Loading story…
Expel reported that a North Korean state-sponsored threat group linked to Lazarus is targeting Web3 developers in a campaign designed to steal cryptocurrency and non-fungible tokens (NFTs). The activity focuses on developers working in blockchain and related ecosystems, a sector that remains attractive to DPRK operators because of its direct access to digital assets and development environments.
The reporting describes the operation as part of a broader effort to industrialize social engineering and intrusion activity with AI-assisted tactics, allowing the group to scale outreach and improve the credibility of its lures. The campaign underscores Lazarus's continued focus on financially motivated operations that blend state-backed tradecraft with theft of digital assets from individuals and organizations tied to the Web3 sector.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Expel said it is tracking a North Korean state-sponsored advanced persistent threat group targeting Web3 developers. The campaign's apparent objective is to steal cryptocurrency and non-fungible tokens (NFTs).
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. agencies and security researchers linked North Korea’s **Lazarus Group**—also tracked as **APT38**, **BlueNoroff**, **Stardust Chollima**, and **HIDDEN COBRA**—to a long-running campaign targeting cryptocurrency exchanges, DeFi platforms, trading firms, venture capital funds, gaming companies, and high-value holders. The operation used spearphishing, fake job offers, fraudulent trading firms, social networking, and even fake Telegram groups to lure victims into downloading trojanized cryptocurrency trading and wallet applications on **Windows** and **macOS**, with activity reported across more than 30 countries. Researchers described later activity as an evolution of the earlier **AppleJeus** campaign, while U.S. agencies said the broader effort continued under the **TraderTraitor** cluster. The malicious apps—including **Celas Trade Pro**, **JMT Trading**, **Union Crypto**, **Kupay Wallet**, **CoinGoTrade**, **Dorusio**, **Ants2Whale**, **DAFOM**, **TokenAIS**, **CryptAIS**, **AlticGO**, **Esilet**, and **CreAI Deck**—appeared legitimate but installed hidden updater components, persistence mechanisms, and remote-access payloads such as **Manuscrypt** variants. Analysis of **Union Crypto** showed the malware collecting host details, installing services or LaunchDaemons, contacting command-and-control infrastructure, downloading second-stage payloads, and enabling file operations, screenshots, command execution, lateral movement, theft of private keys, and fraudulent blockchain transactions. U.S. authorities said the campaign supports North Korea’s sanctions evasion and revenue generation, and warned that cryptocurrency and blockchain firms remain likely targets.
Jun 29, 2026
Security researchers have uncovered and documented a sophisticated scheme by North Korea's Lazarus Group, specifically its Famous Chollima division, to infiltrate Western companies by recruiting remote IT workers under false pretenses. The operation involves North Korean agents posing as recruiters who target engineers and developers, convincing them to rent out their identities and computers. These compromised individuals act as figureheads, allowing Lazarus operatives to pass interviews, gain employment, and use the victims' devices as proxies to conceal their true location and activities. Researchers, including Mauro Eldritch of BCA LTD and the NorthScan initiative, managed to capture the scheme live by deploying controlled sandbox environments that mimicked real developer laptops, enabling them to observe the attackers' tactics in real time. The scheme leverages social engineering, AI-driven interview techniques, and deepfake technology to bypass security checks and secure positions at high-profile companies, particularly in finance, crypto, healthcare, and engineering sectors. Victims are offered a share of the salary, typically 20-35%, in exchange for their cooperation, but they bear all legal and reputational risks if the operation is discovered. The investigation also revealed that Lazarus operatives spammed GitHub repositories with recruitment messages to attract more candidates. This exposure provides critical insight into North Korea's ongoing efforts to generate revenue and conduct espionage through remote access to Western corporate networks.
Jun 29, 2026
Multiple reports and threat-intel posts highlighted **North Korea-linked cyber activity** spanning social engineering, malware, and broader ecosystem analysis. AllSecure described an attempted compromise of a CEO via a **fake LinkedIn job interview** attributed to **Lazarus** tradecraft (tagged *BeaverTail* / *Contagious Interview*), indicating continued use of recruiter-style lures and developer tooling themes (e.g., *VSCode*) to gain execution on target systems. Separately, eSentire published technical analysis on the **DEV#POPPER remote access trojan** and associated **OmniStealer** activity, framing it as DPRK-linked malware and providing defensive guidance for organizations facing this threat class. Additional DPRK-focused intelligence covered both strategic and operational dimensions. Google’s *Cloud Threat Horizons Report H1 2026* discussed cloud-focused threat activity and tracked DPRK-linked clusters (including **UNC4899** and **UNC5267**), while Logpresso published an OSINT report on **DPRK remote IT worker** infiltration tactics (fraudulent employment/contractor placement). NKInternet released a catalog-style overview of **North Korea’s software export ecosystem**, and RedAsgard’s “Hunting Lazarus” series contributed hands-on investigative detail into Lazarus operator artifacts. A separate Lazarus threat-actor profile page aggregated historical reporting and statistics, but did not add a discrete new incident beyond compilation.
Jun 29, 2026