Tag: north korea
190 articles
Lazarus Group Exclusive Medusa Strikes Critical Healthcare
Get the inside story on how the Lazarus Group’s Medusa strike rocked critical healthcare—and what it means for patients, providers, and the future of cyber defenses.
Konni Hackers Exclusive AI PS Backdoor Dangerous to Devs
Konni hackers are now using AI to craft convincing developer‑facing PowerShell backdoors that can turn a single compromised laptop into a supply‑chain catastrophe—if you work on builds or CI, now’s the time to harden systems with hardware MFA, reproducible builds, and artifact signing.
QR codes Exclusive Threat: Pyongyang’s Dangerous Phishing
Think twice before you scan: the FBI warns North Korean hackers are using QR-based quishing to turn innocent-looking codes into multi-step traps that steal cloud credentials and bypass enterprise defenses.
QR codes Stunning Pyongyang Phishing Threat
QR codes have gone from handy shortcuts to attack vectors—North Korean actors are using QR-based phishing to steal cloud credentials by hiding multi-step payloads inside seemingly legitimate scans. The real question now isnt whether to scan, but how to verify what the square tells you.
US: Exclusive Five Plead Guilty in Damaging NK IT Fraud
Five people in the U.S. pleaded guilty this year to helping North Korean hackers secure remote IT jobs with American companies — a wake-up call that remote hiring can be manipulated to mask origins, launder pay, and funnel talent and cash back to Pyongyang.
North Korean Hackers Exclusive: Dangerous JSON Channels
What if your next dependency quietly pulled a malicious payload from an innocent-looking JSON? North Korean-linked actors are exploiting public JSON storage services like JSON Keeper, JSONsilo, and npoint.io to seed stealthy backdoors into developer supply chains and swap payloads on the fly to evade detection.
Android Devices Exclusive: KONNI APT Critical Alert
Imagine the smart display on your counter becoming the remote trigger that erases the phone in your pocket — researchers warn a North Korean-linked group called KONNI is abusing Google’s Find My Device and device-management features to remotely wipe Android devices. This tactic can destroy data, break two‑factor access and cripple businesses, a stark reminder that everyday conveniences can be weaponized for sabotage.
Lazarus Group Exclusive: Critical Threat to Europe’s Defense
Who’s stealing Europe’s drone blueprints — and why? Investigators now point to North Korea’s Lazarus Group and Operation DreamJob, a stealthy campaign targeting small defense firms to grab design files, accelerate domestic drone programs, and probe weaknesses in Europe’s nascent “drone wall.”
Lazarus Group Exclusive: Stunning Threat to EU Defense
Europe’s drone industry is being stalked by North Korea’s Lazarus Group, which used fake recruitment DreamJob lures to slip malware into engineers’ inboxes and siphon designs, test data and R&D secrets. The campaign shows how porous modern research networks are—and how cyber espionage can become a direct, strategic threat to EU defence and supply‑chain security.
Lazarus Group Exclusive: Dire Threat to European Defense
Who watches the watchers? Researchers say North Korea’s Lazarus Group—behind Operation “DreamJob”—has quietly infiltrated European drone and counter‑UAS R&D to steal designs, credentials and test data, putting the continent’s push for a layered “drone wall” at real risk of espionage, sabotage and costly setbacks.
Lazarus Group Exclusive: DreamJob Threatens EU Defenses
“If you build it, they will steal it” — North Korea’s Lazarus Group is quietly targeting EU drone engineers, lifting schematics, firmware, and supplier data to speed or sabotage adversaries’ emulation of Western platforms. The result: stolen designs and corrupted files that can derail production and readiness without a single shot fired.
BeaverTail and OtterCookie: Stunning Critical Threat
Cisco Talos warns a North Korean group is fusing BeaverTail’s credential-theft with OtterCookie’s browser persistence into single, stealthier JavaScript malware that’s harder to spot — defenders should start hunting for blended behaviors and tighten basics like MFA, patching, and anomaly detection now.
EtherHiding: Exclusive Risky Crypto Heist Warning
What if the blockchain meant to protect your funds became a hiding place for thieves? Google warns North Korea-linked hackers are using EtherHiding—embedding malware in Ethereum transactions—to siphon crypto, forcing defenders to rethink how they detect and stop attacks.
EtherHiding in smart contracts: Exclusive Critical Threat
Imagine the smart contracts you trust quietly carrying malware — researchers say a North Korean‑linked group used a new EtherHiding trick to embed and trigger malicious payloads in blockchain contracts. Defenders now need to move beyond static code checks and adopt runtime monitoring to stop these covert distribution channels before they steal funds.
North Korean hackers: Stunning $2B Crypto Heist — Alarming
Elliptic reveals North Korean-linked hackers have grabbed a record $2B in crypto this year, using smart hacks and clever laundering to dodge sanctions — a wake-up call about how quickly digital assets can be weaponized. Stronger defenses, better on-ramps and international cooperation are urgently needed to stop the next haul.
malware development: Exclusive Risky AI Abuse Exposed
OpenAI says it disrupted three groups misusing ChatGPT to develop malware — from a Russian actor refining a RAT and credential‑stealer to activity tied to China and North Korea — highlighting how easily generative AI can be repurposed for harm. The takedown bought defenders time, but it also raises urgent questions about policing, policy and how to keep powerful tools useful without arming attackers.
North Korean IT personas: Exclusive Risky Threat Revealed
You won’t believe it until you see it: Okta uncovered convincing fake North Korean IT personas applying, interviewing, and even landing roles across tech, healthcare, finance and AI—using hiring pipelines as a stealthy route for espionage and exploitation. The takeaway: identity is the new perimeter, and companies must tighten onboarding, vetting and access controls before attackers turn routine hiring into a backdoor.
Lazarus Group Exclusive Threat: Risky Malware Surge
Imagine calling tech support and accidentally inviting a nation‑state backdoor into your PC — researchers say North Korea‑linked Lazarus tools are now showing up in everyday tech‑support scams, handing criminals far more powerful, persistent malware. That makes it more important than ever for people and organizations to rethink who they trust and how they secure devices.
AkdoorTea backdoor: Exclusive Dangerous Threat to Devs
A new North Korea-linked campaign called DeceptiveDevelopment is planting a stealthy backdoor, AkdoorTea, in developer environments worldwide—threatening repositories, build systems, and crypto projects across Windows, macOS, and Linux. If you build or maintain crypto or open-source tooling, now’s the time to lock down keys, enforce MFA, and monitor developer endpoints before a single compromised laptop turns into a major breach.
military ID cards: Exclusive Risky AI Forgeries
North Korean-linked hackers are using ChatGPT and image AI to forge photorealistic military IDs and craft highly convincing spear-phishing lures that can fool even seasoned professionals. It’s a wake-up call: stronger verification, cryptographic signing and vigilant cyber-hygiene are now essential to stop AI-enabled deception.
fake military ID: Risky Stunning AI Forgery Threat
Researchers say North Korean operatives used ChatGPT to craft a convincing fake South Korean military ID, showing how generative AI can supercharge social-engineering and produce forgeries that easily fool human reviewers. It’s a wake-up call: organizations need stronger cryptographic identity checks, smarter detection tools, and better staff training so polished prose no longer equals trust.
Lazarus Group Exclusive: Dangerous DeFi RATs Revealed
A North Korea-linked Lazarus campaign used a crafty phishing lure to deploy three cross-platform RATs—PondRAT, ThemeForestRAT and RemotePE—breaching a DeFi organization and highlighting how attackers now tailor stealthy, multi‑OS toolsets to target decentralized finance. It’s a wake-up call: assume breach, tighten access and key protections, and shift to behavior-based detection across heterogeneous environments.
Operation HanKook Phantom: Exclusive Dangerous Threat
When colleagues become targets, South Korea’s academic community is facing a stealthy campaign — Operation HanKook Phantom — where ScarCruft (APT37) uses tailored phishing and the RokRAT trojan to siphon research and influence policy debates. Universities must boost basics like MFA, endpoint protection and phishing training to protect open inquiry without closing it off.
spear-phishing campaign: Risky North Korean Tactic Exposed
North Korea’s APT37 is luring South Koreans with real-looking internal briefings, turning trusted emails into powerful espionage tools — a wake-up call to strengthen MFA, behavior-based detection, and cross‑agency info sharing.