For nearly two years, researcher Vangelis Stykas has maintained access to North Korean hackers’ servers. His work shows they pulled off intrusions in a shocking number of systems across the globe.

Xctdoor와 과거 CRAT 공격 사례의 연관성 분석 (Larva-26005) ASEC

Two IT graduates trained by the state used smishing texts and fake detention calls to steal savings from donju in Wonsan, sources say.

Analysis of the Connection Between Xctdoor and Past CRAT Attack Cases (Larva-26005) ASEC

생성형 AI로 제작한 미끼 문서와 GitHub·GitLab 기반 C2를 활용하는 김수키(Kimsuky)의 'Operation GitPower' 공격이 포착되었습니다.

Operation GitPower, a Kimsuky campaign, uses AI-generated lure documents and GitHub/GitLab-based C2 infrastructure to deliver malicious payloads.

See what happened after suspected Lazarus-linked IT workers were hired, from forged identities and AI tools to remote access and supporting infrastructure.

Malicious npm packages used Ethereum transactions to retrieve a payload, linking hijacked and newly published packages to DPRK-associated malware activity.

Key Points Introduction Since early 2026, Check Point Research has tracked a wave of the Operation Dream Job campaign. This wave primarily targeted the defense sector worldwide, with a particular emphasis on companies operating in the aerospace and aviation…

North Korea exploits virtual asset-to-fiat conversion to launder stolen cryptocurrency, fuelling WMD programs. The paper offers risk mitigation strategies.

Aug 12, 2026 - Clifford -

Experts say the incident highlights potential gaps in government and industry vetting processes, especially for jobs like IT support work.

Watch how Pyongyang’s scheme to generate $800 million a year works.

North Korean “developers” who are really hackers have stolen an estimated $6 billion in crypto. I interviewed one for a job — and found this one question could put a stop to it all.

Lawsuit accuses North Korea and Lazarus Group of orchestrating the $1.5 billion theft, as court-ordered asset freeze supports recovery efforts and Bybit expands collaboration with law enforcement and industry partners to strengthen accountability for crypto…

Fake Web3 interview campaign delivering signed ClickOnce, NeedleStealer, a Rust stealer, and a Go hVNC RAT on Windows in July 2026.

1/ DPRK's Contagious Interview campaign is still running, the infrastructure is rotating often, and the payload is aimed at Mac users (among others).
We analyzed some stages of OtterCookie chain. The malware increasingly looks like it was written with AI.…

1/ I think I found patient zero for COVID-19.

Meet my latest North Korean applicant @hodlwarden ("Ming Cheng"). Ming had a mysterious 3 year employment gap on his resume from 2018-2021 which initially raised some concerns, but then he explained he was receiving…