Lazarus aka Hidden Cobra APT Group – Active IOCs

This APT group has been associated with other threat actor groups, including Bluenoroff and Andariel, believed to be subgroups or closely aligned with Lazarus. One of their recent campaigns, "Dream Job," specifically targets cryptocurrency-adjacent entiti…

North Korean APT Kimsuky aka Black Banshee – Active IOCs

Kimsuky, also known as Black Banshee, is described as a North Korean APT active since at least 2012 and focused on espionage against targets in South Korea, Japan, the United States, and other countries. The advisory summarizes common Kimsuky tradecraft i…

The Worst Cybersecurity Threats: Shadow IT Insiders from North Korea

A YouTube video description frames North Korean shadow IT workers as an insider-threat concern and lists sections on how they operate, their goals, and defensive steps. The excerpt does not provide technical indicators, malware details, or a specific intr…

APT38 Attacks A CEO by MacOS Malware

The source describes an APT38 or Lazarus-attributed social-engineering operation that targeted a CEO through Discord and pushed a fake online meeting download. The download flow used a passcode-protected page and delivered a small macOS DMG containing a B…

Andariel

This Andariel profile identifies the DPRK-linked group as Lab 110 / 3rd Bureau of the Reconnaissance General Bureau and catalogs its aliases, relationships, exploited vulnerabilities, and reporting history. The page maps Andariel to aliases such as APT45,…

Heads up all—some dudes have a slick, new way of dropping some nasty malware

The report describes a malware delivery technique disguised as a polished video-interview workflow, commonly initiated by fake recruiters claiming to represent well-known companies such as Kraken, MEXC, Gemini, or Meta. Targets are approached through Link…

Developers Targeted by New ‘OtterCookie’ Malware with Fake Job Offers – Active IOCs

Rewterz reports that North Korean actors behind the Contagious Interview campaign are using OtterCookie malware in fake job-offer attacks against software developers. The campaign has operated since at least late 2022 and previously distributed BeaverTail…

Exposing the Steps of the Kimsuky APT Group

Picus profiles Kimsuky as a North Korean espionage actor active since at least 2012 and tracked under aliases including Black Banshee, Velvet Chollima, THALLIUM and Emerald Sleet. The source describes targeting of South Korean government, think-tank, defe…

OtterCookie, new malware used in Contagious Interview campaign

NTT's SOC identified OtterCookie as malware used in the North Korea-linked Contagious Interview campaign, with activity observed around November 2024 and possible use since September. The campaign commonly starts from Node.js projects, npm packages or fil…

APT-C-26（Lazarus）组织使用武器化的IPMsg软件的攻击活动分析

The report analyzes an APT-C-26/Lazarus campaign that delivered a weaponized IPMsg installer to targets. When executed, the installer dropped a malicious DLL while also launching the legitimate IPMsg Installer 5.6.18.0 to reduce user suspicion. The DLL ch…

우리 정부의 대북 독자제재 지정

South Korea's Ministry of Foreign Affairs announced independent sanctions against 15 North Korean IT workers and one related entity for foreign-currency earning activity tied to cyber operations and weapons funding. The statement says North Korea continue…

Kimsuky(김수키)에서 만든 자유 아시아 방송으로 위장 해서 특정 북한 인권운동가 노린 악성코드-log_processlist.ps1(2024.12.02)

The report analyzes a Kimsuky-attributed PowerShell malware case, log_processlist.ps1, distributed from a site impersonating Radio Free Asia and aimed at a specific North Korean human-rights activist. The script used Dropbox API credentials to obtain an O…

Contagious Interviewが使用する新たなマルウェアOtterCookieについて

NTT Security Japan analyzes OtterCookie, a malware family observed in the Contagious Interview campaign, which is described as a North Korea-linked, financially motivated operation. The activity often begins with Node.js projects or npm packages downloade…

TraderTraitorによるDMM Bitcoinのビットコイン不正流出についてまとめてみた

The Piyolog summary covers the DMM Bitcoin incident in which 4,502.9 BTC, worth about 48.2 billion yen at the time, was illicitly transferred from the exchange's wallet on May 31, 2024. Japanese authorities later issued warnings stating that a North Korea…

Hyperliquidate

Rekt reported that DPRK-linked wallets were observed trading on Hyperliquid, raising concern that North Korean actors were testing the protocol before a possible attack. The article highlights Hyperliquid's risk profile at the time: more than $2 billion i…