Latest North Korea news

Lazarus hackers breach aerospace firm with new LightlessCan malware

The North Korean 'Lazarus' hacking group targeted employees of an aerospace company located in Spain with fake job opportunities to hack into the corporate network using a previously unknown 'LightlessCan' backdoor.
- Bill Toulas
- September 29, 2023
- 05:30 AM
- 1
Microsoft: North Korean hackers target Russian govt, defense orgs

Microsoft says North Korean hacking groups have breached multiple Russian government and defense targets since the start of the year.
- Sergiu Gatlan
- September 07, 2023
- 02:24 PM
- 1
Google: State hackers attack security researchers with new zero-day

Google's Threat Analysis Group (TAG) says North Korean state hackers are again targeting security researchers in attacks using at least one zero-day in an undisclosed popular software.
- Sergiu Gatlan
- September 07, 2023
- 12:48 PM
- 0
Lazarus hackers deploy fake VMware PyPI packages in VMConnect attacks

North Korean state-sponsored hackers have uploaded malicious packages to the PyPI (Python Package Index) repository, camouflaging one of them as a VMware vSphere connector module named vConnector.
- Bill Toulas
- August 31, 2023
- 02:47 PM
- 0
Hackers use public ManageEngine exploit to breach internet org

The North Korean state-backed hacker group tracked as Lazarus has been exploiting a critical vulnerability (CVE-2022-47966) in Zoho's ManageEngine ServiceDesk to compromise an internet backbone infrastructure provider and healthcare organizations.
- Bill Toulas
- August 24, 2023
- 08:31 AM
- 0
FBI: Lazarus hackers readying to cash out $41 million in stolen crypto

The FBI warned that North Koreans are likely readying to cash out tens of millions worth of stolen cryptocurrency out of hundreds of millions stolen in the last year alone.
- Sergiu Gatlan
- August 23, 2023
- 10:53 AM
- 0
North Korean hackers 'ScarCruft' breached Russian missile maker

The North Korean state-sponsored hacking group ScarCruft has been linked to a cyberattack on the IT infrastructure and email server for NPO Mashinostroyeniya, a Russian space rocket designer and intercontinental ballistic missile engineering organization.
- Bill Toulas
- August 07, 2023
- 10:57 AM
- 0
CoinsPaid blames Lazarus hackers for theft of $37,300,000 in crypto

Estonian crypto-payments service provider CoinsPaid has announced that it experienced a cyber attack on July 22nd, 2023, that resulted in the theft of $37,200,000 worth of cryptocurrency.
- Bill Toulas
- July 27, 2023
- 05:58 PM
- 0
Lazarus hackers linked to $60 million Alphapo cryptocurrency heist

Blockchain analysts blame the North Korean Lazarus hacking group for a recent attack on payment processing platform Alphapo where the attackers stole almost $60 million in crypto.
- Bill Toulas
- July 26, 2023
- 04:19 PM
- 1
Lazarus hackers hijack Microsoft IIS servers to spread malware

The North Korean state-sponsored Lazarus hacking group is breaching Windows Internet Information Service (IIS) web servers to hijack them for malware distribution.
- Bill Toulas
- July 24, 2023
- 04:34 PM
- 0
JumpCloud hack linked to North Korea after OPSEC mistake

A hacking unit of North Korea's Reconnaissance General Bureau (RGB) was linked to the JumpCloud breach after the attackers made an operational security (OPSEC) mistake, inadvertently exposing their real-world IP addresses.
- Sergiu Gatlan
- July 24, 2023
- 01:12 PM
- 2
GitHub warns of Lazarus hackers targeting devs with malicious projects

GitHub is warning of a social engineering campaign targeting the accounts of developers in the blockchain, cryptocurrency, online gambling, and cybersecurity sectors to infect their devices with malware.
- Lawrence Abrams
- July 20, 2023
- 06:48 PM
- 0
JumpCloud breach traced back to North Korean state hackers

US-based enterprise software company JumpCloud was breached by North Korean Lazarus Group hackers, according to security researchers at SentinelOne, CrowdStrike, and Mandiant.
- Sergiu Gatlan
- July 20, 2023
- 08:25 AM
- 0
New EarlyRAT malware linked to North Korean Andariel hacking group

Security analysts have discovered a previously undocumented remote access trojan (RAT) named 'EarlyRAT,' used by Andariel, a sub-group of the Lazarus North Korean state-sponsored hacking group.
- Bill Toulas
- June 29, 2023
- 01:39 PM
- 0
Lazarus hackers linked to the $35 million Atomic Wallet heist

The notorious North Korean hacking group known as Lazarus has been linked to the recent Atomic Wallet hack, resulting in the theft of over $35 million in crypto.
- Bill Toulas
- June 07, 2023
- 02:16 PM
- 0
NSA and FBI: Kimsuky hackers pose as journalists to steal intel

State-sponsored North Korean hacker group Kimsuky (a.ka. APT43) has been impersonating journalists and academics for spear-phishing campaigns to collect intelligence from think tanks, research centers, academic institutions, and various media organizations.
- Bill Toulas
- June 02, 2023
- 02:07 PM
- 1
Lazarus hackers target Windows IIS web servers for initial access

The notorious North Korean state-backed hackers, known as the Lazarus Group, are now targeting vulnerable Windows Internet Information Services (IIS) web servers to gain initial access to corporate networks.
- Bill Toulas
- May 29, 2023
- 09:00 AM
- 1
US sanctions orgs behind North Korea’s ‘illicit’ IT worker army

The Treasury Department's Office of Foreign Assets Control (OFAC) announced sanctions today against four entities and one individual for their involvement in illicit IT worker schemes and cyberattacks generating revenue to finance North Korea's weapons development programs.
- Sergiu Gatlan
- May 23, 2023
- 12:38 PM
- 1
North Korean hackers breached major hospital in Seoul to steal data

The Korean National Police Agency (KNPA) warned that North Korean hackers had breached the network of one of the country's largest hospitals, Seoul National University Hospital (SNUH), to steal sensitive medical information and personal details.
- Bill Toulas
- May 10, 2023
- 05:16 PM
- 0
Kimsuky hackers use new recon tool to find security gaps

The North Korean Kimsuky hacking group has been observed employing a new version of its reconnaissance malware, now called 'ReconShark,' in a cyberespionage campaign with a global reach.
- Bill Toulas
- May 04, 2023
- 05:40 PM
- 2