Latest North Korea news

DPRK hacking groups breach South Korean defense contractors

The National Police Agency in South Korea issued an urgent warning today about North Korean hacking groups targeting defense industry entities to steal valuable technology information.
- Bill Toulas
- April 23, 2024
- 12:56 PM
- 0
Hackers hijack antivirus updates to drop GuptiMiner malware

North Korean hackers have been exploiting the updating mechanism of the eScan antivirus to plant backdoors on big corporate networks and deliver cryptocurrency miners through GuptiMiner malware.
- Bill Toulas
- April 23, 2024
- 10:56 AM
- 0
ScreenConnect flaws exploited to drop new ToddlerShark malware

The North Korean APT hacking group Kimsuky is exploiting ScreenConnect flaws, particularly CVE-2024-1708 and CVE-2024-1709, to infect targets with a new malware variant dubbed ToddlerShark.
- Bill Toulas
- March 04, 2024
- 05:14 PM
- 0
North Korea hacks two South Korean chip firms to steal engineering data

The National Intelligence Service (NIS) in South Korea warns that North Korean hackers target domestic semiconductor manufacturers in cyber espionage attacks.
- Bill Toulas
- March 04, 2024
- 09:46 AM
- 0
New executive order bans mass sale of personal data to China, Russia

U.S. President Joe Biden has signed an executive order that aims to ban the bulk sale and transfer of Americans' private data to "countries of concern" such as China, Russia, Iran, North Korea, Cuba, and Venezuela.
- Sergiu Gatlan
- February 28, 2024
- 03:50 PM
- 8
Lazarus hackers exploited Windows zero-day to gain Kernel privileges

North Korean threat actors known as the Lazarus Group exploited a flaw in the Windows AppLocker driver (appid.sys) as a zero-day to gain kernel-level access and turn off security tools, allowing them to bypass noisy BYOVD (Bring Your Own Vulnerable Driver) techniques.
- Bill Toulas
- February 28, 2024
- 12:24 PM
- 1
Japan warns of malicious PyPi packages created by North Korean hackers

Japan's Computer Security Incident Response Team (JPCERT/CC) is warning that the notorious North Korean hacking group Lazarus has uploaded four malicious PyPI packages to infect developers with malware.
- Bill Toulas
- February 28, 2024
- 10:04 AM
- 0
North Korean hackers linked to defense sector supply-chain attack

In an advisory today Germany's federal intelligence agency (BfV) and South Korea's National Intelligence Service (NIS) warn of an ongoing cyber-espionage operation targeting the global defense sector on behalf of the North Korean government.
- Bill Toulas
- February 19, 2024
- 03:24 PM
- 0
North Korean hackers now launder stolen crypto via YoMix tumbler

The North Korean hacker collective Lazarus, infamous for having carried out numerous large-scale cryptocurrency heists over the years, has switched to using YoMix bitcoin mixer to launder stolen proceeds.
- Bill Toulas
- February 16, 2024
- 09:31 AM
- 5
Orbit Chain loses $86 million in the last fintech hack of 2023

Orbit Chain has experienced a security breach that has resulted in a loss of $86 million in cryptocurrency, particularly Ether, Dai, Tether, and USD Coin.
- Bill Toulas
- January 02, 2024
- 02:46 PM
- 0
Lazarus hackers drop new RAT malware using 2-year-old Log4j bug

The notorious North Korean hacking group known as Lazarus continues to exploit CVE-2021-44228, aka "Log4Shell," this time to deploy three previously unseen malware families written in DLang.
- Bill Toulas
- December 11, 2023
- 04:25 PM
- 0
North Korea's state hackers stole $3 billion in crypto since 2017

North Korean-backed state hackers have stolen an estimated $3 billion in a long string of hacks targeting the cryptocurrency industry over the last six years since January 2017.
- Sergiu Gatlan
- December 03, 2023
- 12:11 PM
- 1
US govt sanctions North Korea’s Kimsuky hacking group

The Treasury Department's Office of Foreign Assets Control (OFAC) has sanctioned the North Korean-backed Kimsuky hacking group for stealing intelligence in support of the country's strategic goals.
- Sergiu Gatlan
- November 30, 2023
- 05:08 PM
- 2
UK and South Korea: Hackers use zero-day in supply-chain attack

A joint advisory by the National Cyber Security Centre (NCSC) and Korea's National Intelligence Service (NIS) discloses a supply-chain attack executed by North Korean hackers involving the MagicLineThe National Cyber Security Centre (NCSC) and Korea's National Intelligence Service (NIS) warn that the North Korean Lazarus hacking grou
- Bill Toulas
- November 24, 2023
- 12:28 PM
- 0
Microsoft: Lazarus hackers breach CyberLink in supply chain attack

Microsoft says a North Korean hacking group has breached Taiwanese multimedia software company CyberLink and trojanized one of its installers to push malware in a supply chain attack targeting potential victims worldwide.
- Sergiu Gatlan
- November 22, 2023
- 01:06 PM
- 0
Microsoft: BlueNoroff hackers plan new crypto-theft attacks

Microsoft warns that the BlueNoroff North Korean hacking group is setting up new attack infrastructure for upcoming social engineering campaigns on LinkedIn.
- Sergiu Gatlan
- November 10, 2023
- 03:40 PM
- 0
BlueNoroff hackers backdoor Macs with new ObjCShellz malware

The North Korean-backed BlueNoroff threat group targets Apple customers with new macOS malware tracked as ObjCShellz that can open remote shells on compromised devices.
- Sergiu Gatlan
- November 07, 2023
- 03:26 PM
- 0
New macOS 'KandyKorn' malware targets cryptocurrency engineers

A new macOS malware dubbed 'KandyKorn' has been spotted in a campaign attributed to the North Korean Lazarus hacking group, targeting blockchain engineers of a cryptocurrency exchange platform.
- Bill Toulas
- November 02, 2023
- 03:22 PM
- 0
Lazarus hackers breached dev repeatedly to deploy SIGNBT malware

The North Korean Lazarus hacking group repeatedly compromised a software vendor using flaws in vulnerable software despite multiple patches and warnings being made available by the developer.
- Bill Toulas
- October 27, 2023
- 12:15 PM
- 0
North Korean hackers exploit critical TeamCity flaw to breach networks

Microsoft says that the North Korean Lazarus and Andariel hacking groups are exploiting the CVE-2023-42793 flaw in TeamCity servers to deploy backdoor malware, likely to conduct software supply chain attacks.
- Lawrence Abrams
- October 18, 2023
- 06:33 PM
- 0