Tag: north-korea
-
DPRK ‘IT Workers’ Pivot to Europe for Employment Scams
By using fake references and building connections with recruiters, some North Korean nationals are landing six-figure jobs that replenish DPRK coffers. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/dprk-it-workers-europe-employment
-
North Korean IT Scammers Targeting European Companies
Inside North Korea’s IT Scam Network Now Shifting to Europe. North Koreans posing as remote IT workers have spread to Europe, where one Pyongyang fraudster assumed at least 12 personas to target companies in Germany, Portugal and the United Kingdom. Western companies have grappled for years with the prospect of unintentionally hiring a North Korean…
-
North Korean IT worker scam spreading to Europe after US law enforcement crackdown
North Korea’s IT worker scam has expanded widely into Europe after years of focusing on U.S. companies, according to new research. First seen on therecord.media Jump to article: therecord.media/north-korean-it-worker-scam-spreads-to-europe
-
North Korea’s IT Operatives Are Exploiting Remote Work Globally
The global rise of North Korean IT worker infiltration poses a serious cybersecurity risk”, using fake identities, remote access, and extortion to compromise organizations. The post North Korea’s IT Operatives Are Exploiting Remote Work Globally appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/north-koreas-it-operatives-are-exploiting-remote-work-globally/
-
North Korea IT Workers Expand Their Employment Across Europe To Infiltrate the Company Networks
North Korean IT workers have intensified their global operations, expanding their employment footprint across Europe to infiltrate corporate networks and generate revenue for the regime. According to the latest report by Google Threat Intelligence Group (GTIG), these workers pose as legitimate remote employees, leveraging advanced technical skills and deceptive tactics to gain access to sensitive…
-
Lazarus Uses ClickFix Tactics in Fake Cryptocurrency Job Attacks
North Korea’s Lazarus hackers are using the ClickFix technique for malware deployment in fresh attacks targeting the cryptocurrency ecosystem. The post Lazarus Uses ClickFix Tactics in Fake Cryptocurrency Job Attacks appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/lazarus-uses-clickfix-tactics-in-fake-cryptocurrency-job-attacks/
-
North Korea’s Fake IT Worker Scheme Sets Sights on Europe
Google has found a significant increase in North Korean actors attempting to gain employment as IT workers in European companies, leading to data theft and extortion First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/north-korea-fake-it-worker-europe/
-
North Korean IT workers set their sights on European organizations
Tags: north-koreaNorth Korean IT workers are expanding their efforts beyond the US, and are seeking to fraudulently gain employment with organizations around the world, but most especially in … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/04/02/north-korean-it-workers-target-europe/
-
North Korea’s fake tech workers now targeting European employers
With help from UK operatives, because it’s getting tougher to run the scam in the USA First seen on theregister.com Jump to article: www.theregister.com/2025/04/02/north_korean_fake_techies_target_europe/
-
North Korean IT worker army expands operations in Europe
North Korea’s IT workers have expanded operations beyond the United States and are now increasingly targeting organizations across Europe. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/north-korean-it-worker-army-expands-operations-in-europe/
-
Volume of attacks on network devices shows need to replace end of life devices quickly
Tags: access, apache, attack, authentication, best-practice, breach, cloud, control, credentials, cve, cyber, dns, endpoint, espionage, exploit, firewall, flaw, government, group, Hardware, infrastructure, injection, Internet, ivanti, lazarus, macOS, monitoring, network, north-korea, open-source, password, risk, router, russia, sans, service, software, threat, tool, update, vulnerabilityCVE-2023-1389, a vulnerability in TP-Link Archer AX21 router;CVE-2024-3400, a hole in Palo Alto Networks PAN-OS firewall operating system;CVE-2023-36845, a vulnerability in Juniper Networks Junos OS operating system;CVE-2021-44529, a vulnerability in Ivanti Endpoint Manager Cloud Service Appliance;CVE-2023-38035, a hole in Ivanti Sentry security gateway;CVE-2024-36401, a vulnerability in OSGeo GeoServer;CVE-2024-0012, a vulnerability in Palo Alto Neworks PAN-OS…
-
The North Korea worker problem is bigger than you think
The yearslong scheme goes much deeper than contract work, extending to roles beyond traditional IT and sometimes granting the insider threat “keys to the kingdom,” DTEX President Mohan Koo said. First seen on cyberscoop.com Jump to article: cyberscoop.com/north-korea-technical-workers-full-time-jobs/
-
North Korean hackers adopt ClickFix attacks to target crypto firms
The notorious North Korean Lazarus hacking group has reportedly adopted ‘ClickFix’ tactics to deploy malware targeting job seekers in the cryptocurrency industry, particularly centralized finance (CeFi). First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/north-korean-hackers-adopt-clickfix-attacks-to-target-crypto-firms/
-
DPRK IT Worker Scam: Mitigation Steps for Hiring Teams
Nisos DPRK IT Worker Scam: Mitigation Steps for Hiring Teams Nisos is tracking a network of likely North Korean (DPRK)-affiliated IT workers posing as Singaporean, Turkish, Finish and US nationals with the goal of obtaining employment in remote IT, engineering, and full-stack blockchain positions… First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/03/dprk-it-worker-scam-mitigation-steps-for-hiring-teams/
-
North Korean Kimsuky Hackers Deploy New Tactics and Malicious Scripts in Recent Attacks
Security researchers have uncovered a new attack campaign by the North Korean state-sponsored APT group Kimsuky, also known as >>Black Banshee.
-
Unmasking Kimsuky’s Latest Tactics: A Deep Dive into Malicious Scripts and Payloads
Recently, K7 Labs provided an insightful analysis of a campaign attributed to the North Korean APT group Kimsuky, First seen on securityonline.info Jump to article: securityonline.info/unmasking-kimsukys-latest-tactics-a-deep-dive-into-malicious-scripts-and-payloads/
-
North Korea Launches Military Research Facility to Strengthen Cyber Warfare Operations
North Korea has taken a significant step in enhancing its cyber warfare capabilities by establishing a new research center, known as Research Center 227, under the military’s Reconnaissance General Bureau (RGB). This move is part of a broader strategy to bolster the country’s offensive cyber operations, particularly focusing on AI-powered hacking technologies. Background and Objectives…
-
North Korea launches hacking hub focused on artificial intelligence
First seen on scworld.com Jump to article: www.scworld.com/news/north-korea-launches-hacking-hub-focused-on-artificial-intelligence
-
U.S. Treasury removed sanctions against the crypto mixer service Tornado Cash
The U.S. Treasury is lifting sanctions on Tornado Cash, a crypto mixer accused of helping North Korea’s Lazarus Group launder illicit funds. The U.S. Treasury Department removed sanctions against the cryptocurrency mixer service Tornado Cash. In August 2022, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) sanctioned the crypto mixer service Tornado Cash used by…
-
U.S. Treasury Lifts Tornado Cash Sanctions Amid North Korea Money Laundering Probe
The U.S. Treasury Department has announced that it’s removing sanctions against Tornado Cash, a cryptocurrency mixer service that has been accused of aiding the North Korea-linked Lazarus Group to launder their ill-gotten proceeds.”Based on the Administration’s review of the novel legal and policy issues raised by use of financial sanctions against financial and commercial activity…
-
US removes sanctions against Tornado Cash crypto mixer
The U.S. Department of Treasury announced today that it has removed sanctions against the Tornado Cash cryptocurrency mixer, which North Korean Lazarus hackers used to launder hundreds of millions stolen in multiple crypto heists. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/us-removes-sanctions-against-tornado-cash-crypto-mixer/
-
Künstliche Intelligenz: Nordkorea erforscht KI-gestütztes Hacking
Mit KI-gestützten Technologien will Nordkorea in Echtzeit auf Informationen reagieren und seine Cyberkriegsführung im Ausland verbessern. First seen on golem.de Jump to article: www.golem.de/news/kuenstliche-intelligenz-nordkorea-erforscht-ki-gestuetztes-hacking-2503-194552.html
-
Windows Shortcut-Exploit seit 2017 von staatlichen Hackers als 0-Day genutzt
Sicherheitsforscher der Trend Micro Zero Day Initiative (ZDI) weisen auf eine 0-Day-Schwachstelle ( ZDI-CAN-25373) in Windows hin, die wohl seit 2017 von 11 staatlich unterstützten Hackergruppen aus Nordkorea, Iran, Russland und China ausgenutzt wird. Microsoft hat die Schwachstelle in Verknüpfungsdateien … First seen on borncity.com Jump to article: www.borncity.com/blog/2025/03/20/windows-shortcut-exploit-seit-2017-von-staatlichen-hackers-als-0-day-genutzt/
-
North Korea launches new unit with a focus on AI hacking, per report
North Korea is reportedly launching a new cybersecurity unit called Research Center 227 within its intelligence agency Reconnaissance General Bureau (RGB). © 2025 TechCrunch. All rights reserved. For personal use only. First seen on techcrunch.com Jump to article: techcrunch.com/2025/03/20/north-korea-launches-new-unit-with-a-focus-on-ai-hacking-per-report/
-
North Korean IT Workers Exploit GitHub to Launch Global Cyberattacks
A recent investigation by cybersecurity firm Nisos has uncovered a coordinated effort by North Korean IT workers to exploit GitHub for creating fake personas, enabling them to secure remote jobs in Japan and the United States. These individuals, posing as professionals from countries like Vietnam, Japan, and Singapore, primarily target roles in engineering and blockchain…
-
State-Backed Hackers Exploiting Windows Zero-Day Since 2017
At least 11 state-sponsored hacking groups from North Korea, Iran, Russia, and China have been actively exploiting a newly uncovered Windows zero-day vulnerability in cyber espionage and data theft attacks since 2017. Despite clear evidence of exploitation, Microsoft has declined… First seen on sensorstechforum.com Jump to article: sensorstechforum.com/zdi-can-25373-zero-day-exploited-since-2017/
-
New Windows zero-day feared abused in widespread espionage for years
.The zero-day vulnerability, tracked as ZDI-CAN-25373, has yet to be publicly acknowledged and assigned a CVE-ID by Microsoft. ZDI-CAN-25373 has to do with the way Windows displays the contents of .lnk files, a type of binary file used by Windows to act as a shortcut to a file, folder, or application, through the Windows UI.A…