Sleet’s AppleScript Trap Hijacks macOS and Crypto Wallets Sapphire Sleet macOS TCC Bypass Malware

Beyond Gatekeeper: How Sapphire Sleet’s AppleScript Trap Hijacks macOS and Crypto Wallets

Do Son April 21, 2026

In a sophisticated shift away from traditional software exploitation, the North Korean state-sponsored threat actor Sapphire Sleet...

North Korea’s UNC1069 Uses Fake Video Calls to Hijack Crypto UNC1069 Fake Meetings ClickFix Malware

North Korea’s UNC1069 Uses Fake Video Calls to Hijack Crypto

Do Son April 19, 2026

In a sophisticated escalation of cyber-enabled financial theft, security researchers from Validin have unmasked a sprawling campaign...

The “Laptop Farm” Fallout: Two NJ Men Sentenced for Facilitating $5M North Korean Work Scheme Laptop Farm North Korean IT Fraud

The “Laptop Farm” Fallout: Two NJ Men Sentenced for Facilitating $5M North Korean Work Scheme

Do Son April 17, 2026

In what federal prosecutors are calling a sophisticated strike against national security, two New Jersey residents have...

The Invisible Patch: How PolinRider Rewrites Git History to Hide North Korean Malware PolinRider Malware Git History Falsification

The Invisible Patch: How PolinRider Rewrites Git History to Hide North Korean Malware

Do Son April 17, 2026

Security researchers from the OpenSourceMalware (OSM) team have uncovered a massive and rapidly expanding threat campaign targeting...

North Korea’s “OtterCookie” Hides Inside Benign npm Wrappers Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

North Korea’s “OtterCookie” Hides Inside Benign npm Wrappers

Do Son April 16, 2026

A new investigative report from Panther has identified a dangerous cluster of malicious packages lurking within the...

The “Graphalgo” Evolution: How North Korea Built a Fake Florida LLC to Hack Developers Graphalgo Campaign State-Sponsored Phishing

The “Graphalgo” Evolution: How North Korea Built a Fake Florida LLC to Hack Developers

Do Son April 15, 2026

The ReversingLabs (RL) research team has uncovered a sophisticated expansion of the “graphalgo” campaign. Originally identified in...

North Korea’s “Portfolio Model” Shatters Modern Attribution Attribution Resistance DPRK Cyber Portfolio

North Korea’s “Portfolio Model” Shatters Modern Attribution

Do Son April 10, 2026

North Korea’s cyber program has moved past the era of accidental growth into a period of “mature...

North Korean Hackers Pivot to AI: New npm Malware Targets Cursor, Claude, and Gemini Tokens AI Tool Targeting Contagious Interview

North Korean Hackers Pivot to AI: New npm Malware Targets Cursor, Claude, and Gemini Tokens

Do Son April 10, 2026

In a calculated move that signals a new frontier in cyber espionage, North Korean threat actors have...