Search: “dprk”

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.

Rapid7 Labs identified a previously undocumented framework attributed with medium confidence to DPRK actors, targeting South Korean automotive and media organizations likely since early 2025. The toolkit embeds a backdoor compiled into HAProxy 2.8.12 using its filter API, plus trojanized crond, agetty, atd, sshd, and polkitd, an SSH keylogger storing credentials under /var/lib/sshd/, and a curl-based RAT with a watchdog thread. It enables remote command execution, malicious script injection into served webpages (a watering-hole loop), credential harvesting, and long-term surveillance. Hardcoded C2s are associated with APT37 via ThreatFox, and exposed groupware portals and mail servers align with Kimsuky tradecraft; the initial access vector and any CVE remain unconfirmed.

Rapid7 Blog·Sep 4, 12:00 UTC · 12d agoThreat actor in the wild1

North Korea-linked IT Workers Are Getting Hired Inside Western Companies

Huntress documented five DPRK-linked FAMOUS CHOLLIMA workers hired by Western companies in 2026 using fake identities, proxies and laptop farms.

Huntress published an investigation of five confirmed 2026 cases of North Korea-linked IT workers, tracked as FAMOUS CHOLLIMA, obtaining remote jobs at legitimate companies in IT, sales, marketing and healthcare. The workers use stolen or fabricated identity documents, VPNs and proxy services, and some were caught using PiKVM hardware-level control, travel routers and laptop farms to mask their true location. Detection relied on document forensics, behavioral anomalies and indicators like identical typo artifacts in electricity bills rather than network intrusions.

Security Affairs·Sep 1, 11:08 UTC · 15d agoThreat actor in the wild

Insights into Suspected DPRK Workers

Huntress details incidents involving suspected DPRK remote workers (Famous Chollima) in partner environments and shares detection indicators.

Huntress analyzed several incidents involving suspected North Korean remote workers, associated with the activity cluster known as Famous Chollima. The report describes indicators defenders can use to detect and prevent DPRK worker infiltration in customer environments. The scheme centers on operatives obtaining remote jobs at Western companies under assumed identities.

Huntress·Aug 26, 04:00 UTC · 21d agoThreat actor in the wild

North Korean remote workers are broadening their job hunt beyond IT

Huntress links suspected North Korean remote workers to sales, marketing, and healthcare jobs using stolen identities, VPNs, proxies, and KVM hardware.

Huntress investigations identified suspected DPRK remote workers hired beyond IT in sales, marketing, and healthcare/financial organizations, sometimes actually performing the work they were hired for. Fraudulent documents included passports from the same city issued one day apart, ID cards with identical validity dates, and electricity bills built from the same online template with matching typos. A financial-services case found a PiKVM and Guermok USB capture card on a new hire's laptop within hours of delivery, suggesting a laptop farm, and another hire used a police mugshot with the photo digitally swapped. Researchers urge rigorous background checks and identity verification at the interview stage.

Help Net Security·Aug 28, 00:00 UTC · 19d agoPhishing & fraud in the wild

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Malicious versions of the Rust crate arrayref executed a compile-time backdoor, with infrastructure overlapping recent DPRK supply chain attacks on Mastra and axios.

Wiz researchers report that malicious versions of the arrayref Rust crate ran a backdoor during compilation, compromising developer build pipelines. The campaign's command-and-control infrastructure significantly overlaps with infrastructure used in recent DPRK supply chain attacks, including campaigns against Mastra and axios. Developers using affected crate versions should audit their builds and review dependencies.

Wiz Blog·Aug 20, 15:56 UTC · 27d agoThreat actor in the wild1

North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring

Researchers expose DPRK remote IT worker infiltration tactics, including forged identities and AI-assisted interview behavior.

A joint investigation by Mauro Eldritch, Heiner García, and ANY.RUN hired suspected DPRK developers linked to Lazarus Group into controlled sandboxes, revealing forged IDs, remote-access tools, AI-assisted workflows, and VPN/VPS infrastructure. The FBI is investigating a North Korean remote IT worker who reportedly worked for a U.S. federal agency. The article outlines verification steps and indicators including VPS and AstrillVPN exit node IPs.

The Hacker News·Aug 15, 00:00 UTC · Aug 15, 2026Threat actor in the wild

Disrupting a new covert influence campaign from Russia

OpenAI banned Russia-origin accounts that used AI tools to run a covert influence campaign behind a fake Israel-based think tank and pro-Russia sovereignty index.

OpenAI disrupted and banned accounts of Russia origin that were using its AI tools to conduct a covert influence operation. The campaign promoted a fictitious Israel-based think tank and a 'sovereignty' index praising Russia while criticizing Western countries. The action is part of OpenAI's ongoing monitoring and disruption of malicious uses of AI for influence operations.

OpenAI News·Aug 25, 00:00 UTC · 22d agoAI safety & security

DianShi-RxnDB: A Large-Scale, Fine-Grained Organic Reaction Data Platform Built via a Fully Automated Pipeline for Researchers and AI Agents

Researchers release DianShi-RxnDB, a database of roughly 24 million organic reaction instances extracted automatically from USPTO and EPO patents since 1976.

DianShi-RxnDB is built by a fully automated pipeline integrating patent text, images, and reaction schemes, yielding about 24 million reaction instances, of which 14.8 million (61.7%) pass automated qualification checks. Manual evaluation of 1,300 sampled instances showed 92.95% field-level accuracy, and comparisons with Pistachio found advantages in deduplicated record counts and granularity. The platform offers a web research workbench and a Model Context Protocol (MCP) service enabling AI agents to perform composable structured retrieval.

Hugging Face daily papers·Sep 5, 20:00 UTC · 11d agoAI research

North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales

North Korea's IT worker scheme (Famous Chollima/PurpleDelta) has expanded from IT into healthcare, sales, and financial services roles worldwide.

Huntress and Recorded Future documented DPRK-linked fraudulent workers landing remote jobs beyond IT, including at an Australian healthcare company, a financial services firm, and a sales hire with a stolen identity. The scheme, tracked as Famous Chollima, Jasper Sleet, Nickel Tapestry, PurpleDelta, UNC5267, and Wagemole, uses forged identity documents, VPNs, proxies, and laptop farms with PiKVM and capture cards to fund Pyongyang's weapons programs. Recorded Future found the PurpleDelta cluster applied to 1,100+ companies between late 2024 and early 2025 with 22 fabricated personas, some AI-generated, using ChatGPT and AI transcription during interviews. Analysts assess the activity is ongoing and likely to expand in scale and sophistication.

The Hacker News·Sep 1, 06:34 UTC · 15d agoThreat actor in the wild

North Korean Hackers Tied to Rust Supply Chain Attack

Researchers linked a backdoor hidden in compromised Rust packages to North Korean actors' prior software supply chain attack campaigns.

Cybersecurity researchers attributed a malicious backdoor planted in compromised Rust packages to North Korean threat actors based on ties to earlier supply chain attacks. The campaign targets the open-source developer ecosystem, where infected packages can propagate downstream to developer build systems. The attribution suggests DPRK-aligned actors continue investing in open-source supply chain tradecraft.

Infosecurity Magazine·Aug 21, 12:40 UTC · 26d agoThreat actor in the wild

CISA gives federal agencies two weeks to patch Microsoft bug exploited in DPRK campaign

CISA orders federal agencies to patch exploited Windows Winsock zero-day CVE-2026-68820 by August 25, used by Lazarus in Operation Dream Job.

CISA ordered federal agencies to patch Windows Winsock vulnerability CVE-2026-68820, rated 7/10, by August 25 after confirming exploitation; no workaround exists and a restart is required. Check Point found Lazarus Group hackers impersonated Lockheed Martin and Enveil recruiters on LinkedIn, sent malicious PDFs enabling long-term remote access, then used the zero-day to escalate from limited access to full system control. Targets spanned defense sectors including surveillance, drones and robotics in France, Germany, Brazil and India, as part of Operation Dream Job tracked since 2020.

The Record·Aug 12, 12:12 UTC · Aug 12, 2026Exploit / PoC in the wildCVE-2026-688201

Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited

Help Net Security's weekly digest highlights 274 compromised Zimbra servers, Gitea and Citrix NetScaler KEV additions, a PaperCut zero-day, and a suspected Iran-linked power plant attack.

The roundup reports at least 274 internet-facing Zimbra instances compromised via CVE-2026-73570, critical Gitea CVE-2026-60004 added to CISA's KEV catalog after exploitation began, and previously patched Citrix NetScaler flaw CVE-2026-8452 exploited in the wild. It also covers PaperCut NG/MF zero-day attacks, a suspected Iran-linked shutdown of a UK power plant, an FBI seizure of domains tied to a China-linked group that hit NASA, DOJ and the Senate, a cyberattack disrupting Boston Scientific, and the Manchester Airports Group breach. Additional items include Chameleon SEO poisoning phishing, Android car head unit proxy botnet malware, ReliaQuest social engineering by ShinyHunters, fake OpenAI Codex macOS malware, and AI-related workforce and supply chain interviews.

Help Net Security·Aug 30, 00:00 UTC · 17d agoIndustry in the wildCVE-2026-73570CVE-2026-60004CVE-2026-8452

North Korean Hackers Deploy New Linux Espionage Toolkit

Rapid7 says North Korea-aligned actors use a new Linux espionage toolkit (ted HAProxy backdoor, CurlRAT) against South Korean automotive and media targets.

Rapid7 reports a stealthy Linux framework comprising a custom HAProxy backdoor ('ted'), trojanized system binaries (agetty, atd, crond, polkitd, sshd), an SSH keylogger, and CurlRAT that polls C&C every 12 hours. Initial access came via a Groupware login portal flaw, with credential harvesting enabling lateral movement to internal systems. The toolkit supports long-term surveillance, HTTP traffic interception/injection, and drive-by downloads, likely in use since late 2024. Infrastructure and artifacts overlap Operation SyncHole, suggesting Lazarus or APT37 involvement.

SecurityWeek·Sep 7, 12:12 UTC · 9d agoThreat actor in the wild1

Security Affairs newsletter Round 594 by Pierluigi Paganini – INTERNATIONAL EDITION

Weekly Security Affairs newsletter aggregates top stories including Cisco FMC exploitation, Qilin ransomware, Chrome zero-days, and Berlin leak.

Pierluigi Paganini's Security Affairs newsletter Round 594 (International Edition) rounds up the week's security headlines. Topics include attackers exploiting a critical Cisco FMC flaw to deploy Qilin ransomware, SonicWall mass exploitation linked to a UK council attack, multiple CISA KEV additions, Chrome zero-days used by four nation-state actors, a $320 million Liquid Network theft, and a Berlin ransomware data leak. It also covers AI security items such as agent sandbox failures and distillation campaigns by Chinese AI firms.

Security Affairs·Sep 13, 14:23 UTC · 3d agoIndustry in the wildCVE-2026-42016CVE-2026-42018CVE-2026-82329+1 CVEs1

North Korea-linked Hackers Hide a Backdoor Inside HAProxy

Rapid7 reports North Korea-linked hackers implanted a backdoor compiled into HAProxy at South Korean automotive and media firms, enabling covert C2 and credential theft.

Rapid7 documented a previously undocumented Linux toolkit hitting South Korean automotive and media organizations, centered on a backdoor compiled directly into victims' HAProxy 2.8.12. The 'ted backdoor' uses HAProxy's native filter API to intercept HTTP traffic, receive C2 commands hidden in requests to a fake image path, and erase all traces from logs and counters; the toolkit also trojanizes crond, agetty, atd, sshd, and polkitd, adds an SSH keylogger, and runs curlRAT with virtualization checks. It can inject scripts or replace page content for selected victims, turning the load balancer into a watering hole. Attribution sits at medium confidence toward North Korean state actors, with overlaps to APT37-linked infrastructure and a concurrent Lazarus campaign; the campaign's command domains have since gone dark.

Security Affairs·Sep 8, 09:11 UTC · 8d agoThreat actor in the wild

Weekly Cybersecurity Newsletter – Top 50 Biggest Cybersecurity Stories of the Week

GBHackers weekly digest rounds up 50 stories including Microsoft's 973-CVE patch drop, exploited Cisco FMC flaws, and Claude agent attacks.

GBHackers' September 7-12, 2026 newsletter summarizes the 50 biggest cybersecurity stories of the week. Highlights include Microsoft patching a record 973 CVEs with two exploited zero-days, active exploitation of Cisco FMC, Check Point VPN and Ivanti flaws, China-linked crews chaining Chrome and Windows zero-days, AI agents mass-exploiting PaperCut to compromise 440 servers, and the emergence of Panzer cross-platform ransomware. It also covers Anthropic and OpenAI agentic AI incidents and CrowdStrike's SafeMind launch.

GBHackers·Sep 15, 11:44 UTC · 1d agoIndustry in the wild

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

Rapid7 found a new backdoor, ted, compiled into trojanized HAProxy at two South Korean organizations, with medium-confidence attribution to North Korean actors.

Rapid7 documented a previously undocumented Linux toolkit named ted compiled into the HAProxy load balancer binaries of two South Korean organizations in the automotive and media sectors. The implant intercepts web traffic, serves altered pages only to filtered visitors, and hides C2 exchanges from backend logs and HAProxy statistics; a companion RAT, curlRAT, beacons on a default 12-hour schedule. The toolkit also trojanizes crond, sshd, agetty, atd, and polkitd binaries and sanitizes logs and bash history. Rapid7 attributes the activity with medium confidence to North Korean state-sponsored actors, with domain infrastructure overlapping APT37 listings in maltrail and delivery resembling the Operation SyncHole campaign.

The Hacker News·Sep 4, 14:51 UTC · 12d agoThreat actor in the wild

Threat actors are coming for your AI assets to operationalize their use of AI

Google GTIG reports espionage and crime groups stealing AI models, prompts, and API credentials, plus distillation campaigns and agentic AI attack automation.

Google Threat Intelligence Group's quarterly AI Threat Tracker reports adversaries stealing proprietary models, source code, prompts, and API credentials from government, healthcare, and media targets, including China-based UNC6508 compromising clouds to run unauthorized LLM workloads. Distillation campaigns against Google's models exceeded 100 million prompts launched via thousands of stolen account credentials through proxy networks. Mandiant also observed a financially motivated actor deploy an autonomous multi-agent framework that harvested thousands of third-party credentials in under 6 hours, and a 'Recon' framework on a live C2 server managing over 23,000 stolen credentials including cloud and AI API keys.

CSO Online·Sep 15, 08:25 UTC · 1d agoThreat actor in the wild

Russian suspect in bank account takeovers is extradited to US

Russian developer Sergei Filimonov was extradited to the U.S. and pleaded not guilty to multimillion-dollar bank account takeover fraud.

Sergei Anatolyevich Filimonov, a 36-year-old Russian web developer, has been extradited to the United States to face an indictment in a multimillion-dollar bank account takeover scheme. He appeared in Atlanta federal court on September 4 and pleaded not guilty to fraud charges. Federal authorities announced the extradition on Tuesday.

DataBreaches.net·Sep 9, 12:08 UTC · 7d agoPolicy & legal1

Risky Bulletin: The EU publishes its upcoming cybersecurity standards

ETSI releases 17 draft cybersecurity standards vendors must meet when the EU Cyber Resilience Act takes effect in December 2027.

The European Telecommunications Standards Institute published 17 interim draft standards covering operating systems, routers, firewalls, VPNs, SIEMs, browsers, password managers, smart home devices, toys and wearables. They mandate basic security features such as post-sale updates, shipped SBOMs, modern cryptography and secure-by-default settings; public comments run until November, with final versions expected in December, one year before CRA compliance begins in December 2027. The newsletter also reports Irregular taking responsibility for AI test-environment escapes involving Anthropic and Meta frontier models, a breach at France's tax agency exposing 678,000+ citizens' data claimed by hacker ZeroBytes, and Kazakhstan eGov data covering 15 million citizens listed for sale on an underground forum. Additional briefs cover a $3.2 million Harmony Protocol theft crashing the ONE token 40%, Columbus Police still restoring systems two years after ransomware, DDoS attacks on Threema's provider, and Ukraine's GUR claiming a cyberattack on Wildberries.

Risky Business News·Aug 17, 05:03 UTC · Aug 17, 2026Policy & legal2

Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras

Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.

Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.

Risky Business News·Aug 19, 04:52 UTC · 28d agoThreat actor in the wild1

Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated)

Trojanized 3CXDesktopApp installers for Windows and macOS loaded RC4-encrypted shellcode delivering a backdoor to hundreds of thousands of 3CX users.

Threat actors compromised the 3CXDesktopApp build process, adding malicious libraries (ffmpeg.dll, d3dcompiler_47.dll) to installers downloaded from the developer's website. The Windows MSI loader decrypts embedded shellcode with RC4, sleeps for a random 1-4 weeks, then beacons to C2 hidden in icon files on GitHub. Unit 42 fingerprinted 247,277 IPs across 199 countries using 3CX applications and blocked shellcode execution at 127 Cortex XDR customers between March 9-30, 2023.

Palo Alto Unit 42·Aug 17, 12:18 UTC · Aug 17, 2026Threat actor in the wild1

Russian national extradited to US for alleged involvement in bank-account takeover scheme

US extradited Russian national Sergei Filimonov over a bank-account takeover scheme using spoofed bank domains that defrauded two banks of $6.3 million.

US authorities extradited 36-year-old Russian national Sergei Anatolyevich Filimonov from the Republic of Georgia on charges including bank and wire fraud conspiracy and aggravated identity theft. He and unnamed co-conspirators allegedly ran spoofed bank domains, bought sponsored links to lure victims, and harvested over 5,000 victim login credentials starting in November 2023, causing unauthorized transfers of about $5.58 million and $735,000 from two banks in 2024. The FBI previously identified at least 19 US victims linked to the credential-storage domain, with roughly $28 million in attempted losses including $14.6 million confirmed. Filimonov faces up to 175 years in prison, pleaded not guilty on September 4, and remains detained in the Northern District of Georgia.

CyberScoop·Sep 8, 20:32 UTC · 8d agoPolicy & legal

Trojanized npm Packages Employ NullReceiver Tactic to Decode C2 IP from Blockchain

The Hacker News·Aug 6, 10:08 UTC · Aug 6, 2026Malware

Cyber Op Targets South Korean Media & Automotive Sectors

Likely North Korean APT compromised load balancers at South Korean media and automotive firms using a previously undocumented Linux espionage toolkit.

A cyber operation attributed to a likely North Korean APT group targeted South Korean media and automotive sectors. The attackers deployed a previously undocumented Linux espionage toolkit to compromise load balancers, gaining access to communications and enabling further network exploitation. Specific victims, toolkit names, and indicators of compromise were not disclosed in the report summary.

Dark Reading·01:00 UTC · 21h agoThreat actor in the wild

North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters

Sekoia and Kudelski Security reclassify North Korea's Lazarus umbrella into six clusters spanning espionage, financial theft, and fake IT worker operations.

New research by Sekoia and Kudelski Security, published September 7, divides the former Lazarus umbrella into TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet, and Famous Chollima, mostly under North Korea's military intelligence bureau (GRIB). The former APT38 likely split into CryptoCore and Jade Sleet, focused on cryptocurrency, Web3, and blockchain targets. Moonstone Sleet combines espionage with financially motivated operations, using custom malware alongside Qilin ransomware-as-a-service. Thousands of fake IT workers generate regime revenue and provide access, linked to incidents like the $62.5M Munchables protocol theft.

Infosecurity Magazine·Sep 7, 11:00 UTC · 9d agoThreat actor

Researching Employment Scams

Schneier highlights research into North Korean fake-employment IT-worker scams that embed operatives in remote roles for long-term insider access.

The post discusses research into employment scams in which fabricated remote workers, associated with North Korean IT-worker schemes, embed in organizations for months or years to exfiltrate data or position for financial theft. Researchers used controlled sandbox environments to observe operatives syncing personal accounts and working under false identities. Commenters also note reverse scams targeting desperate job seekers through high-pressure MLM and door-to-door sales schemes.

Schneier on Security·Sep 3, 11:18 UTC · 13d agoPhishing & fraud

Britain’s next war won’t be an away game: Q&A with former head of Defence Intelligence

The Record·Aug 4, 16:28 UTC · Aug 4, 2026Threat actor

AI Is Giving Lesser-Resourced Attackers Nation-State-Level Reach, Google Warns

Google's Threat Intelligence Group warns AI now gives lesser-resourced criminal and nation-state attackers nation-state-level speed and scale, citing TeamPCP, Basin Castle, APT42, and APT24 usage.

GTIG documented throughout 2026 that adversaries increasingly use AI to automate and scale attacks. TeamPCP (UNC6780) used an AI coding chatbot with agent instructions to plan and execute a mass credential harvesting campaign in under six hours, and has compromised PyPI, npm, and Docker Hub since March 2026 with its Dustmaker credential stealer plus released tools Shai-Hulud and Miasma. PRC-nexus Basin Castle uses LLMs for target profiling, lure drafting, and malware development; APT42 (Calanque Ion) uses Gemini for OSINT and localized lures; APT24 (Ravine Castle) uses Gemini across the full attack lifecycle; and DPRK's Midnight Neptune (UNC1069) integrates AI into cryptocurrency theft. Google responds by disrupting attacker accounts and hardening models against distillation attacks.

SecurityWeek·Sep 9, 16:56 UTC · 7d agoThreat actor in the wild2