#North Korea
All CosmicBytez Labs articles tagged #North Korea, across news, security advisories, how-to guides, and projects.
- News
DOJ Dismantles Texas 'Laptop Farm' Network Behind $3 Million North Korean IT Worker Scheme
DOJ charged 14 people and raided 40+ Texas laptop farms that funneled $3M to North Korea via fake remote IT workers at 70 US firms.
- Newsletter
Oct 13 Digest: Ivanti's VPN Root-Access Chain, Microsoft's Record Patch Tuesday, $93M Ledger Implant Heist
This week: an Ivanti zero-day chain gave root access to patched VPNs, Microsoft shipped a record Patch Tuesday, and a $93M Ledger hardware implant surfaced.
- News
Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft
Bitget says attackers used a zero-day in third-party security tools to steal $387.5M from hot wallets, per SlowMist and Mandiant findings.
- News
Bitget Hacked via Zero-Day in Third-Party Security Products
Bitget says attackers who stole $387.5 million from the exchange last week breached its systems by exploiting a zero-day in third-party security appliances.
- News
Bitget Resumes Bitcoin Withdrawals After $387.5 Million North Korea-Linked Heist
Bitget restored BTC withdrawals Sep 28 in a phased restart after its $387.5M breach, with ETH, USDT, and fiat/P2P to follow through Oct. 2.
- News
Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M
Bitget says a zero-day in a third-party security product gave attackers internal credentials used to forge withdrawal commands and steal $388 million.
- News
Bitget Loses $351.6M in Suspected North Korean Backend Compromise
Bitget's hot wallets lost $351.6M — since revised toward $387.5M — after attackers spoofed its backend to approve fraudulent transfers.
- News
Crypto CEO Accuses North Korea of Stealing $387 Million From Bitget Platform
Bitget CEO Gracy Chen says North Korean hackers stole $387.5 million via a wallet system breach; a $464M User Protection Fund will cover losses.
- News
Bitget Hack Losses Climb to $387.5 Million as CEO Points to North Korea
Bitget's hack losses grew from an initial $351.6M estimate to $387.5M as North Korea-linked actors spoofed backend transfer approvals.
- News
Hackers Steal $351.6 Million in Bitget Crypto Exchange Hack
Bitget says $351.6M was drained from its hot and warm wallets on Sept. 24; the CEO points to IP evidence tied to a North Korea-linked hacking group.
- News
Stopping IT Worker Scams Requires Revamped HR Process
North Korean IT worker fraud is scaling with AI. Dark Reading details the HR red flags and automated vetting controls needed to stop it.
- News
Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme
Japan, the US, Germany and Australia detail WaterPlum's 30,000-device haul and Japan's first North Korean laptop farm takedown.
- Newsletter
Weekly Digest — Issue #36
Arista's VeloCloud takes a CVSS 10.0 under active attack, a Microsoft 'spoofing' bug turns out to be real RCE, and China loots government data.
- News
Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors
North Korea's Jade Sleet compromised an Indian IT firm's DevOps engineer via a fake job-interview repo, deploying two new Rust macOS backdoors.
- News
North Korean WaterPlum Hackers Infected 30,000 Devices Worldwide
A joint law enforcement advisory says DPRK-linked WaterPlum hackers compromised 30,000 devices and stole $10.7M in crypto via fake job interviews.
- News
FBI Warns of North Korean 'WaterPlum' Campaign Infecting Devices Across 100 Countries
FBI, DoD, and allied agencies detail 'WaterPlum,' a North Korean fake-recruiter scheme that stole $10.5M and infected 30,000+ devices.
- News
WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage
A stripped-down JS stealer hidden in 13 npm packages harvests Chrome extension storage, echoing North Korea-linked BeaverTail and OtterCookie.
- News
Cyber Op Targets South Korean Media & Automotive Sectors
A North Korea-aligned APT embedded a custom backdoor in HAProxy load balancers at two South Korean firms, intercepting decrypted traffic for months.
- News
'Ted' Backdoor Hides Inside Trojanized HAProxy Builds to Intercept Web Traffic
Rapid7 found a DPRK-linked Linux implant compiled into trojanized HAProxy binaries at two South Korean firms, hijacking traffic via hidden C2 channels.
- News
In Other News: Rapid7 Layoffs, Hacking a Boeing 737, Refrigeration System Vulnerabilities
Weekly roundup: Rapid7 cuts staff, researcher hacks Boeing 737 systems, North Korean IT worker breaches federal agency, DEF CON drama.
- News
Lazarus Hackers Exploited Windows Zero-Day to Target Defense Firms
North Korea's Lazarus Group weaponized CVE-2026-68820 in Operation Dream Job, hitting defense and aerospace firms across four countries for five weeks.
- News
In Other News: OpenAI Open Source Tool, AWS Links Hacks to North Korea, Mythos Crypto Research
This week's security roundup covers a parcel delivery company breach at OnTrac, Adobe's latest security patches, AWS attribution of recent cloud attacks...
- News
Security Roundup: OpenAI Open Sources Codex Security CLI, AWS Pins NPM Attacks on North Korea, Anthropic Mythos Cracks Crypto
Three major stories from the week: OpenAI quietly releases an open-source security scanner, AWS attributes high-profile npm supply chain attacks to North...
- News
Amazon Links Debug, Chalk NPM Supply Chain Attacks to North Korean Hackers
Amazon security researchers have attributed the compromise of widely used NPM packages including debug and chalk to a North Korea-linked threat group, in...
- News
North Korean Hackers Behind Major Open-Source Supply Chain Attacks, Amazon Says
Amazon security research has exposed a North Korea-linked hacker group as the orchestrators of multiple high-profile open-source software supply chain...
- News
South Korea Discloses Data Breach Impacting Diplomats Worldwide
South Korea's Ministry of Foreign Affairs has disclosed a data breach affecting approximately 10,000 diplomatic records after an unidentified attacker...
- News
North Korean Hackers Target Open Source Developers in Supply Chain Attacks
The PolinRider campaign has compromised more than 100 legitimate open source packages and repositories to deliver a backdoor and information stealer...
- News
North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets
JFrog researchers attribute a fresh npm supply chain campaign to North Korea's Lazarus Group. Malicious packages impersonating Rollup polyfill tooling...
- News
North Korean Hackers Publish 108 Malicious Packages in PolinRider Campaign
Threat actors linked to North Korea's Contagious Interview campaign have published 108 malicious packages and browser extensions across npm, Packagist,...
- News
Microsoft Links Mastra AI Supply Chain Attack to North Korean Hackers
Microsoft has attributed a 88-minute automated supply chain attack against 142 Mastra AI npm packages — with over 1.1 million combined weekly downloads —...
- Newsletter
June 17 Digest: Teams C2 Evasion, Copilot Data Theft, iRhythm Breach, cPanel KEV
DragonForce hides C2 inside Microsoft Teams relay traffic; a SearchLeak attack weaponizes M365 Copilot for one-click data exfiltration; iRhythm confirms...
- News
Fake Microsoft Security Alerts Used to Deploy North Korean NarwhalRAT Malware
North Korean state-sponsored group APT37 (ScarCruft) is conducting spear-phishing campaigns impersonating Microsoft Account security notifications to...
- News
American Duo Sentenced for Hosting Laptop Farms for North
Two U.S. men have been sentenced for operating laptop farms that helped North Korean IT workers fraudulently obtain employment at nearly 70 American...
- News
Crypto Infrastructure Company Blames $290 Million Theft on North Korean Hackers
A major cryptocurrency infrastructure company has attributed a $290 million theft to North Korean state-sponsored hackers, as the industry continues to...
- Newsletter
Apr 21 Digest: Vercel AI Tool Breach, DPRK $290M, ActiveMQ
Vercel confirms breach through a compromised third-party AI coding tool; North Korean hackers attributed to a $290 million crypto theft; 6,400 Apache...
- News
KelpDAO Suffers $290 Million Heist Tied to Lazarus Hackers
North Korean state-sponsored hackers from the Lazarus Group are behind a $290 million cryptocurrency theft from DeFi platform KelpDAO, marking one of the...
- News
Why the Axios Attack Proves AI Is Mandatory for Supply
The North Korean supply chain attack on Axios — a JavaScript library with 100 million weekly downloads — highlights why human-scale monitoring can no...
- News
New Jersey Men Sentenced to Combined 17 Years for Running
Two New Jersey men received prison sentences of nine and nearly eight years respectively for operating IT laptop farms that funneled over $5 million to...
- News
'It Reads Like a Spy Novel': $280M Drift Theft Linked to North Korean Fake Companies
A post-mortem of the $280 million Drift Protocol crypto theft reveals a sophisticated six-month North Korean social engineering operation involving fake...
- News
Drift $280M Crypto Theft Linked to 6-Month In-Person DPRK
Drift Protocol has revealed that the $280 million hack it suffered was the culmination of a six-month long operation in which North Korean-linked threat...
- Newsletter
Apr 7 Digest: Medusa Ransomware Surge, FBI $21B Record
Storm-1175 runs sub-24-hour Medusa ransomware campaigns using zero-days; the FBI IC3 reports a record $21 billion in US cybercrime losses for 2025; North...
- News
Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits
This week's biggest cybersecurity stories: a North Korean supply chain attack hit the Axios npm package, a new Chrome zero-day under active exploitation,...
- News
$285 Million Drift Hack Traced to Six-Month DPRK Social
Drift has confirmed the April 1, 2026, theft of $285 million resulted from a meticulously planned six-month North Korean social engineering operation that...
- News
Axios npm Hack Used Fake Teams Error Fix to Hijack
The Axios HTTP client post-mortem reveals North Korean threat actors used a ClickFix-style fake Microsoft Teams error message to socially engineer a...
- News
UNC1069 Social Engineering of Axios Maintainer Led to npm
The North Korean threat actor UNC1069 used a sophisticated, targeted social engineering campaign against the Axios npm package maintainer Jason Saayman to...
- News
Drift Crypto Platform Confirms $280 Million Stolen as
Drift Protocol has confirmed that $280 million was stolen in a sophisticated hack after malicious actors executed a novel attack that achieved the rapid...
- News
Axios NPM Package Breached in North Korean Supply Chain
A long-lived NPM access token was used to bypass the GitHub Actions OIDC-based CI/CD publishing workflow and push backdoored versions of the widely used...
- News
Google Attributes Axios npm Supply Chain Attack to North
Google's Threat Intelligence Group has formally attributed the supply chain compromise of the popular Axios npm package to UNC1069, a financially...
- Newsletter
Mar 11 Digest: npm Supply Chain Seizes AWS Admin, 3.4M
This week: UNC6426 weaponizes a stale npm supply chain compromise to seize full AWS admin in 72 hours, Cognizant TriZetto leaks 3.4 million patient...
- News
North Korea's UNC4899 Breached Crypto Firm via AirDropped
North Korean threat actor UNC4899 compromised a cryptocurrency organization after a developer AirDropped a trojanized archive from a personal device to a...
- News
All Four Major Nation-State Adversaries Now Weaponizing
Google reports that APT groups from China, Russia, Iran, and North Korea are all actively using Gemini AI for cyber operations including target...
- News
Lazarus Group Plants 192 Malicious Packages in npm and PyPI
North Korea's Lazarus Group is running a fake recruitment campaign codenamed Graphalgo, planting 192 malicious packages on npm and PyPI that target...
- News
North Korea Deploys AI-Generated Video and ClickFix
North Korean threat actors are running sophisticated campaigns using AI-generated deepfake videos and the ClickFix social engineering technique to target...
- News
North Korean Hackers Use Fake Zoom Meeting to Target Crypto
UNC1069, a North Korean APT group, deployed a sophisticated ClickFix scam using a fake Zoom meeting to target a cryptocurrency executive in a social...