Loading story…
Researchers published an investigation into suspected DPRK-linked cryptocurrency intrusions, outlining activity tied to crypto theft operations and the tradecraft used to compromise digital asset targets. The reporting frames the campaign as part of North Korea’s broader effort to generate revenue through cyber operations, with intrusions aimed at organizations handling cryptocurrency and related infrastructure.
Separate reporting detailed an alleged ShinyHunters breach involving the EU Europa platform, claiming the exposure of roughly 90GB of data and highlighting the potential compromise of DKIM keys and weaknesses in single sign-on (SSO) architecture. The analysis said the incident could have affected authentication and trust mechanisms tied to the platform, raising concerns about downstream abuse of exposed email-signing material and identity systems.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean threat actors expanded beyond traditional espionage into large-scale cryptocurrency theft and intrusion campaigns, with research presented at Black Hat identifying **1,640 organizations in 57 countries** touched by the activity and roughly **700 to 800** showing clearly malicious compromise. Investigators said some intrusions reached **root-level access** on servers and **AWS accounts**, while attackers also abused third-party contractors to reach government, healthcare, and private-sector victims. The activity was linked broadly to DPRK operations including **Lazarus Group**, which researchers said continues to pair social engineering with crypto theft and laundering to generate revenue believed to support sanctions evasion and state priorities. Separate reporting tied the shift to specific DPRK espionage clusters now targeting crypto users and firms directly. **Konni** was described as moving from South Korea-focused Windows espionage to a global **macOS** campaign using fake recruiter or document lures, **AppleScript**, `LaunchAgents`, **TCC** abuse, and payloads including **FileRATClient** and an **EggShell** variant. **Kimsuky** was reported to have operated a fake trading platform, **Tralert FX**, distributing a trojanized desktop app through direct download and the Microsoft Store before deploying a customized **Xeno RAT** via GitLab staging; researchers said that campaign affected more than **250 victim IPs across 28 countries**.
Aug 25, 2026
Microsoft-linked reporting says **North Korean threat actors** are using **AI** to scale and refine long-running “fake IT worker” schemes, where operatives pose as legitimate remote hires to obtain *authorized* access inside victim organizations. The activity is attributed to DPRK-linked clusters **Jasper Sleet** and **Coral Sleet**, with AI used to improve identity fabrication and maintenance (including face/voice manipulation) and to sustain day-to-day communications that help keep fraudulent personas credible, enabling “sustained, large-scale misuse of legitimate access.” Separately, reporting on suspected DPRK-linked intrusions describes a coordinated campaign against **cryptocurrency organizations** spanning staking platforms, exchange software providers, and exchanges, with theft of **source code, private keys, and cloud secrets**. Investigators described two primary access paths: exploitation of `CVE-2025-55182` in the *React2Shell* framework (including mass scanning and WAF-bypass techniques) and the use of **pre-obtained valid AWS access tokens** to move directly into cloud enumeration; researchers also recovered artifacts from attacker infrastructure (e.g., shell history, archived code, and tool configurations) that provided visibility into post-compromise activity and C2 setup.
Jun 29, 2026
North Korean operators are expanding access and revenue-generation operations through fraudulent remote employment, targeted intrusions, and cryptocurrency theft. The DPRK-linked **Famous Chollima** group—also tracked as **UNC5267** and **Jasper Sleet**—uses fabricated identities, falsified documents, AI-assisted communications, proxy interviewers, laptop farms, and payment fraud to secure remote IT roles at technology, aerospace, defense, software, blockchain, cryptocurrency, and DeFi organizations. The workers gain legitimate internal access by abusing recruiting, onboarding, payroll, and remote-work processes, with activity concentrated in the United States and increasingly observed in Europe. Other DPRK-linked activity demonstrates a broader intrusion capability. **Andariel** has used watering-hole compromises, spearphishing attachments, malicious macros, and exploitation of client-side ActiveX vulnerabilities—including zero-days—to access targets, then deploys additional tools, enumerates systems and network connections, and collects files for exfiltration; it has also concealed executables in PNG files using steganography. Separately, the FBI, DC3, and Japan's National Police Agency attributed the theft of approximately **$308 million** from Bitcoin.DMM.com to North Korean actors tracked as **TraderTraitor**, underscoring the financial risk to cryptocurrency businesses and organizations with digital-asset exposure.
Sep 26, 2026