outlook.com - DPRK Threat Intelligence | lazarus.day

outlook.com

Domain

Emails on this domain: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
First Seen: 2018-09-06
Last Seen: 2026-04-17

Shortcuts: Censys Criminal IP Virustotal any.run urlscan

27

Related Reports
135

Related IOCs

Related Reports

2026-04-17

meowmfer

"Taro" is part of a cell I've been calling "215"

#ITWorker

2026-04-10

Panther

Polymarket Trader Funds at Risk: DPRK npm Package Steals Wallet Keys and Installs SSH Backdoor

#FamousChollima #NPM #T1552.001 #T1083 #T1098.004

2026-04-08

Group-IB

Cyber Saga: In the Footsteps of the DPRK IT Workers

#ITWorker #JasperSleet #T1585.001 #T1589.001 #T1199 #T1588.007

2026-04-07

NKInternet

npm Malware, Fake Devs, and Deepfake Videos: These Are A Few of My Favorite DPRK Things

#ITWorker #NPM #Deepfake

2026-03-31

OSM

TasksJacker: Latest DPRK Attack Skips the Fake Interview and Goes Straight to Compromising GitHub Users

#TasksJacker #VSCode #T1059.007 #T1070.004 #T1036 #T1041 #T1543 #T1555 #T1059.004 #T1027 #T1102.001 #T1071.001 #T1552.004 #T1195.001

2026-03-17

Kmsec

Contagious Trader campaign - Coordinated weaponisation of cryptocurrency trading bots by suspected DPRK malware operators

#ContagiousTrader #FamousChollima #NPM

2026-01-21

Recorded Future

PurpleBravo’s Targeting of the IT Software Supply Chain

#BeaverTail #ClickFix #ContagiousInterview #GolangGhost #PurpleBravo #PylangGhost

2025-11-26

Socket

Inside the GitHub Infrastructure Powering North Korea’s Contagious Interview npm Attacks

#ContagiousInterview #NPM #OtterCookie #T1204.005 #T1036 #T1555.001 #T1587 #T1583.006 #T1082 #T1119 #T1585 #T1547.001 #T1005 #T1059.007 #T1587.001 #T1539 #T1041 #T1113 #T1656 #T1608.001 #T1204.002 #T1571 #T1105 #T1195.002 #T1115 #T1083 #T1583.001 #T1497 #T1546.016 #T1555.003 #T1056.001 #T1657 #T1217

2025-11-09

Wickeren

DPRK UNC3782

#Phishing #UNC3782

2025-10-10

Socket

North Korea’s Contagious Interview Campaign Escalates: 338 Malicious npm Packages, 50,000 Downloads

#ContagiousInterview #NPM #T1119 #T1005 #T1059.007 #T1082 #T1083 #T1555.001 #T1041 #T1027.013 #T1546.016 #T1608.001 #T1204.002 #T1555.003 #T1105 #T1657 #T1217 #T1195.002

2025-10-01

Ketman

Spotted a Weird Github Organization? It Might be DPRK!

#ITWorker

2025-09-04

Sentinel One

North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms

#ClickFix #ContagiousInterview

2025-08-19

Rakesh Krish

Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags

#ITWorker #JasperSleet

2025-07-15

Socket

Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader

#ContagiousInterview #NPM #XORIndex #T1119 #T1005 #T1059.007 #T1082 #T1083 #T1555.001 #T1041 #T1027.013 #T1546.016 #T1608.001 #T1204.002 #T1555.003 #T1105 #T1657 #T1217 #T1195.002

2025-06-25

Socket

Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages

#BeaverTail #ContagiousInterview #HexEval #NPM #T1119 #T1005 #T1059.007 #T1082 #T1083 #T1555.001 #T1041 #T1027.013 #T1546.016 #T1608.001 #T1204.002 #T1555.003 #T1056.001 #T1105 #T1657 #T1217 #T1195.002

2025-05-13

Proofpoint

TA406 Pivots to the Front

#LNK #TA406

2025-04-24

Silentpush

Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies to Deliver a Trio of Malware

#BeaverTail #ContagiousInterview #InvisibleFerret #OtterCookie #FamousChollima #ClickFix

2024-11-14

Paloalto Networks

Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phishing Attack

#BeaverTail #CL-STA-0237 #ITWorker #Wagemole

2024-10-24

Datadog

Tenacious Pungsan: A DPRK threat actor linked to Contagious Interview

#BeaverTail #ContagiousInterview #TenaciousPungsan

2024-09-18

Know Be4

North Korean Fake Employees Are Everywhere! How to Protect Your Organization

#ITWorker

2023-11-04

Phylum

Crypto-Themed npm Packages Found Delivering Stealthy Malware

#SupplyChain #NPM

2023-03-24

Kaspersky

APT attacks on industrial organizations in H2 2022

#Trend

2023-03-14

USJustice

USA vs MINH QUOC NGUYEN

#Cryptocurrency #Harmony #AxieInfinity #ChipMixer

2022-10-05

ESET

ESET Threat Report T2 2022

#Trend

2022-08-05

Somansa

H0lyGh0st 랜섬웨어

#Ransomware #H0lyGh0st #Andariel

2020-11-12

ESTSecurity

北 연계 탈륨조직, '블루 에스티메이트(Blue Estimate)' APT 캠페인 지속

#Kimsuky #BlueEstimate

2018-09-06

USJustice

PARK COMPLAINT UNSEALED

#Blockbuster #BangSwift #WannaCry

⚠ These IoCs were automatically extracted using regular expressions or an LLM and may include non-malicious data.