Tag: korea
-
FBI raids 40+ laptop farms helping North Korea pocket US tech salaries
North Korean IT workers used stolen and fabricated identities to land remote jobs at more than 70 US companies, with help from Americans who allegedly kept company-issued … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/14/north-korean-it-workers-laptop-farms-arrests/
-
North Korea Phishes Ukrainians for War Intel
The Democratic People’s Republic of Korea (DPRK) is trying to get insight into its own war effort in Ukraine, through simple reply-baiting phishing attacks. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/north-korea-phishes-ukrainians-war-intel
-
Kimsuky Uses Fake Zoom Installers and Malicious LNK Files to Deploy Malware
Tags: cyber, espionage, group, international, korea, malicious, malware, north-korea, phishing, powershell, spear-phishing, ukraine, windowsNorth Korea-linked cyber espionage group Kimsuky has expanded its Operation GitPower campaign by using fake Zoom installers and malicious Windows shortcut files to target Ukrainian experts working in diplomacy, security, and international policy. Researchers at Genians Security Center found that the campaign combines reply-baiting spear phishing, PDF-themed LNK files, public code-hosting platforms, hidden PowerShell execution,…
-
Hackers target two South Korean megachurches, potentially exposing congregant data
Two of South Korea’s largest Protestant churches are investigating cyberattacks that may have exposed sensitive information about hundreds of thousands of members, including personal details, financial records and internal documents. First seen on therecord.media Jump to article: therecord.media/south-korea-hackers-megachurches
-
ChainDrop and PolinRider Use Blockchain C2 to Steal Cloud and CI/CD Credentials
Tags: access, blockchain, cloud, control, credentials, cyber, endpoint, infrastructure, korea, network, north-korea, open-source, service, threat, wormThreat actors are increasingly using blockchain networks as resilient command-and-control infrastructure to steal cloud credentials from developer endpoints and CI/CD environments. Recent campaigns involving the ChainDrop npm worm and the North Korea-linked PolinRider operation show how poisoned open-source packages can harvest short-lived cloud tokens, service-account credentials, deployment secrets, and source-code access tokens while resolving attacker…
-
South Korean President Orders Probe After Financial Data Breaches
South Korea’s president ordered a financial-sector probe after breaches hit major banks and lenders, exposing customer data and raising questions about AI-assisted attacks. The post South Korean President Orders Probe After Financial Data Breaches appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-south-korean-president-financial-data-breach-probe-apac/
-
South Korea Suspects AI Tool Helped Steal Bank Customer Data
Attack Servers Show Signs Open-Source Penetration Testing Tool Artex Employed. Police in South Korea probing data breaches at multiple banks have found signs on attack servers that the threat actor used a free, open-source and semi-automated penetration testing tool called Artex AI to help steal data pertaining to more than 60,000 individuals. First seen on…
-
Hackers Use ERP Web Shell and IDOR Flaws to Breach Major South Korean Churches
Attackers breached two of South Korea’s largest churches through distinct intrusion chains, combining an ERP web shell, privileged database access, leaked credentials, and broken authorization controls. Oasis Security’s analysis of attacker-server files documents extensive collection of congregant, employee, financial, and administrative information across both organizations. Its findings describe recovered attacker artifacts, rather than a complete…
-
Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan
Linux backdoors targeting telecom and network appliances in South Korea and Taiwan have been disguising their traffic as email services and seemingly legitimate processes to blend in and evade detection.Threat actors are known to name their malicious software after a legitimate operating system component or a process as a defense evasion measure. By borrowing the…
-
Researcher Infiltrates Chinese Crime Syndicate Laundering Crypto for Lazarus Group
Tags: blockchain, breach, china, crime, crypto, cyber, exploit, group, intelligence, korea, lazarus, north-korea, organizedBlockchain investigator ZachXBT has revealed that he infiltrated a Chinese organized crime syndicate believed to have laundered over $1 billion through cryptocurrency exploits linked to North Korea’s Lazarus Group. In a disclosure on October 5, 2026, he said he posed as a customer to gather intelligence that helped freeze stolen assets and link criminal conversations…
-
South Korea probes bank breaches amid suspected AI-powered attacks
South Korea’s Financial Services Commission (FSC) held an emergency meeting following a series of cyberattacks targeting financial institutions in the country. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/south-korea-probes-bank-breaches-amid-suspected-ai-powered-attacks/
-
South Korea probes bank breaches amid suspected AI-powered attacks
South Korea’s Financial Services Commission (FSC) held an emergency meeting following a series of cyberattacks targeting financial institutions in the country. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/south-korea-probes-bank-breaches-amid-suspected-ai-powered-attacks/
-
New Stealthy Linux Backdoors Target Telecoms, Masquerade as Email Traffic
Rapid7 has uncovered new BPFDoor, BPF Rekoobe and AVERAT malware variants targeting telecom and network-edge appliances in South Korea and Taiwan First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/smtp-linux-backdoors-network-edge/
-
South Korea Orders Investigation Into AI-Powered Cyberattacks on Major Banks
South Korean President Lee Jae Myung has ordered a comprehensive investigation into a series of data breaches impacting major banks and other financial institutions. Concerns have been raised that attackers may have utilized AI-enabled offensive security tools. These incidents have prompted emergency regulatory action and a sector-wide effort to strengthen defenses against increasingly automated intrusions.…
-
Crypto CEO accuses North Korea of stealing $387 million from Bitget platform
The CEO said the company has a User Protection Fund that has over $464 million and those funds will be used to cover the losses. First seen on therecord.media Jump to article: therecord.media/crypto-ceo-accuses-north-korea-of-387-million-theft
-
The Cyber Express Weekly Roundup: ShinyHunters’ FBI Breach Claim, North Korea’s WaterPlum Campaign, and the EU KIDS Act
Tags: access, advisory, ai, application-security, breach, crypto, cyber, korea, malware, north-koreaThis weekly roundup covers a brazen breach claim against the FBI’s recruitment portal, a multinational advisory exposing North Korea’s fake-recruiter malware operation, a sweeping EU proposal to reshape children’s access to social media, a conversation on application security in the age of AI agents, a short-lived Discord ban in the Philippines, and a multimillion-dollar hot-wallet…
-
Bitget Confirms $351.6 Million Hack, Suspects North Korea’s Lazarus Group
Bitget confirms a $351.6 million theft, suspends withdrawals and says North Korea’s Lazarus Group may be involved as investigators examine the breach in detail. First seen on hackread.com Jump to article: hackread.com/bitget-hack-suspects-north-korea-lazarus-group/
-
Bitget Confirms $351.6 Million Hack, Suspects North Korea’s Lazarus Group
Bitget confirms a $351.6 million theft, suspends withdrawals and says North Korea’s Lazarus Group may be involved as investigators examine the breach in detail. First seen on hackread.com Jump to article: hackread.com/bitget-hack-suspects-north-korea-lazarus-group/
-
Cryptohack Roundup: US Sanctions BitBank
Also: South Korea Books 26 Polymarket Users for Alleged Illegal Gambling. This week, the United States sanctioned Iranian exchange BitBank, South Korea booked 26 Polymarket users and Polymarket faced $10 million fraud attempt. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/cryptohack-roundup-us-sanctions-bitbank-a-32914
-
Operation Conflict Compass Deploys VelvetCake PowerShell Malware Through Malicious LNK Files
Tags: cyber, cyberespionage, intelligence, korea, malicious, malware, north-korea, powershell, russia, threat, ukraine, windowsNorth Korea-linked threat actor Konni has launched a targeted cyberespionage operation against Ukraine-focused entities using malicious Windows shortcut files disguised as PDF documents. The campaign, tracked by SOCRadar Threat Research Unit as Operation Conflict Compass, deploys a modular PowerShell malware family dubbed VelvetCake to collect intelligence on the Russia-Ukraine war. The activity appears designed to…
-
Contagious Interview: 30,000 devices infected by a fake job interview
North Korea-linked WaterPlum runs the Contagious Interview campaign, infecting over 30,000 devices using a fake job interview. On September 18, Japan’s National Police Agency, the FBI, the US Department of Defense’s Cyber Crime Center, and intelligence agencies from Australia and Germany published a joint advisory about a group called WaterPlum, better known as Contagious Interview.…
-
North Korea’s job interview scam runs both ways
Attackers are targeting members of the Rust Project and maintainers of widely used crates (Rust code libraries), dangling attractive opportunities to compromise their devices … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/21/north-korean-hackers-contagious-interview-defenses/
-
North Korea’s Hangro VPN Certificate Exposes Internal Network and Russia-Linked Infrastructure
North Korea’s Hangro VPN and mail platform has deployed a new certificate hierarchy that exposes an apparent cross-border management environment spanning systems in Pyongyang and Russia’s Far East. The certificate’s Subject Alternative Name field lists the platform’s publicly exposed servers alongside a carrier-grade NAT address, offering an unusual glimpse into how the service may be…
-
Hackers Weaponize Terraform Lock Files to Infect DevOps Engineers With macOS Backdoors
North Korea-linked threat actor TraderTraitor has expanded its developer-focused intrusion activity beyond cryptocurrency targets, using weaponized Terraform lock files in fake job-interview repositories to infect DevOps engineers with macOS backdoors. SentinelOne identified an Indian IT services provider compromised with the same FLATROOF and ROOFDECK implants previously linked to the April 2026 KelpDAO-LayerZero attack. The campaign…
-
Nations take action on North Korean IT workers after UN report
A report published Wednesday said that as of July, Vietnam, Laos, Pakistan and Argentina took meaningful steps to respond to allegations involving North Korea listed in an October study. First seen on therecord.media Jump to article: therecord.media/nations-take-action-on-north-korean-it-worker-schemes
-
WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage
Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit.The new malware family, per OpenSourceMalware, exhibits functional overlaps with two malware strains associated with the Democratic People’s Republic of Korea’s (DPRK) Contagious Interview campaign: BeaverTail and First seen on thehackernews.com Jump to…
-
Breach Roundup: China Calls for Stronger AI Oversight
Also, Spain’s First AI Agent-Linked Data Breach, NightmareStresser Domains Seized. This week: a call for stronger AI oversight in China, an AI agent-linked breach in Spain, Cisco active exploits, Check Point patched flaws. NightmareStresser seized – again! South Korea data breach fines, AI made BEC attacks worse. An Android Trojan, an exploited Pixel flaw and…
-
North Korea-linked Hackers Hide a Backdoor Inside HAProxy
North Korea-linked hackers hid a backdoor inside HAProxy, masking C2 traffic and stealing data while keeping the load balancer working normally. North Korean-linked hackers found a genuinely clever hiding spot for their malware: inside the actual source code of HAProxy, the load balancing software running at the edge of two South Korean companies’ networks. Rapid7’s…
-
North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters
Sekoia and Kudelski Security have observed that North Korea’s Lazarus umbrella is split into six distinct clusters, focused on espionage, financial theft and sanctions evasion First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/north-korea-lazarus-six-cyber/