The Record
According to the State Department, a U.S. national named Christina Chapman helped four people fraudulently obtain work as remote software and applications developers with companies in a range of sectors and industries, earning millions of dollars for the North Korean regime.
CyberNews
A UN sanctions investigation says North Korea laundered $147.5 million of stolen crypto through the virtual mixer platform Tornado Cash in March.
CyberNews
The US Department of State has released a new international cyberspace and digital strategy, which focuses “on building broad digital solidarity.”
Bleeping Computer
The NSA and FBI warned that the APT43 North Korea-linked hacking group exploits weak email Domain-based Message Authentication Reporting and Conformance (DMARC) policies to mask spearphishing attacks.
The Hacker News
U.S. government warns of North Korean hackers sending spoofed emails to gather intelligence.
DarkReading
Lazarus, Kimsuky, and Andariel all got in on the action, stealing "important" data from firms responsible for defending their southern neighbors (from them).
Bleeping Computer
The National Police Agency in South Korea issued an urgent warning today about North Korean hacking groups targeting defense industry entities to steal valuable technology information.
DarkReading
North Korean hackers break ground with new exploitation techniques for Windows and macOS.
DarkReading
North Korean hackers break ground with new exploitation techniques for Windows and macOS.
CyberNews
Japan has issued a warning to companies about IT workers from North Korea posing as Japanese to fund Pyongyang's regime.
DarkReading
DPRK is using cyberattacks to steal designs and other data from South Korean microchip manufacturers, according to the National Intelligence Service.
HACKRead
Discover the latest cybersecurity revelation: KONNI malware, linked to North Korea, targets the Russian Ministry of Foreign Affairs.
DarkReading
First Brad and Jennifer, now Kim and Putin? Romance truly is dead, as North Korea is caught spying (again) on its partner to the north with the Konni malware.
Cyber Security News
Konni RAT is a sophisticated malware tool cyber threat actors use to gain unauthorized access to systems, execute commands remotely.
The Hacker News
Russian government software compromised in suspected North Korean cyberattack. Konni RAT backdoor discovered in Ministry of Foreign Affairs tool.
Cyber Security News
Threat actors target military technologies to gain a strategic advantage, access classified information, and compromise national security.
DarkReading
UN reportedly investigating dozens of crypto cyberattacks suspected to have earned the North Korean regime billions to fund nuclear program.
SecurityWeek
U.N. experts are investigating 58 suspected North Korean cyberattacks valued at approximately $3 billion, with the money reportedly being used fund development of weapons of mass destruction.
CyberNews
An unpublished United Nations report says that dozens of suspected cyberattacks by North Korea raked in $3 billion used to help develop its nuclear weapons program.
The Cyber Express
UN sanctions monitors are delving into a series of suspected cyberattacks by North Korea, allegedly amassing a staggering $3 billion
The Record
Hackers siphoned $1.7 billion from cryptocurrency platforms in 2023 — down by about $2 billion from a record high set the previous year, according to data collected by blockchain research firm Chainalysis.
DarkReading
Based on fresh infection routines the APT is testing, it's looking to harvest threat intelligence in order to improve operational security and stealth.
Cyber Security News
The Democratic People's Republic of Korea (DPRK) has reportedly stolen nearly $600 million in cryptocurrency in 2023.
Infosecurity News
North Korean hackers remain effective in stealing cryptocurrency despite growing international law enforcement action
CyberNews
North Korean hackers continue to be the most prolific in terms of cryptocurrency theft, research finds.
The Hacker News
North Korean hackers have stolen over $600M in crypto in 2023! A significant threat to global financial security.
Security Affairs
Researchers discovered a macOS backdoor, called SpectralBlur, which shows similarities with a North Korean APT's malware family.
DarkReading
The post-exploitation backdoor is the latest in a string of custom tools aimed at spying on Apple users.
Bleeping Computer
Orbit Chain has experienced a security breach that has resulted in a loss of $86 million in cryptocurrency, particularly Ether, Dai, Tether, and USD Coin.
DarkReading
The infamous vulnerability may be on the older side at this point, but North Korea's primo APT Lazarus is creating new, unique malware around it at a remarkable clip.
Bleeping Computer
North Korean-backed state hackers have stolen an estimated $3 billion in a long string of hacks targeting the cryptocurrency industry over the last six years since January 2017.
Security Affairs
The US Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced sanctions against North Korea-linked APT group Kimsuky.
Bleeping Computer
The Treasury Department's Office of Foreign Assets Control (OFAC) has sanctioned the North Korean-backed Kimsuky hacking group for stealing intelligence in support of the country's strategic goals.
SecurityWeek
US Treasury sanctions Sinbad, saying the cryptocurrency mixer is laundering funds for North Korean hacking group Lazarus.
The Hacker News
DPRK threat actors have stolen an estimated $3 billion in crypto assets, with $1.7 billion taken in 2022 alone.
CyberNews
Sinbad operated on the Bitcoin blockchain and was a preferred mixing service for North Korea’s threat actors.
The Cyber Express
In a significant move to combat cyber-enabled criminal activities, the U.S. Department of the Treasury's Office of Foreign Assets Control
The Hacker News
The U.S. Treasury Department has imposed sanctions against a virtual currency mixer called Sinbad.
HACKRead
According to the US government, Sinbad.io provided its services to the Lazarus group to launder money stolen from numerous data breaches, including those affecting Horizon Bridge, Axie Infinity, and Atomic Wallet.
SecurityWeek
UK and Korea say DPRK state-sponsored hackers targeted governments, defense organizations via supply chain attacks.
Security Affairs
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free for you.
Bleeping Computer
A joint advisory by the National Cyber Security Centre (NCSC) and Korea's National Intelligence Service (NIS) discloses a supply-chain attack executed by North Korean hackers involving the MagicLineThe National Cyber Security Centre (NCSC) and Korea's National Intelligence Service (NIS) warn that the North Korean Lazarus hacking grou
The Record
The alert came as the two governments announced a new strategic cyber partnership “to disrupt and deter DPRK malicious cyber capabilities and activities that contribute to its WMD programs.”
DarkReading
No one has turned the job market into an attack surface quite like North Korea, which plays both sides for financial gain and, possibly, espionage.
DarkReading
Posing as fellow engineers, the North Korean state-sponsored cybercrime group Lazarus tricked crypto-exchange developers into downloading the hard-to-detect malware.
The Hacker News
State-sponsored North Korean hackers are using a sneaky macOS malware called KANDYKORN to target crypto engineers via Discord.
SecurityWeek
FBI says North Korean hacking group Lazarus has stolen $41 million in cryptocurrency from online betting platform Stake.com.
CSO
Government-backed threat actors are using zero-day exploits to infect security researchers and exfiltrate critical vulnerability information.
DarkReading
This time, they're creating elaborate impostor profiles and using a fresh zero-day and a fake Windows tool to lure in the suspecting.
SecurityWeek
Google again catches a North Korean APT actor using using zero-days and rigged software tools to take control of their computers.
DarkReading
The most recent stolen bitcoin comes just after three major operations occurred in June, with millions stolen in each heist.
Security Affairs
The U.S. FBI warned that North Korea-linked threat actors may attempt to cash out stolen cryptocurrency worth more than $40 million. The Federal Bureau of Investigation shared details about the activity of six cryptocurrency wallets operated by North Korea-linked threat actors. The wallets hold roughly 1,580 Bitcoin (roughly $41 million at the current rate) that […]
Bleeping Computer
The FBI warned that North Koreans are likely readying to cash out tens of millions worth of stolen cryptocurrency out of hundreds of millions stolen in the last year alone.
SecurityWeek
The FBI has published information on six crypto wallets in which North Korean hackers moved roughly 1,580 Bitcoin from various heists.
DataBreaches
The FBI is warning cryptocurrency companies of recent blockchain activity connected to the theft of hundreds of millions of dollars in cryptocurrency. Over the...
The Record
The FBI attributed three recent cyberattacks on cryptocurrency platforms to the North Korean government’s APT38 hacking group and warned that Pyongyang is likely to attempt to cash out the stolen proceeds.
CSO
SentinelLabs analyzed leaked emails and associated implants to confirm two North Korea-backed hacker groups intruded into a Russian missile maker.
Cyber Security News
North Korean threat actors actively grabbed the attention of security experts, revealing fruitful campaign insights over the year.
SecurityWeek
A sanctioned Russian missile maker appears to have been targeted by two important North Korean hacking groups.
CSO
Mandiant research has attributed the hack to UNC4899, a Democratic People’s Republic of Korea (DPRK) threat actor, with a history of targeting companies within the cryptocurrency vertical.
Infosecurity News
Mandiant said the compromise resulted from a sophisticated spear-phishing campaign
The Hacker News
North Korean state actors linked to the RGB have been identified in the JumpCloud hack! An OPSEC mistake exposed their IP address.
Bleeping Computer
A hacking unit of North Korea's Reconnaissance General Bureau (RGB) was linked to the JumpCloud breach after the attackers made an operational security (OPSEC) mistake, inadvertently exposing their real-world IP addresses.
Security Affairs
SentinelOne researchers attribute the recent supply chain attacks on JumpCloud to North Korea-linked threat actors. JumpCloud is a cloud-based directory service platform designed to manage user identities, devices, and applications in a seamless and secure manner. It allows IT administrators to centralize and simplify their identity and access management tasks across various systems and applications. […]
SecurityWeek
SentinelOne has linked the recent JumpCloud cyberattack to North Korean hackers, based on the published IOCs.
The Hacker News
North Korean state-sponsored groups suspected in the recent supply chain attack on JumpCloud! They used the breach to target cryptocurrency firms.
Bleeping Computer
US-based enterprise software company JumpCloud was breached by North Korean Lazarus Group hackers, according to security researchers at SentinelOne and CrowdStrike.
Security Affairs
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free for you in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Google addressed 3 actively exploited flaws in Android Iran-linked APT TA453 targets Windows and macOS systems […]
Cyber Security News
This variant of RUSTBUCKET, targets macOS systems, adds persistence capabilities not previously observed and, at the time of reporting, is undetected by VirusTotal signature engines.
The Hacker News
North Korea's Kimsuky group, a.k.a APT43, wields spear-phishing campaigns and is leveraging social engineering to compromise high-value targets.
Security Affairs
A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free for you in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Is the BlackByte ransomware gang behind the City of Augusta attack? New Buhti ransomware operation uses […]
Security Affairs
North Korea-linked APT group Lazarus actor has been targeting vulnerable Microsoft IIS servers to deploy malware. AhnLab Security Emergency response Center (ASEC) researchers reported that the Lazarus APT Group is targeting vulnerable versions of Microsoft IIS servers in a recent wave of malware-based attacks. Once discovered a vulnerable ISS server, the attackers leverage the DLL side-loading […]
Infosecurity News
Illicit North Korean IT workers send the money they made from abroad to fund Kim’s regime, US Treasury Department said
Security Affairs
The US Department of the Treasury sanctioned four entities and one individual for their role in cyber operations conducted by North Korea. The US Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced sanctions against four entities and one individual for their role in malicious cyber operations conducted to support the government of […]
The Hacker News
North Korean Lazarus Group remains relentless in targeting vulnerable Microsoft IIS servers, utilizing DLL side-loading techniques to deploy malware.
Bleeping Computer
The Treasury Department's Office of Foreign Assets Control (OFAC) announced sanctions today against four entities and one individual for their involvement in illicit IT worker schemes and cyberattacks generating revenue to finance North Korea's weapons development programs.
DarkReading
ReconShark, aimed at gaining initial access to targeted systems, is a component of previous malware used by the Kimsuky group.
Infosecurity News
ReconShark is sent via emails containing OneDrive links leading to documents with malicious macros
Security Affairs
North Korea-linked APT group Kimsuky has been observed using a new reconnaissance tool dubbed ReconShark in a recent campaign. SentinelOne researchers observed an ongoing campaign from North Korea-linked Kimsuky Group that is using a new malware called ReconShark. The reconnaissance tool is delivered through spear-phishing emails, OneDrive links leading to document weaponized downloads, and the execution of malicious […]
DarkReading
As threat actors around the world grow and evolve, APTs from the DPRK stand out for their spread and variety of targets.
DarkReading
Kim Jong Un's Swiss Army knife APT continues to spread its tendrils around the world, showing it's not intimidated by the researchers closing in.
CSO
Detection times and ransomware attacks are down but adversaries remain sophisticated, adaptable, persistent, and creative.
Bleeping Computer
A digitally signed and trojanized version of the 3CX Voice Over Internet Protocol (VOIP) desktop client is reportedly being used to target the company's customers in an ongoing supply chain attack.
Infosecurity News
Mandiant says unit is focused on espionage and crypto theft
DarkReading
Campaign demonstrates the DPRK-backed cyberattackers are gaining tools to avoid EDR tools.
DarkReading
CISA, FBI, and South Korean intelligence agencies warn that the North Korean government is sponsoring ransomware attacks to fund its cyber-espionage activities.
Security Affairs
North Korea-linked APT groups conduct ransomware attacks against healthcare and critical infrastructure facilities to fund its activities. Ransomware attacks on critical infrastructure conducted by North Korea-linked hacker groups are used by the government of Pyongyang to fund its malicious cyber operations, U.S. and South Korean agencies warn. US CISA published a Cybersecurity Advisory (CSA) to […]
Infosecurity News
The latest iteration of the document is now analyzing activity by the Maui and H0lyGh0st groups
Bleeping Computer
A new cybersecurity advisory from the U.S. Cybersecurity & Infrastructure Security Agency (CISA) describes recently observed tactics, techniques, and procedures (TTPs) observed with North Korean ransomware operations against public health and other critical infrastructure sectors.
DataBreaches
Summary Note: This Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various...
The Record
When North Korea collects ransoms from healthcare facilities, the money could be funding operations against bigger targets, an advisory said.
DarkReading
Lazarus Group used a known Zimbra bug to steal data from medical and energy researchers.
Bleeping Computer
A new cyber espionage campaign dubbed 'No Pineapple!' has been attributed to the North Korean Lazarus hacking group, allowing the threat actors to stealthily steal 100GB of data from the victim without causing any destruction.
.webp)
Cyber Security News
It has been officially confirmed by the Federal Bureau of Investigation (FBI) that the cyber-attacks on the cryptocurrency exchange, Harmony Horizon, which resulted in the theft of $100 million worth of Ethereum, were orchestrated by state-sponsored hacking groups, Lazarus and APT38, based in North Korea.
DarkReading
The DPRK has turned crypto scams into big business to replenish its depleted state coffers.
Bleeping Computer
The FBI has concluded its investigation on the $100 million worth of ETH heist that hit Harmony Horizon in June 2022 and validated that the hackers responsible for it are the Lazarus group and APT38.
Security Affairs
The U.S. FBI attributes the $100 million cyber heist against Harmony Horizon Bridge to North Korea-linked Lazarus APT. The U.S. Federal Bureau of Investigation (FBI) this week confirmed that in June 2022 the North Korea-linked Lazarus APT group and APT38 stole $100 million worth of cryptocurrency assets from the Blockchain company Harmony Horizon Bridge. “The FBI continues […]
Security Affairs
The North Korea-linked Lazarus APT spreads fake cryptocurrency apps under the fake brand BloxHolder to install the AppleJeus malware. Volexity researchers warn of a new malware campaign conducted by the North Korea-linked Lazarus APT against cryptocurrency users. The threat actors were observed spreading fake cryptocurrency apps under the fake brand BloxHolder to deliver the AppleJeus […]
ZDNet
US government looks at ways of limiting the impact of ransomware across the world.
Bleeping Computer
Microsoft says the North Korean-sponsored Lazarus threat group is trojanizing legitimate open-source software and using it to backdoor organizations in many industry sectors, such as technology, defense, and media entertainment.
Loading more articles....