Loading story…
Check Point Research published an analysis of SiliVaccine, an antivirus product developed in North Korea, offering a rare look into the country’s domestic security software ecosystem. The report examined the product’s internal design and functionality, highlighting how the software appears to combine conventional antivirus features with locally developed components and reflecting the isolated nature of North Korea’s technology environment.
The research provided defenders and intelligence teams with insight into how North Korean software is built, maintained, and positioned for internal use. By reverse engineering the product, Check Point documented technical characteristics that help illuminate the country’s broader cyber capability, supply chain independence efforts, and approach to endpoint protection within a tightly controlled national network.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Check Point Research published a report examining SiliVaccine, an antivirus product associated with North Korea, providing technical analysis of the software.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked a North Korean **Kimsuky** intrusion cluster to spearphishing campaigns that deliver ZIP archives containing malicious `.lnk` files, which launch obfuscated PowerShell, open decoy PDF documents, and create persistence through scheduled tasks. The activity, tracked by Genians as **Operation GitPower**, also used public **GitHub** and **GitLab** repositories as command-and-control channels and malware staging infrastructure, including encrypted `.NET` **AsyncRAT** payloads disguised as image files. Fortinet separately reported DPRK-linked campaigns using the same combination of LNK-based infection chains and GitHub-backed C2, reinforcing the pattern across related operations. Investigators said the operators appear to be expanding beyond conventional malware delivery and are actively experimenting with **AI-enabled tradecraft**. Artifacts showed local LLM environments built with tools including **Ollama**, **GPT4All**, and **Msty**, along with RAG-style document handling, AI agent development libraries, and **Whisper** speech-to-text components, suggesting a research-and-integration phase focused on malware development, document analysis, and attack automation rather than training original models. Attribution was supported by overlaps with prior Kimsuky techniques, Korean-language artifacts, North Korean lexical patterns, Arirang manufacturer strings, and use of **Astrill VPN**.
Aug 18, 2026
Multiple reports and threat-intel posts highlighted **North Korea-linked cyber activity** spanning social engineering, malware, and broader ecosystem analysis. AllSecure described an attempted compromise of a CEO via a **fake LinkedIn job interview** attributed to **Lazarus** tradecraft (tagged *BeaverTail* / *Contagious Interview*), indicating continued use of recruiter-style lures and developer tooling themes (e.g., *VSCode*) to gain execution on target systems. Separately, eSentire published technical analysis on the **DEV#POPPER remote access trojan** and associated **OmniStealer** activity, framing it as DPRK-linked malware and providing defensive guidance for organizations facing this threat class. Additional DPRK-focused intelligence covered both strategic and operational dimensions. Google’s *Cloud Threat Horizons Report H1 2026* discussed cloud-focused threat activity and tracked DPRK-linked clusters (including **UNC4899** and **UNC5267**), while Logpresso published an OSINT report on **DPRK remote IT worker** infiltration tactics (fraudulent employment/contractor placement). NKInternet released a catalog-style overview of **North Korea’s software export ecosystem**, and RedAsgard’s “Hunting Lazarus” series contributed hands-on investigative detail into Lazarus operator artifacts. A separate Lazarus threat-actor profile page aggregated historical reporting and statistics, but did not add a discrete new incident beyond compilation.
Jun 29, 2026
North Korean threat actors have expanded from distinct intrusion sets into overlapping cyber operations that mix espionage, financial theft, and targeted ransomware while reusing malware, infrastructure, and delivery tradecraft. Research across Lazarus, Kimsuky, APT43, and related DPRK-linked clusters shows campaigns against governments, think tanks, defense-linked individuals, banks, cryptocurrency firms, and South Korea-focused political and academic targets. Analysts tied these operations to spear-phishing with Word, HWP, ZIP, and password-protected archive lures; trojanized cryptocurrency software in the **AppleJeus** family; bank intrusions associated with **Bluenoroff** and SWIFT fraud; and crypto theft campaigns such as **CryptoCore**. Trellix also linked several narrowly targeted ransomware families to North Korea’s financial cyber apparatus, reinforcing the regime’s dual use of cyber operations for intelligence collection and revenue generation. Recent reporting shows attribution is becoming harder because DPRK operators increasingly share tools and infrastructure across sub-clusters and adapt quickly to evade detection. Kimsuky campaigns used **AppleSeed**, **AlphaSeed**, **GoldDragon**, and **DEEP#GOSU** infection chains with cloud-hosted staging, `mshta.exe`, PowerShell, VBS, Dropbox, Google Docs, fake Blogspot pages, and strict victim-validation logic, while a later Korea-focused phishing operation combined Facebook, email, and Telegram to deliver obfuscated JSE malware. Separate analysis described a late-2023 crypto supply-chain intrusion delivering the **Durian** Golang RAT with signs of collaboration between Kimsuky and Andariel, and another case where **PEBBLEDASH**, long associated with Lazarus, appeared alongside Kimsuky-linked infrastructure. Researchers concluded that malware names alone no longer reliably identify the operator and that accurate attribution now depends on reconstructing the full intrusion chain, infrastructure, targeting, and strategic objective.
Aug 15, 2026