Search: “DPRK IT workers”

Insights into Suspected DPRK Workers

Huntress details incidents involving suspected DPRK remote workers (Famous Chollima) in partner environments and shares detection indicators.

Huntress analyzed several incidents involving suspected North Korean remote workers, associated with the activity cluster known as Famous Chollima. The report describes indicators defenders can use to detect and prevent DPRK worker infiltration in customer environments. The scheme centers on operatives obtaining remote jobs at Western companies under assumed identities.

Huntress·Aug 26, 04:00 UTC · 21d agoThreat actor in the wild

North Korean remote workers are broadening their job hunt beyond IT

Huntress links suspected North Korean remote workers to sales, marketing, and healthcare jobs using stolen identities, VPNs, proxies, and KVM hardware.

Huntress investigations identified suspected DPRK remote workers hired beyond IT in sales, marketing, and healthcare/financial organizations, sometimes actually performing the work they were hired for. Fraudulent documents included passports from the same city issued one day apart, ID cards with identical validity dates, and electricity bills built from the same online template with matching typos. A financial-services case found a PiKVM and Guermok USB capture card on a new hire's laptop within hours of delivery, suggesting a laptop farm, and another hire used a police mugshot with the photo digitally swapped. Researchers urge rigorous background checks and identity verification at the interview stage.

Help Net Security·Aug 28, 00:00 UTC · 19d agoPhishing & fraud in the wild

North Korea-linked IT Workers Are Getting Hired Inside Western Companies

Huntress documented five DPRK-linked FAMOUS CHOLLIMA workers hired by Western companies in 2026 using fake identities, proxies and laptop farms.

Huntress published an investigation of five confirmed 2026 cases of North Korea-linked IT workers, tracked as FAMOUS CHOLLIMA, obtaining remote jobs at legitimate companies in IT, sales, marketing and healthcare. The workers use stolen or fabricated identity documents, VPNs and proxy services, and some were caught using PiKVM hardware-level control, travel routers and laptop farms to mask their true location. Detection relied on document forensics, behavioral anomalies and indicators like identical typo artifacts in electricity bills rather than network intrusions.

Security Affairs·Sep 1, 11:08 UTC · 15d agoThreat actor in the wild

North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring

Researchers expose DPRK remote IT worker infiltration tactics, including forged identities and AI-assisted interview behavior.

A joint investigation by Mauro Eldritch, Heiner García, and ANY.RUN hired suspected DPRK developers linked to Lazarus Group into controlled sandboxes, revealing forged IDs, remote-access tools, AI-assisted workflows, and VPN/VPS infrastructure. The FBI is investigating a North Korean remote IT worker who reportedly worked for a U.S. federal agency. The article outlines verification steps and indicators including VPS and AstrillVPN exit node IPs.

The Hacker News·Aug 15, 00:00 UTC · Aug 15, 2026Threat actor in the wild

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.

Rapid7 Labs identified a previously undocumented framework attributed with medium confidence to DPRK actors, targeting South Korean automotive and media organizations likely since early 2025. The toolkit embeds a backdoor compiled into HAProxy 2.8.12 using its filter API, plus trojanized crond, agetty, atd, sshd, and polkitd, an SSH keylogger storing credentials under /var/lib/sshd/, and a curl-based RAT with a watchdog thread. It enables remote command execution, malicious script injection into served webpages (a watering-hole loop), credential harvesting, and long-term surveillance. Hardcoded C2s are associated with APT37 via ThreatFox, and exposed groupware portals and mail servers align with Kimsuky tradecraft; the initial access vector and any CVE remain unconfirmed.

Rapid7 Blog·Sep 4, 12:00 UTC · 12d agoThreat actor in the wild1

Researching Employment Scams

Schneier highlights research into North Korean fake-employment IT-worker scams that embed operatives in remote roles for long-term insider access.

The post discusses research into employment scams in which fabricated remote workers, associated with North Korean IT-worker schemes, embed in organizations for months or years to exfiltrate data or position for financial theft. Researchers used controlled sandbox environments to observe operatives syncing personal accounts and working under false identities. Commenters also note reverse scams targeting desperate job seekers through high-pressure MLM and door-to-door sales schemes.

Schneier on Security·Sep 3, 11:18 UTC · 13d agoPhishing & fraud

North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales

North Korea's IT worker scheme (Famous Chollima/PurpleDelta) has expanded from IT into healthcare, sales, and financial services roles worldwide.

Huntress and Recorded Future documented DPRK-linked fraudulent workers landing remote jobs beyond IT, including at an Australian healthcare company, a financial services firm, and a sales hire with a stolen identity. The scheme, tracked as Famous Chollima, Jasper Sleet, Nickel Tapestry, PurpleDelta, UNC5267, and Wagemole, uses forged identity documents, VPNs, proxies, and laptop farms with PiKVM and capture cards to fund Pyongyang's weapons programs. Recorded Future found the PurpleDelta cluster applied to 1,100+ companies between late 2024 and early 2025 with 22 fabricated personas, some AI-generated, using ChatGPT and AI transcription during interviews. Analysts assess the activity is ongoing and likely to expand in scale and sophistication.

The Hacker News·Sep 1, 06:34 UTC · 15d agoThreat actor in the wild

Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited

Help Net Security's weekly digest highlights 274 compromised Zimbra servers, Gitea and Citrix NetScaler KEV additions, a PaperCut zero-day, and a suspected Iran-linked power plant attack.

The roundup reports at least 274 internet-facing Zimbra instances compromised via CVE-2026-73570, critical Gitea CVE-2026-60004 added to CISA's KEV catalog after exploitation began, and previously patched Citrix NetScaler flaw CVE-2026-8452 exploited in the wild. It also covers PaperCut NG/MF zero-day attacks, a suspected Iran-linked shutdown of a UK power plant, an FBI seizure of domains tied to a China-linked group that hit NASA, DOJ and the Senate, a cyberattack disrupting Boston Scientific, and the Manchester Airports Group breach. Additional items include Chameleon SEO poisoning phishing, Android car head unit proxy botnet malware, ReliaQuest social engineering by ShinyHunters, fake OpenAI Codex macOS malware, and AI-related workforce and supply chain interviews.

Help Net Security·Aug 30, 00:00 UTC · 17d agoIndustry in the wildCVE-2026-73570CVE-2026-60004CVE-2026-8452

Red Flags That Expose Fake North Korean IT Workers

Researchers outline red flags for spotting North Korean operatives posing as remote IT workers as their tactics improve.

Dark Reading describes indicators that help organizations identify North Korean operatives working undercover as IT workers. Researchers say these operatives are improving their tactics, but detection methods still exist. Catching them early helps employers avoid infiltration, data theft, and damage.

Dark Reading·Aug 26, 19:21 UTC · 21d agoPhishing & fraud

North Korean IT Workers Scheme: Detection IOCs and Tactics for Government and Corporate SOCs

ANY.RUN details the expanding North Korean IT worker infiltration scheme using forged identities and AI-assisted workflows, sharing detection IOCs for SOCs.

ANY.RUN describes how North Korean IT workers infiltrate American and European organizations using forged identities and AI-assisted workflows to become trusted insiders. The operation bypasses traditional security perimeters and has expanded beyond the private sector to government targets. The post provides detection IOCs and tactics for government and corporate SOCs.

ANY.RUN·Aug 20, 07:58 UTC · 27d agoThreat actor

Risky Bulletin: The EU publishes its upcoming cybersecurity standards

ETSI releases 17 draft cybersecurity standards vendors must meet when the EU Cyber Resilience Act takes effect in December 2027.

The European Telecommunications Standards Institute published 17 interim draft standards covering operating systems, routers, firewalls, VPNs, SIEMs, browsers, password managers, smart home devices, toys and wearables. They mandate basic security features such as post-sale updates, shipped SBOMs, modern cryptography and secure-by-default settings; public comments run until November, with final versions expected in December, one year before CRA compliance begins in December 2027. The newsletter also reports Irregular taking responsibility for AI test-environment escapes involving Anthropic and Meta frontier models, a breach at France's tax agency exposing 678,000+ citizens' data claimed by hacker ZeroBytes, and Kazakhstan eGov data covering 15 million citizens listed for sale on an underground forum. Additional briefs cover a $3.2 million Harmony Protocol theft crashing the ONE token 40%, Columbus Police still restoring systems two years after ransomware, DDoS attacks on Threema's provider, and Ukraine's GUR claiming a cyberattack on Wildberries.

Risky Business News·Aug 17, 05:03 UTC · Aug 17, 2026Policy & legal2

PurpleDelta's Fraudulent Employment Operations

Recorded Future details North Korean cluster PurpleDelta using AI-generated personas and ChatGPT assistants to infiltrate companies via fraudulent employment.

Recorded Future profiles PurpleDelta, a North Korean IT worker threat cluster, in a new research report. The group uses AI-generated personas, sophisticated tradecraft, and custom ChatGPT assistants to obtain employment at target organizations and operate covertly. The report includes key indicators of compromise and recommended mitigation strategies for defenders.

Recorded Future·Aug 18, 00:00 UTC · 29d agoThreat actor

North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters

Sekoia and Kudelski Security reclassify North Korea's Lazarus umbrella into six clusters spanning espionage, financial theft, and fake IT worker operations.

New research by Sekoia and Kudelski Security, published September 7, divides the former Lazarus umbrella into TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet, and Famous Chollima, mostly under North Korea's military intelligence bureau (GRIB). The former APT38 likely split into CryptoCore and Jade Sleet, focused on cryptocurrency, Web3, and blockchain targets. Moonstone Sleet combines espionage with financially motivated operations, using custom malware alongside Qilin ransomware-as-a-service. Thousands of fake IT workers generate regime revenue and provide access, linked to incidents like the $62.5M Munchables protocol theft.

Infosecurity Magazine·Sep 7, 11:00 UTC · 9d agoThreat actor

CISA gives federal agencies two weeks to patch Microsoft bug exploited in DPRK campaign

CISA orders federal agencies to patch exploited Windows Winsock zero-day CVE-2026-68820 by August 25, used by Lazarus in Operation Dream Job.

CISA ordered federal agencies to patch Windows Winsock vulnerability CVE-2026-68820, rated 7/10, by August 25 after confirming exploitation; no workaround exists and a restart is required. Check Point found Lazarus Group hackers impersonated Lockheed Martin and Enveil recruiters on LinkedIn, sent malicious PDFs enabling long-term remote access, then used the zero-day to escalate from limited access to full system control. Targets spanned defense sectors including surveillance, drones and robotics in France, Germany, Brazil and India, as part of Operation Dream Job tracked since 2020.

The Record·Aug 12, 12:12 UTC · Aug 12, 2026Exploit / PoC in the wildCVE-2026-688201

Russian military hackers pose as recruiters to target Ukrainian IT workers

The Record·Aug 10, 15:24 UTC · Aug 10, 2026Threat actor

Risky Bulletin: Russia tells data centers to deploy drone defenses

Russia ordered data center operators to deploy drone strike defenses under a Putin decree allowing temporary state takeover of unprotected critical infrastructure.

The Russian government instructed data center operators to deploy protections against drone strikes under a presidential decree signed by Putin that allows temporary state administration of critical infrastructure operators failing to defend against Ukrainian hacks and drone strikes. Although data centers are not formally critical infrastructure in Russia, the decree applies to them because other sectors depend heavily on cloud services; Russia has more than 180 data centers, over 80% in the European region within range of Ukrainian strikes. The digest also reports a Dropbox breach affecting nearly 5,000 accounts via the Lenovo ID integration, spyware attacks on at least 14 Serbians using NoviSpy or Pegasus, and a password recovery attack targeting hundreds of thousands of X accounts tied to the new X Money service. Other items include a 14-hour compromise of Coder's Cloudflare infrastructure delivering malicious Terraform modules, donor data breaches at Davayte and You Are Not Alone via the Stripe/WooCommerce integration, a $2.5M Aquifer crypto heist, and a TVING breach exposing data of almost 40 million accounts.

Risky Business News·Sep 4, 03:02 UTC · 12d agoPolicy & legal

Cyber Op Targets South Korean Media & Automotive Sectors

Likely North Korean APT compromised load balancers at South Korean media and automotive firms using a previously undocumented Linux espionage toolkit.

A cyber operation attributed to a likely North Korean APT group targeted South Korean media and automotive sectors. The attackers deployed a previously undocumented Linux espionage toolkit to compromise load balancers, gaining access to communications and enabling further network exploitation. Specific victims, toolkit names, and indicators of compromise were not disclosed in the report summary.

Dark Reading·01:00 UTC · 19h agoThreat actor in the wild

Knowledge Retention & Sharing in DF/IR

DFIR veteran reflects on knowledge retention and sharing gaps across the industry, from EnCase training to PCI forensics workflows.

A personal essay recounts decades in digital forensics and incident response, arguing the industry rarely moves beyond individual or tribal knowledge to operationalize lessons learned. Examples include building condition files and custom EnScripts for PCI investigations at IBM ISS X-Force, and the lack of shared investigative processes in early-career environments.

Lobsters · security·Sep 10, 09:06 UTC · 6d agoIndustry

North Korean Hackers Deploy New Linux Espionage Toolkit

Rapid7 says North Korea-aligned actors use a new Linux espionage toolkit (ted HAProxy backdoor, CurlRAT) against South Korean automotive and media targets.

Rapid7 reports a stealthy Linux framework comprising a custom HAProxy backdoor ('ted'), trojanized system binaries (agetty, atd, crond, polkitd, sshd), an SSH keylogger, and CurlRAT that polls C&C every 12 hours. Initial access came via a Groupware login portal flaw, with credential harvesting enabling lateral movement to internal systems. The toolkit supports long-term surveillance, HTTP traffic interception/injection, and drive-by downloads, likely in use since late 2024. Infrastructure and artifacts overlap Operation SyncHole, suggesting Lazarus or APT37 involvement.

SecurityWeek·Sep 7, 12:12 UTC · 9d agoThreat actor in the wild1

When AI quietly breaks things, who pays?

Reed Smith partner David Halbreich explains how AI companies can avoid D&O/E&O coverage gaps around mergers, governance warranties, and claims timing.

In an interview, insurance recovery partner David Halbreich of Reed Smith outlines insurance pitfalls for AI companies under claims-made D&O and E&O policies. He highlights 'straddle' claims after mergers that fall between tail coverage and go-forward policies, potentially leaving policyholders with no coverage. He also warns that governance artifacts submitted in insurance applications, such as bias testing records and model cards, can become warranties carriers use to deny claims, and discusses who should answer AI-use questions and how business interruption coverage applies to cloud and compute vendor outages.

Help Net Security·Sep 3, 00:00 UTC · 13d agoAI industry

North Korean Hackers Tied to Rust Supply Chain Attack

Researchers linked a backdoor hidden in compromised Rust packages to North Korean actors' prior software supply chain attack campaigns.

Cybersecurity researchers attributed a malicious backdoor planted in compromised Rust packages to North Korean threat actors based on ties to earlier supply chain attacks. The campaign targets the open-source developer ecosystem, where infected packages can propagate downstream to developer build systems. The attribution suggests DPRK-aligned actors continue investing in open-source supply chain tradecraft.

Infosecurity Magazine·Aug 21, 12:40 UTC · 26d agoThreat actor in the wild

The complex corporate web behind a $3.2 billion AI data center

Ars Technica probes diffuse accountability behind TeraWulf's $3.2B Lake Mariner AI data center after a June fire exposed safety and job gaps.

A June fire at the Lake Mariner data center in Somerset, New York exposed missing alarms, a nonfunctioning suppression system, and dry hydrants, highlighting how responsibility is split across TeraWulf (owner-operator), Fluidstack (operator), Google (lease guarantees and equity warrants), and Anthropic (compute customer). The article details local concerns over the gap between promised 165 permanent jobs and a projected 35-40, socialized grid costs, and Governor Hochul's moratorium on hyperscaler development. Anthropic's February 2026 pledge to cover electricity price increases applies to the site but leaves other commitments unverified.

Ars Technica · AI·Sep 7, 11:00 UTC · 9d agoAI industry

Hackers Impersonate IT Support on Microsoft Teams to Take Control of Employee PCs

Microsoft warns of a human-operated campaign where attackers pose as IT support in Teams to gain remote PC control and reach domain controllers.

Microsoft Threat Intelligence observed attackers abusing Microsoft Teams external collaboration to impersonate IT/helpdesk staff, persuading employees to grant screen control via Quick Assist or RMM tools. Operators deploy malicious MSI packages via silent msiexec, run encrypted JavaScript implants through portable Node.js, and persist via EdgeUpdate Run keys or Startup folder entries. The Node.js backdoor uses HTTPS long-polling C2, captures screenshots, enumerates Active Directory, and moves laterally over WinRM (TCP 5985) to domain controllers and certificate authorities. Initial access maps to MITRE ATT&CK T1566.003 (Spearphishing via Service); no Teams vulnerability is exploited.

GBHackers·Sep 8, 13:28 UTC · 8d agoPhishing & fraud in the wild

U.S. Agencies Accuse China AI Firms of Distilling Claude, GPT, Gemini, and Grok

NSA, CISA and FBI accuse Chinese AI firms including DeepSeek of industrial-scale distillation of Claude, GPT, Gemini and Grok since late 2024.

A joint bulletin from the NSA, CISA and FBI accuses China-based AI firms including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI of systematic, industrial-scale distillation of U.S. frontier models. The agencies say billions of tokens were extracted from Claude, GPT, Gemini and Grok variants since at least late 2024 through APIs, cloud relays, obfuscated accounts and gray-market proxies, likely with Chinese government backing. Firms allegedly shared premium subscriptions across developer teams and used chain-of-thought extraction and automated failover to evade blocks. Mitigations include subtly altering responses to suspected distillers and correlating activity across providers, clouds and aggregators.

The Hacker News·Sep 9, 09:32 UTC · 7d agoAI policy

This Key Will Self-Destruct: An Open Standard for Revocable API Keys

SecurityWeek opinion piece proposes ORKS, an open standard adding issuer prefixes, discovery files, and unauthenticated revocation endpoints to make leaked API keys quickly revocable.

The article argues that plain API keys leak frequently yet lack any standardized revocation mechanism, unlike OAuth tokens which gained RFC 7009 revocation in 2013, and that GitHub's Secret Scanning Partner Program solves this only in a proprietary, invite-only way. The author proposes ORKS (Open Revocable Key Standard), with a draft spec on GitHub, built on four parts: keys embedding their issuer domain in a fixed prefix format, a discoverable /.well-known/api-key-config JSON file, unauthenticated revocation by possession of the full key, and declared constraints such as IP allowlists, expiry, scopes, and mTLS. An optional quarantine mode inspired by Toyota's andon cord restricts a reported key to read-only and throttled operation for a default 24-hour window before automatic revocation. The piece frames AI agents as making this urgent, since agents hold many credentials, can exfiltrate them via prompt injection, and can leak secrets into logs at machine speed.

SecurityWeek·Sep 9, 10:00 UTC · 7d agoTools1

North Korea-linked Hackers Hide a Backdoor Inside HAProxy

Rapid7 reports North Korea-linked hackers implanted a backdoor compiled into HAProxy at South Korean automotive and media firms, enabling covert C2 and credential theft.

Rapid7 documented a previously undocumented Linux toolkit hitting South Korean automotive and media organizations, centered on a backdoor compiled directly into victims' HAProxy 2.8.12. The 'ted backdoor' uses HAProxy's native filter API to intercept HTTP traffic, receive C2 commands hidden in requests to a fake image path, and erase all traces from logs and counters; the toolkit also trojanizes crond, agetty, atd, sshd, and polkitd, adds an SSH keylogger, and runs curlRAT with virtualization checks. It can inject scripts or replace page content for selected victims, turning the load balancer into a watering hole. Attribution sits at medium confidence toward North Korean state actors, with overlaps to APT37-linked infrastructure and a concurrent Lazarus campaign; the campaign's command domains have since gone dark.

Security Affairs·Sep 8, 09:11 UTC · 8d agoThreat actor in the wild

Four in Five AI Tools Run with No IT Oversight, New Research Finds

Reco's research finds four in five AI tools run without IT oversight, linking expanding shadow AI usage to a surge in vulnerability disclosures.

Reco's new report states that roughly 80% of AI tools in organizations operate with no IT or security oversight. The research connects growing shadow AI adoption to an increasing number of vulnerability disclosures. The findings highlight governance gaps created by employees deploying unsanctioned AI services.

Infosecurity Magazine·Aug 26, 13:00 UTC · 21d agoAI safety & security

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

Rapid7 found a new backdoor, ted, compiled into trojanized HAProxy at two South Korean organizations, with medium-confidence attribution to North Korean actors.

Rapid7 documented a previously undocumented Linux toolkit named ted compiled into the HAProxy load balancer binaries of two South Korean organizations in the automotive and media sectors. The implant intercepts web traffic, serves altered pages only to filtered visitors, and hides C2 exchanges from backend logs and HAProxy statistics; a companion RAT, curlRAT, beacons on a default 12-hour schedule. The toolkit also trojanizes crond, sshd, agetty, atd, and polkitd binaries and sanitizes logs and bash history. Rapid7 attributes the activity with medium confidence to North Korean state-sponsored actors, with domain infrastructure overlapping APT37 listings in maltrail and delivery resembling the Operation SyncHole campaign.

The Hacker News·Sep 4, 14:51 UTC · 12d agoThreat actor in the wild

US Agencies Warn China Is Systematically Extracting Frontier AI Capabilities

NSA, CISA and FBI warn Chinese AI firms including DeepSeek and Moonshot systematically extracted billions of tokens from US frontier models since late 2024.

The NSA, CISA, and FBI report that China-based AI companies including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI extracted billions of tokens from US frontier models such as Claude, GPT-4/GPT-5, Gemini, and Grok 4 since late 2024. The distillation trained DeepSeek's R1 and V3 and Moonshot's Kimi-K2/K3 models, and the agencies mapped the tactics to MITRE ATLAS while noting additional novel techniques like subscription exploitation and request metadata sanitization. They describe the activity as a strategic economic threat to US technological leadership and recommend behavioral detection, differential privacy, and targeted cost-imposing responses.

SecurityWeek·Sep 9, 12:32 UTC · 7d agoAI safety & security in the wild1

50% of CISOs see Mythos as a sign to exit the profession

Survey of 1,001 US and UK CISOs finds 50% consider leaving the profession amid AI-driven pressure, personal liability concerns and burnout.

A survey of 1,001 CISOs in the US and UK found 50% say Anthropic's Mythos and similar cyber-capable AI models have made them consider exiting the profession, while 60% say board pressure to adopt AI is outpacing their governance capability. Average CISO tenure is cited at 18 months, and 78% worry about personal liability for security incidents, up from 56% a year earlier. Executives from BlackBerry, Databricks and IDC discuss D&O insurance, agentic security operations and phased low-risk AI adoption as partial responses.

CSO Online·Sep 9, 08:25 UTC · 7d agoIndustry

Most Fraudulent Hires Receive Credentials Before Detection

HYPR report finds 42% of fraudulent hires pass screening and receive corporate credentials, averaging 5.73 days of unmonitored network access before detection.

A HYPR study of 500 US HR executives found 42% of fraudulent candidates pass pre-hire screening and get hired, with only 3% detected on their hire day and 20% remaining undetected up to three weeks. This gives fraudulent hires an average of 5.73 days of unmonitored corporate network access, and 98% of surveyed executives said they had experienced candidate fraud firsthand. The report follows a September 9 CISA update to its Insider Threat Mitigation Guide warning that malicious actors use AI tools to obtain remote IT jobs, a tactic long used by North Korean actors for data theft and extortion.

Infosecurity Magazine·Sep 15, 15:15 UTC · 1d agoPhishing & fraud