North Korea
-
State-sponsored XenoRAT campaign targets South Korean embassies, researchers say
A Trellix-led analysis describes a multi-phase, state-sponsored XenoRAT espionage campaign targeting South Korean embassies, with links to North Korea’s Kimsuky and indications of possible China-based sponsorship. The operation has conducted at least 19 spearphishing attacks since March, delivering XenoRAT via password-protected ZIP archives and complex, multilingual lures.
-
9GB Data Leak From Alleged North Korean Hacker Surfaces at DEF CON
Two hackers released a 9GB archive reportedly from a North Korean operator during DEF CON, with the material—including logs, credentials, and scripts—made available via DDoSecrets and published on Phrack; the data has been indexed and deemed authentic by researchers, though attribution remains uncertain.
-
U.S. Sanctions North Korean Hacker Linked to Remote IT Worker Fraud Scheme
The U.S. Treasury has sanctioned North Korean hacker Song Kum Hyok for facilitating a fraudulent IT worker scheme targeting American companies. This move highlights concerns over North Korea’s cyber operations as key to generating revenue under international sanctions.
-
North Korean Hackers Target Web3 and Crypto Businesses with Nim-based Malware
North Korean hackers are increasingly targeting Web3 and cryptocurrency sectors with sophisticated Nim-based malware, employing advanced tactics including social engineering and remote process injection techniques to extract sensitive information from compromised systems.
-
U.S. Disrupts North Korean IT Worker Scams Targeting American Firms
The U.S. Department of Justice has successfully disrupted North Korean scams involving fake IT workers who infiltrated over 100 American companies, embezzling significant amounts of money and stealing sensitive data intended for Pyongyang.
-
North Korea-Linked Malicious npm Packages Expose Developers to Security Risks
Cybersecurity researchers have uncovered a new wave of malicious npm packages linked to North Korean threat actors, raising significant concerns for software developers. The covert operation targets job seekers and developers, exposing them to sophisticated supply chain attacks designed to steal sensitive information and compromise systems.
-
North Korean Hackers Target Crypto Job Seekers with Sophisticated Malware Scam
Recent research from Cisco Talos reveals a rise in cyber attacks targeting crypto job seekers, attributed to a North Korea-aligned group known as Famous Chollima, using sophisticated malware disguised as video drivers.
-
North Korean Konni APT Expands Phishing Attacks Targeting Ukraine
Konni APT, a North Korean threat actor, is reportedly conducting a phishing campaign aimed at Ukrainian government entities, signaling a strategic shift in its operations from Russia. The group aims to collect critical intelligence on the ongoing conflict, utilizing sophisticated phishing techniques and malware.
-
North Korean Hackers Expand Malicious Software Distribution via npm
North Korean hackers have expanded their distribution of malicious software through the npm ecosystem, targeting developers with newly identified packages that deploy the BeaverTail malware and a remote access trojan. Security experts warn of the persistent threat posed by this group as they adopt sophisticated methods to evade detection.
