All news with #north korea nexus tag

🛡️ The U.S. Department of Justice disrupted the Famous Chollima (WageMole) network by charging 14 individuals, arresting two U.S. nationals, and seizing about 187 laptops linked to North Korean remote IT worker schemes. Operation "Lonestar Roundup" involved searches of 40 residences in Texas where facilitators hosted employer-issued devices used to mask DPRK operatives. CrowdStrike has tracked these schemes since April 2025, noting methods like fake theft reports and address rotation to divert shipments. An Ohio indictment describes a scheme from 2019–July 2025 that impacted 70 companies and generated roughly $3 million for the threat actors.

🔒 Bitget has resumed Bitcoin withdrawals after suspending them following a large theft attributed to suspected North Korean state-sponsored hackers. The exchange says it patched the exploited vulnerability and provided a staggered schedule to restore withdrawals for ETH, USDT, and other assets. Bitget emphasized user balances remain intact and that its Protection Fund covers losses while trading and deposits continue to operate. The company also launched a Recovery Bounty Program to incentivize recovery of frozen funds.

🛡️ Bitget confirmed unauthorized transfers from a limited set of hot wallets on September 24, 2026, resulting in a theft of $351.6 million. The exchange says cold wallets and most platform assets remain secure, deposits and trading continue, but withdrawals are temporarily suspended during a comprehensive security review. Bitget has engaged Mandiant and SlowMist for investigation and reports the pattern aligns with known North Korean threat actors.

🔒 Bitget disclosed a major security breach after its systems flagged unauthorized transfers from a limited set of wallets, leading to the theft of approximately $351.6 million from hot and warm wallets. The exchange paused withdrawals and engaged law enforcement, on-chain security firms, and cybersecurity partners including Mandiant and SlowMist to investigate. Bitget said its self-custodial Bitget Wallet and cold wallets remain secure, and the company will cover losses using its User Protection Fund.

🛡️ A joint advisory attributes the long-running Contagious Interview campaign to North Korean-linked actors who have compromised at least 30,000 devices across 100+ countries and stolen from over 7,000 cryptocurrency wallets, totaling at least $10.71 million. The campaign targets developers and crypto specialists by posing as recruiters, using coding tests to deploy malware families like BeaverTail, InvisibleFerret, and RATatouille, then exfiltrating data and credentials. Agencies from Japan, the U.S., Australia, and Germany warn the activity is tied to clusters such as WaterPlum and PurpleDelta, and that the operation leverages laptop farms, enablers, and AI-crafted identities to recruit proxies and bypass sanctions.

🛡️ SentinelOne attributes a campaign by the North Korean-linked group Jade Sleet to the compromise of an India-based IT services provider, using macOS backdoors FLATROOF and ROOFDECK. The attackers employed job-interview and coding project lures with weaponized Terraform lock files to trick developers into fetching malicious modules. FLATROOF uses Telegram for C2 and data theft, while ROOFDECK leverages the Nostr protocol for decentralized C2 and persistent, signed command execution. The incident underscores the growing risk to developer endpoints and supply chain vectors.

🛡️ A joint advisory from Japanese, US, Australian, and German authorities warns that North Korean-affiliated group WaterPlum compromised at least 30,000 devices from December 2025 through July 2026 and transferred over $10.7 million in stolen cryptocurrency to North Korea. The group used malicious npm packages, fake interviews, and recruited remote IT workers to distribute malware and steal credentials, crypto keys, and sensitive data.

🔎 Sekoia and Kudelski Security report that North Korea's long-running Lazarus umbrella has been reorganized into six distinct cyber clusters focused on espionage, financial operations and sanctions evasion. The groups—TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet and Famous Chollima—were identified by TTPs and activity patterns. Researchers note extensive use of fake IT workers, front companies and third-country infrastructure to fund operations and gain access to targets.

🛡️ A previously undocumented Linux toolkit named ted was compiled into trojanized HAProxy binaries on two South Korean hosts, intercepting web traffic and serving altered pages to selected visitors. Rapid7 links the implant with medium confidence to North Korean state actors and identifies victims in the automotive and media sectors. The implant uses specially crafted requests to enter C2 mode, erases its activity from HAProxy counters and returns operator responses over ordinary HTTP headers. Rapid7 shared IoCs and recommended network correlation, memory analysis and binary integrity checks.

🛡️ Researchers report DPRK-linked operators have broadened their employment fraud beyond IT into sales, marketing, and healthcare, using stolen and forged identities, VPNs, and proxy services to secure remote jobs at global firms. Investigations found evidence of PiKVM and USB capture hardware, synthetic personas aided by AI, and coordination via multi-account tools and facilitators who provision laptop farms. Agencies and firms are urged to strengthen identity verification and background checks to detect these sophisticated schemes.

🔒 Wiz researchers linked a recent supply chain attack in the Rust ecosystem to state-sponsored North Korean actors. The campaign compromised maintainer accounts on crates.io to alter manifests and import a typosquatted dependency, allowing malicious build-time code to run during compilation. The backdoor aimed to harvest browser credentials, crypto wallets and developer secrets, affecting widely used crates including arrayref, internment and append-only-vec.

🛡️ Researchers investigated suspected North Korean IT operatives who applied for and secured remote developer roles, revealing forged identities, VPN/VPS infrastructure, and AI-assisted workflows. The FBI is probing a case where a suspected DPRK worker reportedly accessed a U.S. federal agency. The report highlights hiring-stage inconsistencies—document anomalies, interview behavior, and location mismatches—as key warning signs requiring deeper verification and sandboxed validation.

🔍 Security researchers created a fake cryptocurrency startup and hired three individuals they suspect were North Korean operatives. Each new hire completed onboarding, received work virtual machines, and performed reconnaissance while their VMs recorded activity. Analysts found image metadata and a Google SynthID watermark on some documents, and traced infrastructure and tooling patterns consistent with prior North Korean campaigns. The team advises stronger, ongoing identity checks, in-person verification for remote-first firms, and network controls to block known VPN services.

🔍 Amazon tied several high-profile npm supply-chain compromises to the Sapphire Sleet group, attributing trojanized packages like typo-crypto, debug, chalk, and axios to North Korea–linked hackers. The campaign began in March 2025 and escalated into 2026, leveraging social engineering of maintainers to push malicious updates that propagated automatically. Amazon reported medium confidence attribution based on shared TTPs, C2 infrastructure, and operational similarities while noting a likely financial motive and AI-enabled enhancements to attack techniques.

🔒 North Korea's state-trained hackers, long known for stealing from foreign banks and crypto exchanges, are reported to have targeted their own country's central financial institutions. Arrests on 12 July by the National Intelligence Agency allegedly disrupted a scheme to siphon funds from the Chosun Central Bank and the Foreign Trade Bank using encrypted communication and crypto laundering. The suspects are said to be discharged veterans trained by the same military unit behind Lazarus Group, and equipment and phones were seized during raids.

🛡️ Researchers observed North Korea–linked actors behind the Contagious Interview campaign publish 108 unique malicious packages and extensions across npm, Packagist, Go, and Chrome under an operation dubbed PolinRider. The releases include obfuscated JavaScript loaders that append code to common project config files and leverage VS Code task auto-run behavior to execute payloads. Attackers appear to acquire or retain registry and maintainer access via repository compromises, domain takeovers, or malicious dependencies. The campaign has been active since at least 2023 and continues to deliver RATs and stealers through multi-stage blockchain-backed payload delivery.

🛡️ Researchers uncovered a macOS malware family named macOS.Gaslight that embeds fabricated error messages and debugging data inside a Rust binary to mislead AI-assisted analysis tools. The 3.5 KB payload contains 38 fake system messages — including memory dumps, token-expiration warnings, and build errors — designed to appear as legitimate developer logs. SentinelOne attributes the sample with high confidence to a North Korean-linked actor and notes the strings aim to prompt-inject LLM pipelines, causing them to abort or distrust their session. The malware retains standard backdoor and data-stealing capabilities alongside the deceptive messaging tactic.

🛡️ A new Rust-based macOS implant named Gaslight embeds a prompt-injection payload aimed at misleading AI-assisted analysis tools into aborting or refusing to analyze the sample. SentinelOne attributes the tool with high confidence to North Korea–aligned actors and notes its Telegram-based C2 implements an interactive shell with commands like shell, upload, and kill. The implant uses a LaunchAgent for persistence and includes a Base64-encoded Python stealer that harvests browser data, Terminal histories, Keychain contents, and system profiles before compressing and exfiltrating via Telegram.

🛡️ SentinelLabs uncovered a North Korea-linked macOS backdoor, tracked as macOS.Gaslight, that embeds 38 fabricated system messages to manipulate AI-assisted malware triage. The Rust implant carries an infostealer and interactive backdoor that exfiltrates browser data, terminal histories and the macOS login keychain, using Telegram Bot API with certificate pinning for command and control. Researchers noted novel tradecraft including runtime staging of a standalone Python interpreter and self-scrubbing of the Telegram bot token from logs. SentinelLabs warned analysts to treat sample contents as adversarial input and to isolate hostile content from LLM-based tools.

🔐 Microsoft attributed a large-scale npm supply chain attack on the open-source Mastra TypeScript project to North Korea’s Sapphire Sleet group. The threat actor abused a compromised npm maintainer account to publish poisoned packages that disabled TLS verification and contacted attacker C2 servers to deploy cross-platform malware. The payload sought cryptocurrency wallet extensions and performed system reconnaissance, posing a significant risk to developers and downstream users. Microsoft advised auditing dependencies, checking for the malicious easy-day-js package and pinning known-good package versions.