North Korea Archives • Daily CyberSecurity

Lazarus Operation FlashHole Abuses CrossWeb EX and GitHub to Spy on South Korean Firms

Operation FlashHole attack chain used by the Lazarus Group against South Korean firms via CrossWeb EX

Lazarus Operation FlashHole Abuses CrossWeb EX and GitHub to Spy on South Korean Firms

Do Son October 21, 2026

In Operation FlashHole, the Lazarus Group used AI-made lure sites, CrossWeb EX, and GitHub C2 to spy on South Korean firms. Here is how.

DOJ Disrupts DPRK IT Worker Schemes Across More Than 70 US Companies FBI agents seize laptops from DPRK IT worker and DPRK IT worker laptop farms in Texas

FBI agents seize laptops from DPRK IT worker and DPRK IT worker laptop farms in Texas

DOJ Disrupts DPRK IT Worker Schemes Across More Than 70 US Companies

Do Son October 14, 2026

The DOJ and FBI raided DPRK IT worker laptop farms in Texas, seizing 187 devices and charging 14 suspects in a $3M fraud scheme hitting 70+ US firms.

Kimsuky Spear Phishing Targets Ukrainian Diplomacy and Security Experts in Operation GitPower Kimsuky spear phishing email with fake KCSCON speaker invitation targeting Ukrainian experts in Operation GitPower

Kimsuky spear phishing email with fake KCSCON speaker invitation targeting Ukrainian experts in Operation GitPower

Kimsuky Spear Phishing Targets Ukrainian Diplomacy and Security Experts in Operation GitPower

Do Son October 13, 2026

Kimsuky spear phishing lures target Ukrainian security experts with fake invitations, as Operation GitPower abuses GitHub and GitLab.

Suspected TraderTraitor Hackers Use Trojanized Terraform Provider to Deliver FLATROOF and ROOFDECK

Trojanized Terraform provider attack chain linked to suspected TraderTraitor hackers delivering FLATROOF and ROOFDECK malware

Suspected TraderTraitor Hackers Use Trojanized Terraform Provider to Deliver FLATROOF and ROOFDECK

Do Son October 12, 2026

Suspected TraderTraitor hackers used a trojanized Terraform provider to drop FLATROOF and ROOFDECK malware on macOS, Linux, and Windows.

Konni Launches Operation Conflict Compass Against Ukraine Diagram of Konni Operation Conflict Compass showing the Operation Conflict Compass infection chain

Diagram of Konni Operation Conflict Compass showing the Operation Conflict Compass infection chain

Konni Launches Operation Conflict Compass Against Ukraine

Do Son September 28, 2026

SOCRadar uncovered the Konni Operation Conflict Compass campaign targeting Ukraine. Learn how Operation Conflict Compass uses fake PDFs and VelvetCake.

The WaterPlum Cyber Actor Group Targets Global IT Professionals A diagram detailing the North Korean WaterPlum cyber actor group infection chain

A diagram detailing the North Korean WaterPlum cyber actor group infection chain

The WaterPlum Cyber Actor Group Targets Global IT Professionals

Do Son September 23, 2026

Discover how the North Korean WaterPlum cyber actor group uses fake job interviews to steal crypto and infiltrate networks globally.

Kimsuky Spear Phishing Abuses Remote Control Tools Kimsuky spear phishing campaigns abusing remote control tools

Kimsuky Spear Phishing Abuses Remote Control Tools

Do Son August 31, 2026

Recent Kimsuky spear phishing campaigns abuse remote control tools and AI extensions to target victims in Japan and South Korea. Read the full analysis.

Amazon Links North Korean Hackers to NPM Supply Chain Attacks North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

Amazon Links North Korean Hackers to NPM Supply Chain Attacks

Do Son August 4, 2026

Amazon ties North Korean hackers to open-source supply chain attacks on the axios, debug, and chalk NPM packages. Here's how the campaign worked.

Fake Job Interviews Deliver PylangGhost and GolangGhost RATs to Crypto Workers ClickFake Interview campaign delivering PylangGhost RAT and GolangGhost RAT to crypto professionals

ClickFake Interview campaign delivering PylangGhost RAT and GolangGhost RAT to crypto professionals

Fake Job Interviews Deliver PylangGhost and GolangGhost RATs to Crypto Workers

Do Son July 28, 2026

North Korea's ClickFake Interview campaign targets crypto pros with fake skill tests, dropping the PylangGhost RAT on Windows and GolangGhost on macOS.

Kimsuky Hacked South Korean Groupware Vendors With New Gomir Variants Kimsuky Gomir variant attack chain showing the DriveTroy backdoor using Google Drive as a covert C2 channel

Kimsuky Gomir variant attack chain showing the DriveTroy backdoor using Google Drive as a covert C2 channel

Kimsuky Hacked South Korean Groupware Vendors With New Gomir Variants

Do Son July 27, 2026

ENKI WhiteHat traced a Kimsuky Gomir variant into South Korean groupware vendors, plus a new DriveTroy backdoor that hides its C2 in Google Drive.

North Korean Contagious Interview Campaign Hides Malware in Fake Coding Tests AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

North Korean Contagious Interview Campaign Hides Malware in Fake Coding Tests

Do Son July 24, 2026

Elastic found a Contagious Interview campaign using fake coding interviews and SVG steganography to steal developer credentials and crypto wallets.

RokRAT Malware Hides in Fake PDF Files to Spy on Academics APT37 RokRAT malware delivered via fake PDF in Operation Capsule Vault spear-phishing

APT37 RokRAT malware delivered via fake PDF in Operation Capsule Vault spear-phishing

RokRAT Malware Hides in Fake PDF Files to Spy on Academics

Do Son July 17, 2026

Genians exposed Operation Capsule Vault, an APT37 campaign. The RokRAT malware hides inside a fake PDF to spy on academics and researchers.

Lazarus-Linked npm Malware Masquerades as Rollup Polyfills Lazarus npm malware masquerading as Rollup polyfill packages in a supply chain attack

Lazarus npm malware masquerading as Rollup polyfill packages in a supply chain attack

Lazarus-Linked npm Malware Masquerades as Rollup Polyfills

Do Son July 3, 2026

New Lazarus npm malware masquerades as Rollup polyfills, hiding remote-access and wallet-theft payloads. JFrog uncovered six malicious packages.

UNK_DeadDrop Phishing Campaigns Target Developers

UNK_DeadDrop phishing campaigns Contagious Interview, Overlord malware

UNK_DeadDrop Phishing Campaigns Target Developers

Do Son June 16, 2026

UNK_DeadDrop phishing campaigns are targeting developers with fake jobs to deliver Overlord malware. Learn how to defend against this North Korean threat.

North Korean “Laptop Farms” Infiltrated 70 U.S. Companies North Korean Laptop Farm DPRK Insider Threat North Korea WMD Cyber Funding, Australia Sanctions Insider threat, North Korean hackers Kimsuky, cyber-espionage NPM Malware, North Korea Cyber-espionage North Korea, Remote IT Job Scam Laptop Farm - DriverEasy - Kimsuky Watering Hole Attack

North Korean Laptop Farm DPRK Insider Threat North Korea WMD Cyber Funding, Australia Sanctions Insider threat, North Korean hackers Kimsuky, cyber-espionage NPM Malware, North Korea Cyber-espionage North Korea, Remote IT Job Scam Laptop Farm - DriverEasy - Kimsuky Watering Hole Attack

North Korean “Laptop Farms” Infiltrated 70 U.S. Companies

Do Son May 8, 2026

DOJ sentences U.S. enablers for running North Korean "laptop farms." Learn how the DPRK breached 70 companies and funded weapons via stolen identities.

The Malware Factory: Unmasking the 108-Package North Korean Siege on npm npm Supply Chain Attack DPRK Malware Factory

The Malware Factory: Unmasking the 108-Package North Korean Siege on npm

Do Son April 29, 2026

Panther Research exposes a massive 2026 DPRK npm campaign using blockchain dead-drops to steal crypto keys and AI secrets. Secure your CI/CD pipelines now.

Beyond Gatekeeper: How Sapphire Sleet’s AppleScript Trap Hijacks macOS and Crypto Wallets Sapphire Sleet macOS TCC Bypass Malware

Beyond Gatekeeper: How Sapphire Sleet’s AppleScript Trap Hijacks macOS and Crypto Wallets

Do Son April 21, 2026

Microsoft uncovers Sapphire Sleet's macOS campaign. Using fake recruiters and AppleScript, they bypass TCC to steal crypto wallets, Telegram, and SSH keys.

North Korea’s UNC1069 Uses Fake Video Calls to Hijack Crypto UNC1069 Fake Meetings ClickFix Malware

North Korea’s UNC1069 Uses Fake Video Calls to Hijack Crypto

Do Son April 19, 2026

North Korea's UNC1069 uses fake video calls and "ClickFix" prompts to drain crypto assets and record victims for deepfakes. Audit your meetings now!

The “Laptop Farm” Fallout: Two NJ Men Sentenced for Facilitating $5M North Korean Work Scheme Laptop Farm North Korean IT Fraud

The “Laptop Farm” Fallout: Two NJ Men Sentenced for Facilitating $5M North Korean Work Scheme

Do Son April 17, 2026

Two NJ residents sentenced for running a "laptop farm" allowing North Korean workers to infiltrate 100+ U.S. companies and steal $5M in revenue.

The Invisible Patch: How PolinRider Rewrites Git History to Hide North Korean Malware PolinRider Malware Git History Falsification

The Invisible Patch: How PolinRider Rewrites Git History to Hide North Korean Malware

Do Son April 17, 2026

PolinRider targets 1,900+ GitHub repos using "history-falsification" to hide malware. DPRK's Lazarus Group uses fake job tests to breach developers.

North Korea’s “OtterCookie” Hides Inside Benign npm Wrappers Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

North Korea’s “OtterCookie” Hides Inside Benign npm Wrappers

Do Son April 16, 2026

Panther uncovers "OtterCookie," a North Korean npm campaign hiding malware in benign wrappers. It steals crypto wallets and installs SSH backdoors. Audit now!

The “Graphalgo” Evolution: How North Korea Built a Fake Florida LLC to Hack Developers Graphalgo Campaign State-Sponsored Phishing

The “Graphalgo” Evolution: How North Korea Built a Fake Florida LLC to Hack Developers

Do Son April 15, 2026

North Korea’s "graphalgo" campaign uses fake job interviews and real Florida LLCs to infect developers. Learn how to spot this sophisticated state-sponsored trap.