Loading story…
North Korean authorities arrested two people in Wonsan after investigators linked them to a smishing and voice-phishing scheme that targeted donju, the country’s wealthy market entrepreneurs. The suspects allegedly sent fraudulent text messages posing as the central bank or inspection authorities, luring victims to malicious links that installed malware and exposed Jonsong e-wallet passwords in real time. Officials said the operation enabled direct theft from mobile wallets and, in some cases, follow-on extortion using victims’ family information.
The Ministry of Social Security reportedly formed a special task force to trace the stolen funds, identify possible accomplices, and determine whether similar cases had spread beyond Wonsan. Victims in Wonsan, Sinuiju, and Chongjin were said to have suffered heavy losses, contributing to cash shortages and wholesale price increases in local jangmadang markets. Reporting indicated the two suspects were trained IT specialists educated at Pyongyang’s Central University and later assigned to a government institution, underscoring concern that state-trained technical talent is being used for domestic cyber-enabled financial crime.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
After learning of the cyber-enabled financial crimes, North Korea’s Ministry of Social Security established a special investigation task force that ultimately arrested two individuals in Wonsan. The report explicitly says the arrests occurred in mid-July 2026, and investigators began tracing stolen funds and checking for accomplices and similar cases elsewhere.
A pair of suspects allegedly ran a smishing campaign impersonating North Korean authorities, using malware-laced text messages to capture Jonsong e-wallet passwords and steal funds from wealthy market entrepreneurs. The operation also enabled follow-on voice-phishing extortion using victims’ family information and reportedly affected victims in Wonsan, Sinuiju, and Chongjin.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean authorities reportedly arrested members of an insider cybercrime ring accused of breaching the internal networks of **Chosun Central Bank** and **Foreign Trade Bank** and siphoning off state trade funds and foreign currency. According to reporting cited in a related social media post, the group included former North Korean cyber operations personnel and younger IT specialists, making the case notable because the suspects were allegedly state-trained insiders tied to elite military cyber and technical institutions. Investigators reportedly uncovered discrepancies in foreign payment approvals and suspicious overseas IP access before launching a covert probe that culminated in raids and arrests in Pyongyang. The suspects allegedly moved stolen funds through shell accounts, converted proceeds into cryptocurrency, and relied on brokers and border-area contacts to launder the money back into **U.S. dollars** and **Chinese yuan**, exposing a breach that struck core parts of North Korea’s financial system.
Jul 24, 2026
North Korea’s fraudulent remote IT worker operation is being used to infiltrate hiring pipelines and generate illicit revenue through front companies and intermediaries tied to the regime. Reporting on the scheme describes DPRK-linked personnel posing as remote developers and other technology workers, with the activity framed as a sustained effort to penetrate global hiring processes while concealing state involvement behind false identities and corporate cutouts. New findings cited by DTEX indicate the proceeds flow far beyond individual fraud, feeding a broader state financing network that supports North Korea’s weapons programs, weapons manufacturing, and activity benefiting Russia’s war effort in Ukraine. Transaction data from a leaked North Korean payment server reportedly showed millions of dollars moving into sanctioned organizations including **Sobaeksu**, **Saenal**, **Songkwang**, and **Korea Ryonbong General Corp**, with SC Media highlighting **$1.97 million** routed through Korea Ryonbong between December 2025 and February 2026.
Jul 22, 2026
The U.S. Treasury Department imposed sanctions on two North Korean financial institutions and eight individuals for laundering cryptocurrency stolen through cybercrime and fraudulent IT worker schemes. The designated entities include Ryujong Credit Bank and Korea Mangyongdae Computer Technology Company (KMCTC), as well as their executives and financial representatives operating in China and Russia. These individuals and organizations are accused of facilitating the movement of tens of millions of dollars in violation of UN sanctions, with funds linked to ransomware attacks and other cyber-enabled crimes targeting U.S. victims. According to U.S. officials, North Korean cybercriminals have stolen over $3 billion in cryptocurrency over the past three years, employing advanced malware and social engineering tactics. Additionally, North Korean IT workers have generated hundreds of millions of dollars annually by concealing their identities and securing freelance work globally, with the proceeds supporting the regime's nuclear weapons program. The sanctions block all property and interests of the designated parties within U.S. jurisdiction, aiming to disrupt North Korea's ability to fund activities that threaten U.S. and global security.
Jun 29, 2026