North Korean APT

The Friend Request from Pyongyang: How APT37 Hijacks Facebook to Deploy RokRAT

• Cybercriminals

The Friend Request from Pyongyang: How APT37 Hijacks Facebook to Deploy RokRAT

Do Son April 15, 2026 0

APT37 pivots to Facebook social engineering, using Wondershare PDFelement "code caves" to deploy RokRAT. Learn how they bypass EDR with memory-only payloads.

Microsoft Exposes How Hackers Use Generative Models as a Force Multiplier

• Cybercriminals

Microsoft Exposes How Hackers Use Generative Models as a Force Multiplier

Do Son March 11, 2026 0

Microsoft Threat Intelligence reveals how cybercriminals and North Korean APTs are weaponizing generative AI to scale attacks and poison AI assistants.

North Korean APT Unleashes DEV#POPPER RAT via GitHub to Drain Crypto Wallets

• Malware

North Korean APT Unleashes DEV#POPPER RAT via GitHub to Drain Crypto Wallets

Do Son March 11, 2026 0

eSentire exposes DEV#POPPER, a North Korean RAT hiding in GitHub repos. It uses blockchain to deploy OmniStealer, targeting crypto and dev secrets.

Bridging the Gap: North Korean APT37 Deploys ‘Ruby Jumper’ to Infiltrate Isolated Air-Gapped Networks

• Malware

Bridging the Gap: North Korean APT37 Deploys ‘Ruby Jumper’ to Infiltrate Isolated Air-Gapped Networks

Do Son March 3, 2026 0

Zscaler unmasked APT37's "Ruby Jumper" campaign, which uses weaponized USBs and cloud services to bypass network isolation and steal data from air-gapped systems.

Kimsuky Group Leverages RDP Wrapper for Persistent Cyber Espionage

• Cyber Security
• Malware

Kimsuky Group Leverages RDP Wrapper for Persistent Cyber Espionage

Do Son February 6, 2025 0

Uncover the tactics used by the North Korean APT group Kimsuky in their cyber espionage operations, including the use of the RDP Wrapper for persistent access.

North Korean APT Group Kimsuky Exploits DMARC Misconfigurations for Sophisticated Phishing Attacks

• Cyber Security
• Vulnerability

North Korean APT Group Kimsuky Exploits DMARC Misconfigurations for Sophisticated Phishing Attacks

Do Son October 7, 2024 0

Learn about the risks of DMARC misconfigurations and how they can be exploited by cybercriminals in spear-phishing campaigns.

CVE-2024-7971: North Korean APT Citrine Sleet Exploits Chromium Zero-Day

• Cyber Security
• Malware
• Vulnerability

CVE-2024-7971: North Korean APT Citrine Sleet Exploits Chromium Zero-Day

Do Son August 30, 2024 0

Discover the latest cybersecurity threat: Citrine Sleet. Learn how this North Korean actor exploited a zero-day vulnerability in Chromium browsers.

North Korean APT’s Stealth Attack on Open-Source Ecosystems

• Malware
• Vulnerability

North Korean APT’s Stealth Attack on Open-Source Ecosystems

Do Son January 7, 2024 0

QiAnXin Threat Intelligence Center's detailed analysis linked the binary involved in this operation to a North Korean APT