Nations take action on North Korean IT workers after UN report
Multiple countries took legal action against North Korean IT worker facilitators following a new UN-linked MSMT report on the illicit scheme.
50
- Mentions · 7d0
- Mentions · 30d0
- All mentions6
- First seenSep 4, 2026
- Last mentionedSep 18, 2026
Timeline
6 articles · newest firstTreasury urges banks to file cyber scam reports, noting nearly $13 billion in losses since 2023
FinCEN urged banks to report cyber scams after a study found $12.7 billion stolen from US victims of crypto investment scams since 2023.
66
Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks
Group-IB reports the Gigabud Android banking trojan uses a cloned work profile to hide from banking app malware checks, with infections confirmed in Indonesia.
60
Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection
GoldFactory-linked Gigabud and Vwork malware clone banking apps into hidden Android work profiles to evade fraud detection across 11+ countries.
58
GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks
Group-IB says GoldFactory's Gigabud Android trojan uses Vwork, a weaponized Shelter fork, to clone banking apps into isolated Work Profiles and evade bank-side detection.
60
US, Britain to coordinate on scam center takedowns
The US and UK signed an MOU to jointly investigate Southeast Asian scam compounds behind fraud that stole over $12 billion from Americans last year.
55
Appears with
- Vworkmalware · 3
- Shelterproduct · 3
- Group-IBvendor · 3
- GoldFactorythreat actor · 3
- Gigabudmalware · 3
- Vworkproduct · 2
- Androidproduct · 2
- Gigabudproduct · 2
- North Koreathreat actor · 1
- TRM Labsorganization · 1
- Group-IBorganization · 1
- FBIorganization · 1
- U.S. Department of Justiceorganization · 1
- Chinese crime syndicatesthreat actor · 1
- Ethereumproduct · 1
- Telegramproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.