Loading story…
North Korean authorities reportedly arrested members of an insider cybercrime ring accused of breaching the internal networks of Chosun Central Bank and Foreign Trade Bank and siphoning off state trade funds and foreign currency. According to reporting cited in a related social media post, the group included former North Korean cyber operations personnel and younger IT specialists, making the case notable because the suspects were allegedly state-trained insiders tied to elite military cyber and technical institutions.
Investigators reportedly uncovered discrepancies in foreign payment approvals and suspicious overseas IP access before launching a covert probe that culminated in raids and arrests in Pyongyang. The suspects allegedly moved stolen funds through shell accounts, converted proceeds into cryptocurrency, and relied on brokers and border-area contacts to launder the money back into U.S. dollars and Chinese yuan, exposing a breach that struck core parts of North Korea’s financial system.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
North Korea's National Intelligence Agency reportedly noticed discrepancies in foreign payment approvals and suspicious overseas IP access involving Chosun Central Bank and Foreign Trade Bank, triggering a covert investigation into the intrusion and theft scheme.
On July 12, North Korean authorities reportedly carried out raids and arrests in Pyongyang against a criminal ring of former cyber operators and recruited IT specialists accused of hacking the internal networks of Chosun Central Bank and Foreign Trade Bank and laundering stolen funds through cryptocurrency.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
bsky.app
Open sourcexakep.ru
Open sourcedailynk.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean state-backed hacking groups, including Lazarus, Andariel, and Kimsuky, have been identified as leading actors in global nation-state cyberattacks, accounting for 18.2% of all such activity between April and September. These groups have adopted increasingly sophisticated tactics, such as "malware-free" intrusions, covert infiltration schemes, and the use of legitimate system tools like PowerShell and Command Prompt to evade detection. Telecommunications, technology, and transportation sectors have been the primary targets, with Turkey and the U.S. among the most frequently attacked nations. Security experts recommend layered defenses and zero-trust principles to counter these evolving threats. A recent report by the Multilateral Sanctions and Measures Team (MSMT), with contributions from Chainalysis, reveals that North Korea has stolen an estimated $2.8 billion in cryptocurrency from January 2024 to September 2025, including a $1.5 billion heist from the Bybit exchange. The report highlights the expansion of North Korea's laundering networks, which now involve sophisticated mixing services, OTC brokers across multiple jurisdictions, and collaboration with Russian and Cambodian money laundering networks. The use of UnionPay cards and Hong Kong-based intermediaries further complicates efforts to trace and recover stolen assets, underscoring the growing scale and complexity of North Korean cyber operations.
Jun 29, 2026
Recorded Future’s Insikt Group reported that North Korea has made cryptocurrency theft a major state-backed source of income, stealing an estimated **$3 billion since 2017**. The report says Pyongyang shifted from **SWIFT-related financial theft** to targeting cryptocurrency during the 2017 crypto boom, initially focusing on South Korea before expanding operations globally. In **2022 alone**, North Korean threat actors were accused of stealing **$1.7 billion**, accounting for **44% of all cryptocurrency stolen worldwide** that year. The stolen funds are reportedly laundered with techniques similar to those used by conventional cybercriminals, including the use of **stolen identities** and **altered photos** to evade anti-money-laundering controls. Recorded Future said the proceeds help the regime blunt the impact of international sanctions and support military and weapons programs, while warning that **cryptocurrency exchanges, individual holders, venture capital firms, and other crypto-related organizations** remain exposed unless cybersecurity, regulation, and investment improve.
Jun 29, 2026
The U.S. State Department, FBI, and allied governments warned that North Korean IT workers are obtaining freelance and full-time jobs at companies worldwide by using stolen identities, forged documents, proxy interview participants, VPNs, remote desktop tools, and overseas **"laptop farms"** that make them appear to be operating from trusted jurisdictions. Authorities said the workers funnel wages and cryptocurrency payments back to Pyongyang, helping fund North Korea’s nuclear weapons and ballistic missile programs while exposing employers to insider threats including **data exfiltration, credential theft, and cryptocurrency theft**. The warning builds on earlier reporting and government actions showing that DPRK-linked workers have infiltrated Western technology and cryptocurrency firms under false identities, sometimes through front companies and facilitators based in **Russia and China**. Researchers and prior U.S. cases have tied the scheme to broader risks beyond sanctions exposure, including potential malware deployment, espionage, disruption, and money laundering, prompting officials to urge stronger identity verification, closer scrutiny of interviews and payment arrangements, monitoring for anomalous account activity, and rapid reporting of suspected hires.
Aug 6, 2026