Do Son North Korean actors launched "Contagious Interview," flooding npm with 338 malicious packages to deliver BeaverTail/InvisibleFerret. The campaign targets Web3 developers via fake job offers.
North Korea
GitLab Threat Intelligence reveals a new North Korean malware campaign using "ClickFix" social engineering to target new industries like crypto and retail.
A new report reveals North Korea's APT37 is using Rust-based malware called Rustonotto, marking a shift toward modern languages and multi-platform attacks.
A new report reveals that the Lazarus Group is actively monitoring CTI platforms to evade detection and sustain a ClickFix phishing campaign against the cryptocurrency sector.
A new report reveals that the North Korean Kimsuky APT is using social engineering on Facebook and Telegram to deliver AppleSeed malware to targets in South Korea.
A new report reveals North Korea's APT-37 is using malicious LNK files in a campaign, "Operation HanKook Phantom," to spy on South Korean government and research.
The U.S. Treasury has sanctioned individuals and entities linked to a North Korean IT worker scheme, which funnels millions of dollars to the regime's weapons programs.
Following a breach tied to an insider, Coinbase is restricting remote work and requiring U.S. citizenship for key roles to combat infiltration by North Korean hackers.
A new report reveals a North Korean espionage campaign targeting embassies with spear phishing and a sophisticated C2 channel hidden on GitHub.
A state-sponsored North Korean hacking group was breached by "ethical" hackers. An 8.9GB archive of tools and stolen data has been leaked online.
S2W TALON exposes ScarCruft (APT37), a North Korean APT using a new campaign disguised as a postal notice, deploying NubSpy and VCD ransomware via PubNub C2.
Veracode warns of a North Korean cyber-espionage campaign using malicious NPM packages to spread Beavertail malware and steal crypto from developers via fake interview tasks.
A new report reveals Kimsuky, a North Korea-linked APT, is using sophisticated LNK files and reflective payloads to infiltrate systems and conduct cyberespionage against South Korean targets.
ShadowSyndicate’s Global Ransomware Empire Blurs Lines Between Cybercrime and Geopolitical Espionage
ShadowSyndicate’s Global Ransomware Empire Blurs Lines Between Cybercrime and Geopolitical Espionage
A new report exposes ShadowSyndicate, a sophisticated cybercrime group tied to top-tier RaaS affiliates, bulletproof hosting, and suspected geopolitical influence operations, blurring lines between cybercrime and espionage.
A DomainTools report exposes how North Korean IT workers use fake IDs, AI, and shell companies to infiltrate remote tech jobs globally, funding the regime's military and compromising corporate infrastructure.
North Korea's Lazarus Group is waging a covert cyberespionage campaign, poisoning 234+ open-source packages on npm/PyPI to steal secrets from CI/CD pipelines and developer environments.
Christina Marie Chapman was sentenced to 8.5 years for facilitating a $17M scheme that allowed North Korean IT operatives to pose as US citizens and secure remote jobs at over 300 US companies.
North Korean APTs are using XORIndex malware in a new npm supply chain attack, infiltrating developers via 67 malicious packages to steal crypto wallets and credentials.
OFAC sanctioned Song Kum Hyok (Andariel) and others for orchestrating North Korea's remote IT worker scheme, which used stolen identities to fund DPRK weapons programs.
North Korean APTs are using "NimDoor," a new Nim-based macOS malware, to target Web3/crypto startups via fake Zoom meetings, stealing browser, Keychain, and Telegram data with novel persistence.
The DOJ dismantled a North Korean scheme exploiting remote IT jobs at 100+ U.S. firms, using stolen identities and laundering millions to fund DPRK weapons programs.
North Korean APT Kimsuky is evolving its ClickFix tactics, using deceptive social engineering, fake job portals, and obfuscated PowerShell to compromise targets via spear-phishing campaigns.