Loading story…
A North Korean state-sponsored threat actor was inadvertently exposed after a LummaC2 infostealer infection compromised a device used in the $1.4 billion Bybit cryptocurrency exchange heist. Analysis by Hudson Rock and Silent Push revealed that the infected machine, operated by a malware developer within North Korea’s cyber apparatus, contained credentials and infrastructure directly tied to the Bybit attack, including the registration of a phishing domain used in the operation. This rare insight into North Korean cyber operations highlights the shared use of development rigs, credential sets, and infrastructure among state-backed actors, providing a unique window into their methods and operational overlaps.
In parallel, Windows systems have been targeted by the advanced KimJongRAT malware, attributed to North Korean APT group Kimsuky, through phishing campaigns leveraging malicious HTA files. Attackers distribute ZIP archives containing LNK files disguised as tax notice PDFs, which, when executed, use mshta to activate the HTA file and deploy KimJongRAT. The malware is capable of exfiltrating system data, browser credentials, cryptocurrency wallet information, and messaging app accounts, with its behavior adapting based on the presence of security software like Windows Defender. These incidents underscore the ongoing sophistication and adaptability of North Korean cyber operations targeting both financial and information assets globally.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Hudson Rock, with corroboration from Silent Push, disclosed that a North Korean threat actor's machine had been compromised by LummaC2, calling it the first documented case of an infostealer infecting a North Korean operator. The exposed system reportedly contained malware development tools, VPN software, communications apps, and evidence of fake Zoom installer phishing activity.
In 2025, a North Korean state-sponsored malware developer was inadvertently infected by the LummaC2 infostealer. The compromise exposed operational details, including phishing domains, credential management activity, and links to infrastructure associated with the Bybit breach.
Reporting revealed that the KimJongRAT campaign adjusted its payloads based on whether Windows Defender was active, while stealing system data, browser storage, encryption keys, cryptocurrency wallets, and Discord and Telegram credentials. The disclosure highlighted the malware's persistence, evasion, and data-exfiltration mechanisms.
A campaign attributed to the North Korean APT group Kimsuky targeted Windows users with phishing emails posing as tax notices. The messages delivered ZIP archives containing an LNK file disguised as a PDF, which used mshta to execute a Base64-encoded HTA file and install KimJongRAT.
In February 2025, attackers linked to North Korean operations conducted a $1.4 billion breach of the Bybit cryptocurrency exchange. Later forensic analysis tied infrastructure on a compromised North Korean operator device to this heist.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers from Hunt.io and the Acronis Threat Research Unit have uncovered a sophisticated network of North Korean state-sponsored infrastructure, revealing operational links between the Lazarus and Kimsuky groups. The investigation identified active tool-staging servers, credential-theft environments, FRP tunneling nodes, and a new Linux variant of the Badcall backdoor, which features enhanced logging for attacker monitoring. The infrastructure analysis exposed consistent patterns, such as the reuse of certificates and open directories for rapid deployment of credential theft kits, enabling persistent access and coordination across global campaigns. In parallel, North Korean threat actors have been attributed to a record surge in cryptocurrency theft, with at least $2.02 billion stolen in 2025, accounting for a significant portion of the over $3.4 billion lost globally. These operations leverage the advanced infrastructure and malware capabilities detailed in the research, highlighting the ongoing evolution and impact of DPRK cybercrime. The findings underscore the persistent threat posed by North Korean groups, both in terms of technical sophistication and financial motivation, as they continue to target global organizations and cryptocurrency platforms.
Jun 29, 2026
North Korean state-sponsored threat actors, including the Lazarus Group and Kimsuky, have been responsible for a dramatic surge in global cryptocurrency theft in 2025, stealing at least $2.02 billion—over half of the total $3.4 billion stolen worldwide. The February compromise of the Bybit cryptocurrency exchange accounted for $1.5 billion of these losses, with the attack attributed to the TraderTraitor cluster, and further links established through malware infrastructure analysis. Lazarus Group, affiliated with North Korea's Reconnaissance General Bureau, has also been implicated in the theft of $36 million from Upbit and is estimated to have stolen over $6.75 billion cumulatively through a series of high-profile heists and campaigns. Recent collaborative research by Hunt.io and the Acronis Threat Research Unit has uncovered new operational infrastructure used by both Lazarus and Kimsuky across global campaigns. The investigation revealed active tool-staging servers, credential theft environments, and tunneling nodes, highlighting the interconnected nature of DPRK cyber operations. Despite evolving malware and tactics, these groups consistently reuse infrastructure, making their activities traceable across campaigns. The findings provide defenders with actionable intelligence on the infrastructure patterns and operational habits of North Korean threat actors, supporting efforts to detect and disrupt ongoing and future attacks.
Jun 29, 2026
North Korean state-backed hacking groups, including Lazarus, Andariel, and Kimsuky, have been identified as leading actors in global nation-state cyberattacks, accounting for 18.2% of all such activity between April and September. These groups have adopted increasingly sophisticated tactics, such as "malware-free" intrusions, covert infiltration schemes, and the use of legitimate system tools like PowerShell and Command Prompt to evade detection. Telecommunications, technology, and transportation sectors have been the primary targets, with Turkey and the U.S. among the most frequently attacked nations. Security experts recommend layered defenses and zero-trust principles to counter these evolving threats. A recent report by the Multilateral Sanctions and Measures Team (MSMT), with contributions from Chainalysis, reveals that North Korea has stolen an estimated $2.8 billion in cryptocurrency from January 2024 to September 2025, including a $1.5 billion heist from the Bybit exchange. The report highlights the expansion of North Korea's laundering networks, which now involve sophisticated mixing services, OTC brokers across multiple jurisdictions, and collaboration with Russian and Cambodian money laundering networks. The use of UnionPay cards and Hong Kong-based intermediaries further complicates efforts to trace and recover stolen assets, underscoring the growing scale and complexity of North Korean cyber operations.
Jun 29, 2026