All news with #north korea nexus tag

🛡️ Researchers report DPRK-linked operators have broadened their employment fraud beyond IT into sales, marketing, and healthcare, using stolen and forged identities, VPNs, and proxy services to secure remote jobs at global firms. Investigations found evidence of PiKVM and USB capture hardware, synthetic personas aided by AI, and coordination via multi-account tools and facilitators who provision laptop farms. Agencies and firms are urged to strengthen identity verification and background checks to detect these sophisticated schemes.

🔒 Wiz researchers linked a recent supply chain attack in the Rust ecosystem to state-sponsored North Korean actors. The campaign compromised maintainer accounts on crates.io to alter manifests and import a typosquatted dependency, allowing malicious build-time code to run during compilation. The backdoor aimed to harvest browser credentials, crypto wallets and developer secrets, affecting widely used crates including arrayref, internment and append-only-vec.

🛡️ Researchers investigated suspected North Korean IT operatives who applied for and secured remote developer roles, revealing forged identities, VPN/VPS infrastructure, and AI-assisted workflows. The FBI is probing a case where a suspected DPRK worker reportedly accessed a U.S. federal agency. The report highlights hiring-stage inconsistencies—document anomalies, interview behavior, and location mismatches—as key warning signs requiring deeper verification and sandboxed validation.

🔍 Security researchers created a fake cryptocurrency startup and hired three individuals they suspect were North Korean operatives. Each new hire completed onboarding, received work virtual machines, and performed reconnaissance while their VMs recorded activity. Analysts found image metadata and a Google SynthID watermark on some documents, and traced infrastructure and tooling patterns consistent with prior North Korean campaigns. The team advises stronger, ongoing identity checks, in-person verification for remote-first firms, and network controls to block known VPN services.

🔍 Amazon tied several high-profile npm supply-chain compromises to the Sapphire Sleet group, attributing trojanized packages like typo-crypto, debug, chalk, and axios to North Korea–linked hackers. The campaign began in March 2025 and escalated into 2026, leveraging social engineering of maintainers to push malicious updates that propagated automatically. Amazon reported medium confidence attribution based on shared TTPs, C2 infrastructure, and operational similarities while noting a likely financial motive and AI-enabled enhancements to attack techniques.

🔒 North Korea's state-trained hackers, long known for stealing from foreign banks and crypto exchanges, are reported to have targeted their own country's central financial institutions. Arrests on 12 July by the National Intelligence Agency allegedly disrupted a scheme to siphon funds from the Chosun Central Bank and the Foreign Trade Bank using encrypted communication and crypto laundering. The suspects are said to be discharged veterans trained by the same military unit behind Lazarus Group, and equipment and phones were seized during raids.

🛡️ Researchers observed North Korea–linked actors behind the Contagious Interview campaign publish 108 unique malicious packages and extensions across npm, Packagist, Go, and Chrome under an operation dubbed PolinRider. The releases include obfuscated JavaScript loaders that append code to common project config files and leverage VS Code task auto-run behavior to execute payloads. Attackers appear to acquire or retain registry and maintainer access via repository compromises, domain takeovers, or malicious dependencies. The campaign has been active since at least 2023 and continues to deliver RATs and stealers through multi-stage blockchain-backed payload delivery.

🛡️ Researchers uncovered a macOS malware family named macOS.Gaslight that embeds fabricated error messages and debugging data inside a Rust binary to mislead AI-assisted analysis tools. The 3.5 KB payload contains 38 fake system messages — including memory dumps, token-expiration warnings, and build errors — designed to appear as legitimate developer logs. SentinelOne attributes the sample with high confidence to a North Korean-linked actor and notes the strings aim to prompt-inject LLM pipelines, causing them to abort or distrust their session. The malware retains standard backdoor and data-stealing capabilities alongside the deceptive messaging tactic.

🛡️ A new Rust-based macOS implant named Gaslight embeds a prompt-injection payload aimed at misleading AI-assisted analysis tools into aborting or refusing to analyze the sample. SentinelOne attributes the tool with high confidence to North Korea–aligned actors and notes its Telegram-based C2 implements an interactive shell with commands like shell, upload, and kill. The implant uses a LaunchAgent for persistence and includes a Base64-encoded Python stealer that harvests browser data, Terminal histories, Keychain contents, and system profiles before compressing and exfiltrating via Telegram.

🛡️ SentinelLabs uncovered a North Korea-linked macOS backdoor, tracked as macOS.Gaslight, that embeds 38 fabricated system messages to manipulate AI-assisted malware triage. The Rust implant carries an infostealer and interactive backdoor that exfiltrates browser data, terminal histories and the macOS login keychain, using Telegram Bot API with certificate pinning for command and control. Researchers noted novel tradecraft including runtime staging of a standalone Python interpreter and self-scrubbing of the Telegram bot token from logs. SentinelLabs warned analysts to treat sample contents as adversarial input and to isolate hostile content from LLM-based tools.

🔐 Microsoft attributed a large-scale npm supply chain attack on the open-source Mastra TypeScript project to North Korea’s Sapphire Sleet group. The threat actor abused a compromised npm maintainer account to publish poisoned packages that disabled TLS verification and contacted attacker C2 servers to deploy cross-platform malware. The payload sought cryptocurrency wallet extensions and performed system reconnaissance, posing a significant risk to developers and downstream users. Microsoft advised auditing dependencies, checking for the malicious easy-day-js package and pinning known-good package versions.

🛡️ Genians Security Center observed North Korea–linked ScarCruft (APT37) sending spear-phishing emails impersonating Microsoft Account security alerts to trick victims into opening ZIP attachments. The archive contains a malicious LNK that triggers a multi-stage chain: batch scripts download a legitimate Python executable, a CAT file, and install NarwhalRAT. Persistence is achieved via scheduled tasks that launch an in-memory payload, enabling keystroke logging, screenshots, audio capture, file exfiltration, and remote command execution.

📄 ESET summarizes notable APT activity observed between October 2025 and March 2026, highlighting China-, Iran-, North Korea-, and Russia-aligned operations alongside unattributed clusters. The report illustrates geopolitical drivers behind campaigns, describes new tooling and supply-chain compromises such as a trojanized axios package, and notes destructive incidents impacting critical infrastructure. ESET confirms protections by its products and notes the report reflects a subset of its Threat Intelligence.

🛡️ New RUSI research warns that adversaries, notably North Korea and Iran, are moving from AI-assisted to AI-enabled sanctions evasion and proliferation financing. The report highlights AI’s ability to mass-produce fraudulent documents, automate shell-company administration, and analyze blockchain flows to evade detection. Experts urge enterprises to adopt behavior-based analytics, defensive AI, stronger identity verification and updated training to counter these evolving threats.

🔐 Three separate April reports describe unrelated threat actors independently targeting developer machines as the preferred initial-access vector. The incidents include a North Korean campaign that trojanized packages across five ecosystems, a Zig-compiled native binary that infects IDEs, and a cascading compromise chaining developer tools into credential theft. Together they illustrate how developer workstations function as credential stores, pipeline controllers and trust anchors, and why traditional endpoint controls are insufficient. Organizations must improve visibility, isolate build environments, enforce stricter controls on IDE extensions and package installs, and assign clear ownership for this distinct attack surface.

🔒 Two U.S. nationals, Matthew Isaac Knoot and Erick Ntekereze Prince, were each sentenced to 18 months in prison for operating laptop farms that enabled North Korean IT workers to fraudulently obtain remote employment at nearly 70 U.S. companies. Authorities say the defendants used stolen identities and remote desktop software to mask foreign workers as U.S.-based employees, resulting in substantial payroll fraud and remediation costs. Courts imposed prison terms, forfeitures, and restitution as part of a broader federal effort to disrupt North Korea's illicit revenue operations.

⚠️ ReversingLabs researchers describe an ongoing supply‑chain campaign called PromptMink that manipulates AI coding agents into installing malicious dependencies. Attackers publish bait packages with persuasive READMEs and LLM‑optimized documentation on registries like NPM and PyPI to increase discovery by autonomous agents and developers. The operation, attributed to North Korea’s Famous Chollima, paired legitimate‑looking SDKs with second‑layer packages carrying infostealers, later evolving to compiled Rust add‑ons, SEAs, SSH backdoors, and project exfiltration.

🔎 A North Korea-aligned espionage group has trojanized Windows and Android clients on a regional Yanbian gaming site, according to ESET. The campaign, attributed to ScarCruft (APT37), delivered an Android port of the BirdCall backdoor (internally named zhuagou) and a trojanized mono.dll on Windows to deploy RokRAT and BirdCall. The malware harvests contacts, SMS, files, screenshots and audio, and routes command-and-control through cloud storage accounts.

⚠️ ESET reports that the North Korea‑aligned threat group ScarCruft compromised the sqgame[.]net gaming platform in a targeted supply‑chain operation to deploy the BirdCall backdoor to Android and Windows users. The compromise, active since late 2024, trojanized Android APKs for two games and delivered a malicious Windows update DLL that used RokRAT as a loader. BirdCall — an evolution of RokRAT — harvests contacts, SMS, call logs, media, screenshots, keystrokes and ambient audio, and leverages legitimate cloud services for command‑and‑control.

📱 ESET researchers report that North Korean-linked APT37 (ScarCruft) developed an Android variant of the BirdCall backdoor and distributed it through trojanized APKs on the sqgame.net game platform. The Android implant, first seen around October 2024 and produced in at least seven variants, collects contacts, call logs, SMS, device identifiers, location and system metrics, takes periodic screenshots, records audio during evening hours, and exfiltrates targeted files to a C2. The campaign focused on users in the Yanbian region and underscores ScarCruft’s continued use of supply-chain tactics; users are advised to download apps only from official marketplaces and trusted publishers.