Tag: north-korea
-
North Korean spies turn Google’s Find Hub into remote-wipe weapon
KONNI espionage crew covertly abused Google’s Find My Device feature to remotely factory-reset Android phones First seen on theregister.com Jump to article: www.theregister.com/2025/11/11/north_korean_spies_turn_googles/
-
Android Devices Targeted By KONNI APT in Find Hub Exploitation
A new cyber-attack has been observed exploiting Google Find Hub to remotely wipe Android devices, linked to North Korean APTs First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/android-devices-targeted-konni-apt/
-
North Korea-linked Konni APT used Google Find Hub to erase data and spy on defectors
North Korea-linked APT Konni posed as counselors to steal data and wipe Android phones via Google Find Hub in Sept 2025. Genians Security Center researchers warn that the North Korea-linked Konni APT group (aka Kimsuky, Earth Imp, TA406, Thallium, Vedalia, and Velvet Chollima) posed as counselors to hack Android and Windows, stealing data and wiping phones…
-
North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices
The post North Korea’s KONNI APT Hijacks Google Find Hub to Remotely Wipe and Track South Korean Android Devices appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/north-koreas-konni-apt-hijacks-google-find-hub-to-remotely-wipe-and-track-south-korean-android-devices/
-
APT37 hackers abuse Google Find Hub in Android data-wiping attacks
North Korean hackers from the KONNI activity cluster are abusing Google’s Find Hub tool to track their targets’ GPS positions and trigger remote factory resets of Android devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/apt37-hackers-abuse-google-find-hub-in-android-data-wiping-attacks/
-
APT37 hackers abuse Google Find Hub in Android data-wiping attacks
North Korean hackers from the KONNI activity cluster are abusing Google’s Find Hub tool to track their targets’ GPS positions and trigger remote factory resets of Android devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/apt37-hackers-abuse-google-find-hub-in-android-data-wiping-attacks/
-
Konni Hackers Turn Google’s Find Hub into a Remote Data-Wiping Weapon
The North Korea-affiliated threat actor known as Konni (aka Earth Imp, Opal Sleet, Osmium, TA406, and Vedalia) has been attributed to a new set of attacks targeting both Android and Windows devices for data theft and remote control.”Attackers impersonated psychological counselors and North Korean human rights activists, distributing malware disguised as stress-relief programs,” the Genians…
-
Android Users Hit by Malware Disguised as Relaxation Programs
A sophisticated new cyberattack targeting Android devices in South Korea has been uncovered, leveraging Google’s asset-tracking feature, Find Hub, to remotely wipe sensitive user data. Threat actors disguised as psychological counselors and North Korean human rights activists have distributed malware masquerading as stress-relief programs, marking a significant escalation in state-sponsored attacks linked to the notorious…
-
Android Users Hit by Malware Disguised as Relaxation Programs
A sophisticated new cyberattack targeting Android devices in South Korea has been uncovered, leveraging Google’s asset-tracking feature, Find Hub, to remotely wipe sensitive user data. Threat actors disguised as psychological counselors and North Korean human rights activists have distributed malware masquerading as stress-relief programs, marking a significant escalation in state-sponsored attacks linked to the notorious…
-
APT Groups Target Construction Firms to Steal RDP, SSH, and Citrix Credentials
Tags: apt, china, citrix, credentials, cyber, cybercrime, group, iran, korea, network, north-korea, organized, ransomware, russia, threatThe construction industry has emerged as a primary target for sophisticated cyber adversaries in 2025, with threat actors including state-sponsored APT groups, ransomware operators, and organized cybercriminal networks actively targeting organizations across the building and construction sector. Nation-state actors from China, Russia, Iran, and North Korea are leveraging the industry’s rapid digital transformation and security…
-
APT Groups Target Construction Firms to Steal RDP, SSH, and Citrix Credentials
Tags: apt, china, citrix, credentials, cyber, cybercrime, group, iran, korea, network, north-korea, organized, ransomware, russia, threatThe construction industry has emerged as a primary target for sophisticated cyber adversaries in 2025, with threat actors including state-sponsored APT groups, ransomware operators, and organized cybercriminal networks actively targeting organizations across the building and construction sector. Nation-state actors from China, Russia, Iran, and North Korea are leveraging the industry’s rapid digital transformation and security…
-
Verdacht des systematischen Missbrauchs von Zahlungsdienstleistern
Tags: credit-card, cybercrime, finance, fraud, germany, mail, north-korea, password, phishing, softwareDie Beschuldigten sollen zur Abwicklung von Zahlungen vier große deutsche Zahlungsdienstleister kompromittiert haben.Bei der Razzia gegen mutmaßliche Betrugs- und Geldwäschenetzwerke auf drei Kontinenten sind auch 29 Objekte in Deutschland durchsucht worden. In Baden-Württemberg, Bayern, Berlin, Hessen, Rheinland-Pfalz, Sachsen, Hamburg und Schleswig-Holstein waren mehr als 250 Einsatzkräfte im Einsatz, wie das Bundeskriminalamt (BKA) und andere Behörden…
-
Verdacht des systematischen Missbrauchs von Zahlungsdienstleistern
Tags: credit-card, cybercrime, finance, fraud, germany, mail, north-korea, password, phishing, softwareDie Beschuldigten sollen zur Abwicklung von Zahlungen vier große deutsche Zahlungsdienstleister kompromittiert haben.Bei der Razzia gegen mutmaßliche Betrugs- und Geldwäschenetzwerke auf drei Kontinenten sind auch 29 Objekte in Deutschland durchsucht worden. In Baden-Württemberg, Bayern, Berlin, Hessen, Rheinland-Pfalz, Sachsen, Hamburg und Schleswig-Holstein waren mehr als 250 Einsatzkräfte im Einsatz, wie das Bundeskriminalamt (BKA) und andere Behörden…
-
Verdacht des systematischen Missbrauchs von Zahlungsdienstleistern
Tags: credit-card, cybercrime, finance, fraud, germany, mail, north-korea, password, phishing, softwareDie Beschuldigten sollen zur Abwicklung von Zahlungen vier große deutsche Zahlungsdienstleister kompromittiert haben.Bei der Razzia gegen mutmaßliche Betrugs- und Geldwäschenetzwerke auf drei Kontinenten sind auch 29 Objekte in Deutschland durchsucht worden. In Baden-Württemberg, Bayern, Berlin, Hessen, Rheinland-Pfalz, Sachsen, Hamburg und Schleswig-Holstein waren mehr als 250 Einsatzkräfte im Einsatz, wie das Bundeskriminalamt (BKA) und andere Behörden…
-
Threat Actors Exploit VS Code Extensions for Ransomware via GitHub C2
Tags: attack, control, cyber, espionage, exploit, github, government, group, infrastructure, malware, north-korea, ransomware, threatSecurity researchers have uncovered a sophisticated attack campaign attributed to Kimsuky, the North Korean-backed threat group known for conducting espionage operations against government entities and think tanks. Recent analysis reveals that threat actors are leveraging Visual Studio Code extensions and GitHub as command-and-control infrastructure to deliver multi-stage malware payloads capable of deploying ransomware and conducting…
-
Threat Actors Exploit VS Code Extensions for Ransomware via GitHub C2
Tags: attack, control, cyber, espionage, exploit, github, government, group, infrastructure, malware, north-korea, ransomware, threatSecurity researchers have uncovered a sophisticated attack campaign attributed to Kimsuky, the North Korean-backed threat group known for conducting espionage operations against government entities and think tanks. Recent analysis reveals that threat actors are leveraging Visual Studio Code extensions and GitHub as command-and-control infrastructure to deliver multi-stage malware payloads capable of deploying ransomware and conducting…
-
EndClient RAT Leverages Compromised Code-Signing to Slip Past Antivirus
A sophisticated Remote Access Trojan (RAT) is actively targeting North Korean Human Rights Defenders (HRDs) through a campaign leveraging stolen code-signing certificates to evade antivirus detection. The newly discovered >>EndClient RAT,>StressClear.msi,
-
EndClient RAT Leverages Compromised Code-Signing to Slip Past Antivirus
A sophisticated Remote Access Trojan (RAT) is actively targeting North Korean Human Rights Defenders (HRDs) through a campaign leveraging stolen code-signing certificates to evade antivirus detection. The newly discovered >>EndClient RAT,>StressClear.msi,
-
Unpatched Windows Flaw a Boon for Nation-State Hackers
Chinese Hackers Target European Diplomats with LNK File Flaw. Chinese nation-state hackers are exploiting a Windows vulnerability to hack European diplomatic outposts, say security researchers – but operating system giant Microsoft says the flaw doesn’t merit a patch. Hackers used a flaw already compromised by North Korea and Russia. First seen on govinfosecurity.com Jump to…
-
U.S. sanctioned North Korea bankers for laundering funds linked to cyberattacks and peapons program
U.S. sanctions North Korea bankers and firms accused of laundering cybercrime funds used to finance the country’s nuclear weapons program. The U.S. Government has imposed sanctions on several North Korea bankers, financial institutions, and individuals accused of laundering funds obtained from cybercrime operations. According to the U.S. Treasury Department, these illicit financial activities directly support…
-
U.S. Sanctions 10 North Korean Entities for Laundering $12.7M in Crypto and IT Fraud
The U.S. Treasury Department on Tuesday imposed sanctions against eight individuals and two entities within North Korea’s global financial network for laundering money for various illicit schemes, including cybercrime and information technology (IT) worker fraud.”North Korean state-sponsored hackers steal and launder money to fund the regime’s nuclear weapons program,” said Under Secretary of First seen…
-
U.S. Sanctions 10 North Korean Entities for Laundering $12.7M in Crypto and IT Fraud
The U.S. Treasury Department on Tuesday imposed sanctions against eight individuals and two entities within North Korea’s global financial network for laundering money for various illicit schemes, including cybercrime and information technology (IT) worker fraud.”North Korean state-sponsored hackers steal and launder money to fund the regime’s nuclear weapons program,” said Under Secretary of First seen…
-
US sanctions North Korean bankers linked to cybercrime, IT worker fraud
The U.S. Treasury Department imposed sanctions on two North Korean financial institutions and eight individuals involved in laundering cryptocurrency stolen in cybercrime and fraudulent IT worker schemes. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/us-treasury-sanctions-north-korean-bankers-linked-to-cybercrime-it-worker-fraud/
-
Kimsuky Debuts HTTPTroy Backdoor Against South Korea Users
The well-known North Korean threat group continues to improve the obfuscation and anti-analysis features of its attack toolchain. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/kimsuky-httptroy-backdoor-south-korea-users
-
North Korean companies, people sanctioned for money laundering from cybercrime, IT worker schemes
The Treasury Department on Tuesday sanctioned eight people and two companies it accused of laundering money obtained from cybercrime and IT worker schemes to fund North Korean government objectives. According to the department, over the last three years North Korea-linked cybercriminals have stolen over $3 billion, mostly in cryptocurrency. In addition, it said, North Korean…
-
North Korean companies, people sanctioned for money laundering from cybercrime, IT worker schemes
The Treasury Department on Tuesday sanctioned eight people and two companies it accused of laundering money obtained from cybercrime and IT worker schemes to fund North Korean government objectives. According to the department, over the last three years North Korea-linked cybercriminals have stolen over $3 billion, mostly in cryptocurrency. In addition, it said, North Korean…
-
Treasury sanctions 8 for laundering North Korea earnings from cybercrime, IT worker scheme
An IT company, a financial institution and eight men accused of aiding cybercrime and IT worker scams are now on the U.S. government’s list of sanctioned North Korean entities. First seen on therecord.media Jump to article: therecord.media/north-korea-us-sanctions-it-worker-scams-cybercrime