Tag: north-korea-nexus
18 entries tagged north-korea-nexus, latest activity first.
- Bitget: an attacker compromised two third-party security appliances, moved laterally to the wallet job server and stole $388M in one of 2026's largest crypto-exchange hacks
- WaterPlum ("Contagious Interview"): a seven-agency joint advisory counts 30,000+ devices in 100+ countries and $10.7M in crypto from December 2025 to July 2026, and discloses Japan's first dismantled "laptop farm"
- Sekoia and Kudelski Security split the 'Lazarus umbrella' into six named DPRK clusters, and document two of them adopting commodity ransomware-as-a-service within two months of each other
- PurpleDelta: Insikt Group gets inside a North Korean IT-worker operation and finds the detectable half is on the endpoint, a second remote-management tool on the company laptop, and a device whose location never matches the login
- Switzerland's federal cyber authority reports the public sector as still the largest share of mandatory critical-infrastructure notifications, and devotes its half-year report to two things a Swiss defender can act on: the anatomy of the Polish energy sabotage, and a crypto-theft playbook that recruits its victims on LinkedIn
- A hijacked crates.io account added the first dependency arrayref has taken in ten years, and that dependency ran a backdoor at compile time; every machine that built an affected project during a ninety-minute window must be treated as compromised
- Amazon attributes the axios, debug and chalk npm compromises to a DPRK-linked cluster with medium confidence, and names a small 2025 package compromise as the rehearsal
- Contagious Interview (DPRK) hides an OTTERCOOKIE-aligned payload in SVG-comment steganography inside fake coding-interview repos
- macOS.Gaslight, a DPRK-aligned Rust backdoor that targets the LLM-assisted analyst
- Mastra npm supply-chain compromise (easy-day-js)
- ScarCruft (APT37) delivers NarwhalRAT behind fake Microsoft OTP "security alert" lures
- DPRK UNK_DeadDrop weaponises VS Code / Cursor auto-run to hit developers, including EU targets
- CrowdStrike 2026 Technology Threat Landscape Report: technology is now the most-targeted sector
- Kimsuky (Velvet Chollima) deploys HTTPSpy RAT and Rust-based HelloDoor via VS Code Remote Tunnel and Cloudflare Quick Tunnel C2
- ESET APT Activity Report Q4 2025–Q1 2026: Sandworm strikes NATO energy, Lazarus targets EU drone sector, UNC5221 pivots to Ivanti SPAWN toolset
- Lazarus "RemotePE": a three-stage memory-only RAT that unhooks EDR and blinds ETW
- Kaspersky: Kimsuky adds Rust-based HelloDoor and httpMalice to its PebbleDash toolkit and takes over hosts through VSCode tunnels and DWAgent
- GTIG AI Threat Tracker (May 2026): an AI-developed zero-day 2FA bypass prepared for mass exploitation, AI decoy code in Russia-nexus malware and PROMPTSPY's Gemini agent