DPRK

DPRK refers to North Korean state-sponsored cyber threat actors and DPRK-affiliated operators. Aliases in the provided content include Democratic People’s Republic of Korea (DPRK), North Korea, DPRK actors, DPRK-affiliated actors, DPRK-aligned actors, DPRK APT, DPRK cyber threat actors, DPRK operatives, and North Korean state-sponsored threat actors. The content describes DPRK as a nation-state threat, particularly prominent in financially motivated cyber operations and cryptocurrency theft, with reporting that North Korean hackers stole at least $2.02 billion in cryptocurrency in 2025, including the $1.5 billion Bybit theft, and that DPRK-linked thefts represented a major share of overall crypto losses. The content also states DPRK actors target defense, diplomatic, financial, and cryptocurrency-related entities, including expanded targeting in Europe to steal cryptocurrency and evade sanctions. The provided material also describes a sophisticated DPRK remote worker and insider infiltration program. According to the content, DPRK operatives use stolen or borrowed identities, deepfake-enabled video interviews, proxy chains, residential IPs, laptop farms, and fraudulent IT worker schemes to obtain remote employment at Western enterprises and technology companies, generate revenue for the regime, and in some cases establish persistent access, espionage opportunities, or sabotage capability. The content cites incidents and reporting involving fake job candidates, KnowBe4’s accidental hiring of a North Korean operative, Amazon’s detection of a North Korean imposter sysadmin, and law-enforcement action against facilitators supporting DPRK IT worker schemes. The content further attributes multiple software supply-chain and malware activities to DPRK or suspected DPRK-linked actors. These include a suspected DPRK-linked compromise of Axios npm packages via a malicious dependency and postinstall malware, a North Korean campaign involving 338 malicious npm packages, use of EtherHiding to conceal malware on blockchains, and React2Shell attacks involving EtherRAT. The material also states DPRK actors misuse AI to improve cyber operations, including phishing, reconnaissance, data extraction, and deepfake-enabled social engineering. Overall, the content portrays DPRK as a persistent nation-state cyber threat combining financially motivated theft, sanctions evasion, insider infiltration, software supply-chain compromise, malware deployment, and AI-enabled deception.