Loading story…
Researchers have uncovered evidence suggesting a rare collaboration between Russian state-sponsored threat actor Gamaredon and North Korea's Lazarus Group, marked by the sharing of command-and-control infrastructure. Gen Threat Labs identified activity from both groups on the same server, with a Gamaredon C2 address later hosting Lazarus-linked InvisibleFerret malware, which had previously been used in the Contagious Interview campaign. The server structure and delivery paths were consistent with Lazarus's known tactics, and the close timing of the activities has led researchers to believe this is more than coincidental, indicating a possible alliance that could enhance the offensive capabilities of both groups.
This potential partnership is significant as it represents a rare instance of cross-nation APT cooperation, with Gamaredon typically conducting espionage for Russia's FSB and Lazarus engaging in both espionage and financially motivated attacks for North Korea's RGB. Security experts warn that such collaboration could amplify the reach and resilience of state-sponsored cyber campaigns, urging organizations to strengthen multi-actor attribution capabilities and adopt multi-layered threat defenses. No specific vulnerabilities or exploits were cited in the reports, with the focus instead on infrastructure overlap and evolving threat attribution patterns.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
On publication of the research, analysts publicly warned that the apparent overlap between Russia's Gamaredon and North Korea's Lazarus could indicate an unusual cross-nation APT partnership. They noted the evidence was not definitive and could also reflect use of a proxy or VPN endpoint, but said the overlap was significant enough to merit closer attribution and defensive monitoring.
Gen Threat Labs reported that a known Gamaredon command-and-control IP was observed and, within days, the same server hosted an obfuscated InvisibleFerret payload associated with Lazarus's Contagious Interview campaign. Researchers said the timing, server structure, and malware lineage suggested possible shared infrastructure or operational overlap between the two groups.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korea-linked threat actors compromised **NPO Mashinostroyeniya**, a sanctioned Russian missile engineering and defense-industrial company, in an apparent cyberespionage operation tied to Pyongyang’s missile-development interests. SentinelLABS said the intrusion involved two separate but overlapping campaigns: a Linux email server compromise attributed to **ScarCruft** and a Windows intrusion using the Lazarus-linked **OpenCarrot** backdoor. The victim reportedly detected suspicious outbound traffic and a malicious DLL in mid-May 2022, but the full extent of the breach was not initially understood. Researchers said **OpenCarrot** enabled broad reconnaissance, process and filesystem manipulation, proxying, and multi-channel command-and-control, suggesting the attackers may have achieved wider network access. Infrastructure tied to the operation included domains such as `centos-packages[.]com` and `redhat-packages[.]com`, while later infrastructure reuse linked the activity to ScarCruft campaigns associated with **RokRAT**-style tradecraft. SentinelLABS assessed with high confidence that North Korea-affiliated operators were responsible, although it remains unclear whether **Lazarus** and **ScarCruft** shared access or were independently tasked against the same Russian target.
Jul 12, 2026
Multiple reports and threat-intel posts highlighted **North Korea-linked cyber activity** spanning social engineering, malware, and broader ecosystem analysis. AllSecure described an attempted compromise of a CEO via a **fake LinkedIn job interview** attributed to **Lazarus** tradecraft (tagged *BeaverTail* / *Contagious Interview*), indicating continued use of recruiter-style lures and developer tooling themes (e.g., *VSCode*) to gain execution on target systems. Separately, eSentire published technical analysis on the **DEV#POPPER remote access trojan** and associated **OmniStealer** activity, framing it as DPRK-linked malware and providing defensive guidance for organizations facing this threat class. Additional DPRK-focused intelligence covered both strategic and operational dimensions. Google’s *Cloud Threat Horizons Report H1 2026* discussed cloud-focused threat activity and tracked DPRK-linked clusters (including **UNC4899** and **UNC5267**), while Logpresso published an OSINT report on **DPRK remote IT worker** infiltration tactics (fraudulent employment/contractor placement). NKInternet released a catalog-style overview of **North Korea’s software export ecosystem**, and RedAsgard’s “Hunting Lazarus” series contributed hands-on investigative detail into Lazarus operator artifacts. A separate Lazarus threat-actor profile page aggregated historical reporting and statistics, but did not add a discrete new incident beyond compilation.
Jun 29, 2026
North Korean state-sponsored threat actors, including the Lazarus Group and Kimsuky, have been responsible for a dramatic surge in global cryptocurrency theft in 2025, stealing at least $2.02 billion—over half of the total $3.4 billion stolen worldwide. The February compromise of the Bybit cryptocurrency exchange accounted for $1.5 billion of these losses, with the attack attributed to the TraderTraitor cluster, and further links established through malware infrastructure analysis. Lazarus Group, affiliated with North Korea's Reconnaissance General Bureau, has also been implicated in the theft of $36 million from Upbit and is estimated to have stolen over $6.75 billion cumulatively through a series of high-profile heists and campaigns. Recent collaborative research by Hunt.io and the Acronis Threat Research Unit has uncovered new operational infrastructure used by both Lazarus and Kimsuky across global campaigns. The investigation revealed active tool-staging servers, credential theft environments, and tunneling nodes, highlighting the interconnected nature of DPRK cyber operations. Despite evolving malware and tactics, these groups consistently reuse infrastructure, making their activities traceable across campaigns. The findings provide defenders with actionable intelligence on the infrastructure patterns and operational habits of North Korean threat actors, supporting efforts to detect and disrupt ongoing and future attacks.
Jun 29, 2026