Latest North Korea news

Newly exposed APT43 hacking group targeting US orgs since 2018

A new North Korean hacking group has been revealed to be targeting government organizations, academics, and think tanks in the United States, Europe, Japan, and South Korea for the past five years.
- Bill Toulas
- March 28, 2023
- 11:00 AM
- 0
North Korean hackers using Chrome extensions to steal Gmail emails

A joint cybersecurity advisory from the German Federal Office for the Protection of the Constitution (BfV) and the National Intelligence Service of the Republic of Korea (NIS) warn about Kimsuky's use of Chrome extensions to steal target's Gmail emails.
- Bill Toulas
- March 22, 2023
- 11:06 AM
- 0
Security researchers targeted with new malware via job offers on LinkedIn

A suspected North Korean hacking group is targeting security researchers and media organizations in the U.S. and Europe with fake job offers that lead to the deployment of three new, custom malware families.
- Bill Toulas
- March 10, 2023
- 12:48 PM
- 0
New WhiskerSpy malware delivered via trojanized codec installer

Security researchers have discovered a new backdoor called WhiskerSpy used in a campaign from a relatively new advanced threat actor tracked as Earth Kitsune, known for targeting individuals showing an interest in North Korea.
- Bill Toulas
- February 18, 2023
- 10:14 AM
- 0
Norwegian police recover $5.8M crypto from massive Axie Infinity hack

Norwegian police (Økokrim) have seized 60 million kroner ($5,800,000) worth of cryptocurrency stolen by the North Korean Lazarus hacking group last year from Axie Infinity's Ronin Bridge.
- Bill Toulas
- February 17, 2023
- 12:19 PM
- 0
RedEyes hackers use new malware to steal data from Windows, phones

The APT37 threat group (aka 'RedEyes' or 'ScarCruft') has been spotted using a new evasive malware named 'M2RAT' along with steganography to attack specific individuals for intelligence collection.
- Bill Toulas
- February 14, 2023
- 05:37 PM
- 0
Lazarus hackers use new service to hide $100 million in stolen crypto

North Korean hackers have found a way around U.S.-imposed sanctions to launder the cryptocurrency proceeds from their heists, according to evidence discovered by blockchain analysts.
- Ionut Ilascu
- February 13, 2023
- 11:00 AM
- 0
North Korean ransomware attacks on healthcare fund govt operations

A new cybersecurity advisory from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) describes recently observed tactics, techniques, and procedures (TTPs) observed with North Korean ransomware operations against public health and other critical infrastructure sectors.
- Bill Toulas
- February 10, 2023
- 09:35 AM
- 0
North Korean hackers stole research data in two-month-long breach

A new cyber espionage campaign dubbed 'No Pineapple!' has been attributed to the North Korean Lazarus hacking group, allowing the threat actors to stealthily steal 100GB of data from the victim without causing any destruction.
- Bill Toulas
- February 02, 2023
- 12:56 PM
- 0
FBI: North Korean hackers stole $100 million in Harmony crypto hack

The FBI has concluded its investigation on the $100 million worth of ETH heist that hit Harmony Horizon in June 2022 and validated that the hackers responsible for it are the Lazarus group and APT38.
- Bill Toulas
- January 24, 2023
- 09:49 AM
- 0
Google: State hackers still exploiting Internet Explorer zero-days

Google's Threat Analysis Group (TAG) revealed today that a group of North Korean hackers tracked as APT37 exploited a previously unknown Internet Explorer vulnerability (known as a zero-day) to infect South Korean targets with malware.
- Sergiu Gatlan
- December 07, 2022
- 12:20 PM
- 0
Microsoft: Hackers target cryptocurrency firms over Telegram

Microsoft says that cryptocurrency investment companies have been targeted by a threat group it tracks as DEV-0139 via Telegram groups used to communicate with the firms' VIP customers.
- Sergiu Gatlan
- December 06, 2022
- 01:56 PM
- 0
Hackers use new, fake crypto app to breach networks, steal cryptocurrency

The North Korean 'Lazarus' hacking group is linked to a new attack spreading fake cryptocurrency apps under the made-up brand, "BloxHolder," to install the AppleJeus malware for initial access to networks and steal crypto assets.
- Bill Toulas
- December 03, 2022
- 10:12 AM
- 2
New Windows malware also steals data from victims’ mobile phones

Security researchers found a previously unknown backdoor they call Dolphin that's been used by North Korean hackers in highly targeted operations for more than a year to steal files and send them to Google Drive storage.
- Bill Toulas
- November 30, 2022
- 03:51 PM
- 0
North Korean hackers target European orgs with updated malware

North Korean hackers are using a new version of the DTrack backdoor to attack organizations in Europe and Latin America.
- Bill Toulas
- November 15, 2022
- 05:24 PM
- 0
Influencer 'Hushpuppi' gets 11 years in prison for cyber fraud

An Instagram influencer known as 'Hushpuppi' has been sentenced to 11 years in prison for conspiring to launder tens of millions of USD from business email compromise (BEC) scams and various cyber schemes.
- Bill Toulas
- November 08, 2022
- 09:39 AM
- 1
Lazarus hackers abuse Dell driver bug using new FudModule rootkit

The notorious North Korean hacking group 'Lazarus' was seen installing a Windows rootkit that abuses a Dell hardware driver in a Bring Your Own Vulnerable Driver attack.
- Bill Toulas
- October 01, 2022
- 10:05 AM
- 0
Microsoft: Lazarus hackers are weaponizing open-source software

Microsoft says the North Korean-sponsored Lazarus threat group is trojanizing legitimate open-source software and using it to backdoor organizations in many industry sectors, such as technology, defense, and media entertainment.
- Sergiu Gatlan
- September 29, 2022
- 01:33 PM
- 0
Lazarus hackers drop macOS malware via Crypto.com job offers

The North Korean Lazarus hacking group is now using fake 'Crypto.com' job offers to hack developers and artists in the crypto space, likely with a long-term goal of stealing digital assets and cryptocurrency.
- Bill Toulas
- September 27, 2022
- 02:55 PM
- 0
Hackers trojanize PuTTY SSH client to backdoor media company

North Korean hackers are using trojanized versions of the PuTTY SSH client to deploy backdoors on targets' devices as part of a fake Amazon job assessment.
- Bill Toulas
- September 15, 2022
- 04:45 PM
- 7