(Malwarebytes) Lazarus Group is commonly believed to be run by the North Korean government, motivated primarily by financial gain as a method of circumventing long-standing sanctions against the regime. They first came to substantial media notice in 2013 with a series of coordinated attacks against an assortment of South Korean broadcasters and financial institutions using DarkSeoul, a wiper program that overwrites sections of the victims’ master boot record. In November 2014, a large scale breach of Sony Pictures was attributed to Lazarus. The attack was notable due to its substantial penetration across Sony networks, the extensive amount of data exfiltrated and leaked, as well of use of a wiper in a possible attempt to erase forensic evidence. Attribution on the attacks was largely hazy, but the FBI released a statement tying the Sony breach to the earlier DarkSeoul attack, and officially attributed both incidents to North Korea. Fast forward to May 2017 with the widespread outbreak of WannaCry, a piece of ransomware that used an SMB exploit as an attack vector. Attribution to North Korea rested largely on code reuse between WannaCry and previous North Korean attacks, but this was considered to be thin grounds given the common practice of tool sharing between regional threat groups. Western intelligence agencies released official statements to the public reaffirming the attribution, and on September 6, 2018, the US Department of Justice charged a North Korean national with involvement in both WannaCry and the Sony breach. Lazarus Group has 3 subgroups: 1. Subgroup: Andariel, Silent Chollima 2. Subgroup: BeagleBoyz 3. Subgroup: Bluenoroff, APT 38, Stardust Chollima 4. Subgroup: Operation Contagious Interview The following groups may be associated with the Lazarus Group: Covellite, Reaper, APT 37, Ricochet Chollima, ScarCruft, Wassonite and Moonstone Sleet.
Bitget, a crypto exchange, suffered a breach resulting in the theft of over $387 million. Bitget is utilizing a User Protection Fund to cover the losses and has initiated a recovery bounty program.
North Korean threat actor Jade Sleet (also known as PUKCHONG, Slow Pisces, TraderTraitor, and UNC4899) has been linked to a breach of an India-based IT services provider, continuing their targeting of developers and vend…
North Korean-aligned threat actors are deploying a sophisticated Linux espionage toolkit targeting automotive and media organizations in South Korea. The toolkit, incorporating a custom HAProxy plugin and various trojani…
A previously undocumented Linux toolkit, dubbed ‘ted,’ has been discovered embedded within trojanized HAProxy load balancers used by two South Korean organizations. Developed by North Korean state-sponsored actors (likel…
A Russian national, extradited from Cyprus, has been charged with using a network of fake accounts on a freelance platform to spread malware and steal data between 2016 and 2017. The campaign involved distributing malwar…
Microsoft has patched a critical vulnerability in Entra ID, which has been exploited in the wild. The flaw allows remote code execution, and while Microsoft has addressed it, it highlights the ongoing need for vigilance…
This week saw a surge in exploitation activity and new malware discoveries. A China-nexus APT is leveraging a newly patched VMware vulnerability to deploy a backdoor and ransomware (Babuk-derived). Simultaneously, a zero…
North Korean IT workers are increasingly infiltrating government and businesses by securing jobs through traditional hiring processes. The FBI is currently investigating a case where a North Korean remote worker was hire…
The Lazarus Group, a North Korean threat actor, is exploiting a newly patched zero-day vulnerability in Microsoft Windows' AFD.sys driver to gain SYSTEM access and deploy a backdoor called Troy. They are leveraging a sop…
Microsoft released a massive update with 62 critical and 357 important security vulnerabilities, marking a significant increase in the number of flaws discovered and highlighting the growing role of AI in vulnerability d…
The CISA has ordered federal agencies to patch a critical Windows vulnerability being actively exploited by North Korean hackers as part of Operation ‘Dream Job’. This campaign, led by the Lazarus Group, impersonates rec…
North Korean hackers, operating under the Lazarus Group, are exploiting a recently patched Windows zero-day vulnerability (CVE-2026-68820) to conduct targeted attacks against defense, aerospace, and aviation organization…
