North Korea Archives • Daily CyberSecurity

Amazon Links North Korean Hackers to NPM Supply Chain Attacks North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

Amazon Links North Korean Hackers to NPM Supply Chain Attacks

Do Son August 4, 2026

At a glance Actor DPRK-linked group (Sapphire Sleet, Stardust Chollima, BlueNoroff, UNC1069) Activity NPM supply chain compromise...

Fake Job Interviews Deliver PylangGhost and GolangGhost RATs to Crypto Workers ClickFake Interview campaign delivering PylangGhost RAT and GolangGhost RAT to crypto professionals

ClickFake Interview campaign delivering PylangGhost RAT and GolangGhost RAT to crypto professionals

Fake Job Interviews Deliver PylangGhost and GolangGhost RATs to Crypto Workers

Do Son July 28, 2026

At a glance Threat actor Famous Chollima, also called Wagemole; North Korea-aligned Activity type Social engineering via...

Kimsuky Hacked South Korean Groupware Vendors With New Gomir Variants Kimsuky Gomir variant attack chain showing the DriveTroy backdoor using Google Drive as a covert C2 channel

Kimsuky Gomir variant attack chain showing the DriveTroy backdoor using Google Drive as a covert C2 channel

Kimsuky Hacked South Korean Groupware Vendors With New Gomir Variants

Do Son July 27, 2026

At a glance Actor or group Kimsuky, a North Korea-linked group also tracked as Springtail, Thallium and...

North Korean Contagious Interview Campaign Hides Malware in Fake Coding Tests AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

North Korean Contagious Interview Campaign Hides Malware in Fake Coding Tests

Do Son July 24, 2026

At a glance Actor / group DPRK-aligned group behind the Contagious Interview campaign (Elastic tracks it as...

RokRAT Malware Hides in Fake PDF Files to Spy on Academics APT37 RokRAT malware delivered via fake PDF in Operation Capsule Vault spear-phishing

APT37 RokRAT malware delivered via fake PDF in Operation Capsule Vault spear-phishing

RokRAT Malware Hides in Fake PDF Files to Spy on Academics

Do Son July 17, 2026

At a glance Malware family RokRAT variant (x64) Threat actor Assessed highly likely APT37 (suspected, not confirmed)...

Lazarus-Linked npm Malware Masquerades as Rollup Polyfills Lazarus npm malware masquerading as Rollup polyfill packages in a supply chain attack

Lazarus npm malware masquerading as Rollup polyfill packages in a supply chain attack

Lazarus-Linked npm Malware Masquerades as Rollup Polyfills

Do Son July 3, 2026

At a glance Actor Suspected North Korean Lazarus-linked group (attribution by TTP similarity) Activity npm supply chain...

UNK_DeadDrop Phishing Campaigns Target Developers

UNK_DeadDrop phishing campaigns Contagious Interview, Overlord malware

UNK_DeadDrop Phishing Campaigns Target Developers

Do Son June 16, 2026

In the ever-evolving landscape of cyber warfare, software developers have become prime targets for state-sponsored threat actors....

North Korean “Laptop Farms” Infiltrated 70 U.S. Companies North Korean Laptop Farm DPRK Insider Threat North Korea WMD Cyber Funding, Australia Sanctions Insider threat, North Korean hackers Kimsuky, cyber-espionage NPM Malware, North Korea Cyber-espionage North Korea, Remote IT Job Scam Laptop Farm - DriverEasy - Kimsuky Watering Hole Attack

North Korean Laptop Farm DPRK Insider Threat North Korea WMD Cyber Funding, Australia Sanctions Insider threat, North Korean hackers Kimsuky, cyber-espionage NPM Malware, North Korea Cyber-espionage North Korea, Remote IT Job Scam Laptop Farm - DriverEasy - Kimsuky Watering Hole Attack

North Korean “Laptop Farms” Infiltrated 70 U.S. Companies

Do Son May 8, 2026

The corporate perimeter has been breached, and the threat isn’t coming through an external firewall—it’s sitting on...

The Malware Factory: Unmasking the 108-Package North Korean Siege on npm npm Supply Chain Attack DPRK Malware Factory

The Malware Factory: Unmasking the 108-Package North Korean Siege on npm

Do Son April 29, 2026

Cybersecurity researchers at Panther Threat Research have released a detailed exposé on a massive, coordinated npm malware...

Beyond Gatekeeper: How Sapphire Sleet’s AppleScript Trap Hijacks macOS and Crypto Wallets Sapphire Sleet macOS TCC Bypass Malware

Beyond Gatekeeper: How Sapphire Sleet’s AppleScript Trap Hijacks macOS and Crypto Wallets

Do Son April 21, 2026

In a sophisticated shift away from traditional software exploitation, the North Korean state-sponsored threat actor Sapphire Sleet...

North Korea’s UNC1069 Uses Fake Video Calls to Hijack Crypto UNC1069 Fake Meetings ClickFix Malware

North Korea’s UNC1069 Uses Fake Video Calls to Hijack Crypto

Do Son April 19, 2026

In a sophisticated escalation of cyber-enabled financial theft, security researchers from Validin have unmasked a sprawling campaign...

The “Laptop Farm” Fallout: Two NJ Men Sentenced for Facilitating $5M North Korean Work Scheme Laptop Farm North Korean IT Fraud

The “Laptop Farm” Fallout: Two NJ Men Sentenced for Facilitating $5M North Korean Work Scheme

Do Son April 17, 2026

In what federal prosecutors are calling a sophisticated strike against national security, two New Jersey residents have...

The Invisible Patch: How PolinRider Rewrites Git History to Hide North Korean Malware PolinRider Malware Git History Falsification

The Invisible Patch: How PolinRider Rewrites Git History to Hide North Korean Malware

Do Son April 17, 2026

Security researchers from the OpenSourceMalware (OSM) team have uncovered a massive and rapidly expanding threat campaign targeting...

North Korea’s “OtterCookie” Hides Inside Benign npm Wrappers Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

North Korea’s “OtterCookie” Hides Inside Benign npm Wrappers

Do Son April 16, 2026

A new investigative report from Panther has identified a dangerous cluster of malicious packages lurking within the...

The “Graphalgo” Evolution: How North Korea Built a Fake Florida LLC to Hack Developers Graphalgo Campaign State-Sponsored Phishing

The “Graphalgo” Evolution: How North Korea Built a Fake Florida LLC to Hack Developers

Do Son April 15, 2026

The ReversingLabs (RL) research team has uncovered a sophisticated expansion of the “graphalgo” campaign. Originally identified in...

North Korea’s “Portfolio Model” Shatters Modern Attribution Attribution Resistance DPRK Cyber Portfolio

North Korea’s “Portfolio Model” Shatters Modern Attribution

Do Son April 10, 2026

North Korea’s cyber program has moved past the era of accidental growth into a period of “mature...

North Korean Hackers Pivot to AI: New npm Malware Targets Cursor, Claude, and Gemini Tokens AI Tool Targeting Contagious Interview

North Korean Hackers Pivot to AI: New npm Malware Targets Cursor, Claude, and Gemini Tokens

Do Son April 10, 2026

In a calculated move that signals a new frontier in cyber espionage, North Korean threat actors have...

North Korean State Actors Linked to Massive $285 Million Drift Protocol Heist Drift Protocol Solana DeFi Hack

North Korean State Actors Linked to Massive $285 Million Drift Protocol Heist

Do Son April 8, 2026

On April 1, 2026, the decentralized finance (DeFi) world was rocked as attackers drained approximately USD 285...

The 1,700-Package Blitz: North Korea’s “Contagious Interview” Infiltrates Every Major Dev Registry Contagious Interview Malicious Packages

The 1,700-Package Blitz: North Korea’s “Contagious Interview” Infiltrates Every Major Dev Registry

Do Son April 8, 2026

Researchers at Socket have identified a massive new cluster of malicious packages linked to North Korea’s notorious...

Takedown-Proof: Inside the Ethereum-Powered “EtherRAT” and North Korea’s New Blockchain Backdoor

Do Son April 1, 2026

In a sophisticated blend of social engineering and decentralized technology, eSentire’s Threat Response Unit (TRU) recently detected...

183 Million Targets: Inside the North Korean Supply Chain Strike on Axios and the WAVESHAPER Backdoor axios Supply Chain Attack WAVESHAPER.V2 SnappyBee Malware Salt Typhoon Stately Taurus ScoringMathTea RAT, Lazarus Reflective DLL

axios Supply Chain Attack WAVESHAPER.V2 SnappyBee Malware Salt Typhoon Stately Taurus ScoringMathTea RAT, Lazarus Reflective DLL

183 Million Targets: Inside the North Korean Supply Chain Strike on Axios and the WAVESHAPER Backdoor

Do Son April 1, 2026

The Google Threat Intelligence Group (GTIG) has issued an urgent warning regarding a sophisticated software supply chain...

Infiltrating the Infiltrators: Inside the Florida “Laptop Farm” and the DPRK’s Failed Strike on a Cyber Firm Conceptual network diagram of DPRK scam

Infiltrating the Infiltrators: Inside the Florida “Laptop Farm” and the DPRK’s Failed Strike on a Cyber Firm

Do Son March 30, 2026

In an attempt to infiltrate the cybersecurity industry itself, a suspected North Korean (DPRK) IT worker recently...