Tag: korea
-
Lazarus Deploys RemotePE Memory-Only RAT Against Financial and Crypto Firms
Cybersecurity researchers have shed light on a cross-platform malware called RemotePE that has been put to use by the North Korea-linked Lazarus Group in attacks targeting financial and cryptocurrency organizations.RemotePE, per NCC Group subsidiary Fox-IT, is part of a multi-stage attack chain that involves two loaders tracked as DPAPILoader and RemotePELoader.”DPAPILoader decrypts and First seen…
-
Kimsuky Uses LNK, JSE Lures to Target Recruiters, Crypto Users, Defense Officials
Kimsuky Hackers Use LNK and JSE Lures to Target Recruiters, Crypto Users, and Defense Officials. North Korea-linked threat group Kimsuky has launched at least four distinct spear-phishing campaigns in early 2026, targeting recruiters, cryptocurrency users, developers, defense personnel, and academic administrators. Despite using different themes and delivery methods, all campaigns follow a consistent attack chain:…
-
Can Laws Stop Deepfakes? South Korea Aims to Find Out
South Korea’s local elections next month will be a test bed for how effective regulations might be to stymie the flow of deepfakes. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/can-laws-stop-deepfakes-south-korea
-
Cryptohack Roundup: Bitcoin Core Reveals High-Severity Flaw
Also: TrustedVolumes, Wasabi Protocol and Ekubo Hacks. This week, Bitcoin Core revealed a memory safety flaw, hackers exploited TrustedVolumes, Wasabi Protocol and Ekubo, Bithumb suspension paused, sentencing in U.S. theft case, prosecutors seek 20-year sentence for Delio CEO and North Korea denied that it’s a thief. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/cryptohack-roundup-bitcoin-core-reveals-high-severity-flaw-a-31625
-
Americans sentenced for running ‘laptop farms’ for North Korea
Two U.S. nationals were sentenced to 18 months in prison each for operating so-called laptop farms that helped North Korean IT workers fraudulently obtain remote employment at nearly 70 American companies. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/americans-sentenced-for-running-laptop-farms-for-north-korea/
-
ScarCruft Targets Gaming Platform With Windows, Android Backdoors
A sophisticated multiplatform supply-chain attack orchestrated by the North Korea-aligned APT group ScarCruft, targeting ethnic Koreans in China’s Yanbian region through a compromised gaming platform. The attack, believed to have been ongoing since late 2024, weaponized both Windows and Android components of sqgame[.]net, a video game platform that hosts traditional Yanbian-themed card and board games.…
-
ScarCruft Hacks Gaming Platform to Deploy BirdCall Malware on Android and Windows
The North Korea-aligned state-sponsored hacking group known as ScarCruft has compromised a video game platform in a supply chain espionage attack, trojanizing its components with a backdoor called BirdCallto likely target ethnic Koreans residing in China.While prior versions of the backdoor have primarily targeted Windows users only, the supply chain attack is assessed to have…
-
North Korea’s Enormous Crypto Hacks Redefine Scale and Strategy
A pair of tightly executed cyberattacks have become milestones in cryptocurrency theft in 2026 due to their sheer size. These two incidents, targeting Drift Protocol and KelpDAO, account for roughly three quarters of all recorded crypto losses through April, revealing a shift toward fewer, higher-dollar operations. Based on a report from TRM Labs, security researchers..…
-
ISMG Editors: North Korea’s Fake Meetings Fuel Crypto Heists
Also: Google’s $40B AI Bet, Insights From Google Next Conference. In this week’s panel, four ISMG editors discussed North Korea’s use of fake video meetings to fuel crypto fraud, Google’s $40 billion investment in Anthropic and what it signals for the AI race, and key takeaways from Google Next in Las Vegas on enterprise AI…
-
76% of All Crypto Stolen in 2026 Is Now in North Korea
North Korean threat actors are pulling off historic cryptocurrency heists on a yearly, sometimes weekly basis now. AI might be helping them. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-analytics/crypto-stolen-2026-north-korea
-
Cryptohack Roundup: North Korea Steals Bulk of Crypto So Far
Also: Cartier Heir Imprisoned, Believe Founder Benjamin Pasternak Arrested. This week, North Korea hacks, Cartier heir jailed, Believe founder arrested, Cambodia scam network sanctioned. A U.S. Army soldier’s insider bet, Litecoin, sentences in laundering and romance fraud cases, France probed crypto kidnapping. Tennessee banned crypto ATMs, Kelp DAO and Alex Mashinsky. First seen on govinfosecurity.com…
-
ODNI to CISOs on threat assessments: You’re on your own
Tags: access, ai, china, ciso, computer, control, credentials, cyber, cybercrime, data, defense, detection, disinformation, encryption, finance, framework, government, healthcare, identity, infrastructure, intelligence, iran, jobs, korea, metric, resilience, risk, russia, service, strategy, technology, theft, threat, tool, warfareThe bifurcated framework: Operational reporting vs. homeland focus: The report now operates on two distinct tracks that risk narrowing the threat horizon for CROs. In a departure from traditional probabilistic forecasting, the IC has transitioned toward active operational reporting. This shift prioritizes immediate success metrics, such as a significant drop in border encounters and fentanyl…
-
ODNI to CISOs on threat assessments: You’re on your own
Tags: access, ai, china, ciso, computer, control, credentials, cyber, cybercrime, data, defense, detection, disinformation, encryption, finance, framework, government, healthcare, identity, infrastructure, intelligence, iran, jobs, korea, metric, resilience, risk, russia, service, strategy, technology, theft, threat, tool, warfareThe bifurcated framework: Operational reporting vs. homeland focus: The report now operates on two distinct tracks that risk narrowing the threat horizon for CROs. In a departure from traditional probabilistic forecasting, the IC has transitioned toward active operational reporting. This shift prioritizes immediate success metrics, such as a significant drop in border encounters and fentanyl…
-
CISA adds Microsoft, ConnectWise vulnerabilities to active exploitation catalog
Russia has used one of the flaws, security experts said, while North Korea has used the other. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-microsoft-connectwise-kev-update/818817/
-
CISA adds Microsoft, ConnectWise vulnerabilities to active exploitation catalog
Russia has used one of the flaws, security experts said, while North Korea has used the other. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-microsoft-connectwise-kev-update/818817/
-
CISA adds Microsoft, ConnectWise vulnerabilities to active exploitation catalog
Russia has used one of the flaws, security experts said, while North Korea has used the other. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisa-microsoft-connectwise-kev-update/818817/
-
North Korea’s Lazarus Targets macOS Users via ClickFix
Lazarus continues leveraging ClickFix for initial access and data theft, in this case, against Mac-centric organizations and their high-value leaders. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/north-koreas-lazarus-targets-macos-users-clickfix
-
Lazarus Lures Developers With Backdoored Coding Tests
North Korea-linked hackers are using AI-assisted malware and backdoored coding challenges to quietly loot millions in cryptocurrency from Web3 developers. Expel assesses with high confidence that HexagonalRodent is a DPRK state-sponsored subgroup that likely evolved from fraudulent IT worker operations before pivoting fully to malware-driven theft. In just three months, the group exfiltrated data from…
-
Tropic Trooper Uses Custom Beacon and VS Code Tunnels for Stealthy Remote Access
A new Tropic Trooper campaign that combines a trojanized PDF reader, a custom AdaptixC2 Beacon listener, and Visual Studio (VS) Code tunnels to gain and maintain remote access to targeted systems. The operation appears to focus on Chinese-speaking individuals in Taiwan, as well as victims in South Korea and Japan. It is attributed to Tropic…
-
Tropic Trooper Pivots to AdaptixC2 and Custom Beacon Listener
IntroductionOn March 12, 2026, Zscaler ThreatLabz discovered a malicious ZIP archive containing military-themed document lures targeting Chinese-speaking individuals. Our analysis of this sample uncovered a campaign leveraging a multi-stage attack chain where a trojanized SumatraPDF reader deploys an AdaptixC2 Beacon agent, ultimately leading to the download and abuse of Visual Studio (VS) Code tunnels for…
-
North Korea Stole 100,000 Identities to Infiltrate Global Companies
Here Is What That Looks Like From an Investigator’s Perspective. The DPRK remote IT worker scheme is not a cybersecurity problem. It is an identity fraud problem at state scale. The tools that can detect and attribute it are the same tools built for investigating threat actors, not screening job applicants. Research published in March……
-
North Korea Blamed for $290m KelpDAO Crypto Heist
North Korea’s Lazarus Group is pegged for a $290m crypto theft at KelpDAO First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/north-korean-blamed-290m-kelpdao/
-
Mustang Panda Hits India and S. Korea with Updated LOTUSLITE Backdoor
Acronis reveals Mustang Panda is using a new LOTUSLITE backdoor to target Indian banks and Korean diplomats. Learn how this DLL sideloading attack works. First seen on hackread.com Jump to article: hackread.com/mustang-panda-india-s-korea-lotuslite-backdoor/
-
Tencent’s QClaw AI agent app arrives on Windows and macOS
Tencent has opened an international beta of QClaw, an AI agent application aimed at consumers in Canada, Japan, Singapore, South Korea, and the United States. The first wave … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/04/22/tencent-qclaw-ai-agent-windows-macos/
-
Mustang Panda’s New LOTUSLITE Variant Targets India Banks, South Korea Policy Circles
Cybersecurity researchers have discovered a new variant of a known malware called LOTUSLITE that’s distributed via a theme related to India’s banking sector.”The backdoor communicates with a dynamic DNS-based command-and-control server over HTTPS and supports remote shell access, file operations, and session management, indicating a continued espionage-focused capability set rather than First seen on thehackernews.com…
-
South Korea Expands AI Cybersecurity to Safeguard Cloud-Based Education Systems
South Korea is stepping up its digital defenses for kids by expanding the reach of AI-powered cybersecurity systems, with a particular focus on private cloud environments used for teaching and learning. The Ministry of Education, working alongside the Korea Education and Research Information Service (KERIS), announced a series of upgrades designed to strengthen protection across…