Loading story…
A security researcher said he infiltrated infrastructure used by North Korean hackers for 22 months and uncovered evidence tying the operation to 1,640 companies in 57 countries, with 700 to 800 organizations allegedly suffering serious intrusions. A WIRED report, cited in social media coverage, described the findings as showing that North Korean operators had breached hundreds of networks worldwide, while researcher Vangelis Stykas, CTO of Kumio, publicly identified roughly a dozen affected organizations.
Among those named was Boston Children’s Hospital, which disputed that its own systems were compromised. The hospital said the incident involved only a former contractor’s personal device rather than a breach of hospital systems. The reporting highlights both the scale of the alleged North Korean campaign and the uncertainty that can follow public attribution, as victim organizations challenge how exposure and impact are characterized.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
WIRED reported that security researchers exploited vulnerabilities in a child-focused GPS smartwatch to track and eavesdrop on a reporter in real time in New York. The demonstration highlighted surveillance and privacy risks in insecure GPS-enabled consumer devices for children.
Security researcher Vangelis Stykas publicly named Boston Children's Hospital as one of roughly a dozen organizations impacted by the North Korean hacking operation. This disclosure was reported as part of the broader reporting on the campaign.
A Wired article reported that a security professional hacked North Korean hackers and found they had breached hundreds of networks worldwide. The provided source material includes only the headline-level claim and no further verified incident details.
Reporting on Vangelis Stykas's Black Hat 2026 findings publicly identified additional affected organizations beyond Boston Children's, including AEON Smart Technology, Oppo, Coinbase, Uniswap Labs, Italy’s Consiglio Superiore della Magistratura, a subsidiary of Al Rajhi Bank, and Digitaal Vlaanderen. The disclosures expanded the list of known victims tied to the North Korean Contagious Interview operation.
Boston Children's Hospital disputed that its own systems were breached, saying the issue was limited to a former contractor's personal device. The statement challenged its characterization as a directly breached victim in the operation.
Vangelis Stykas said he spent 22 months inside systems used by a North Korean hacking group, where he gathered evidence about the scope of their operations. He said this access linked the operation to 1,640 companies in 57 countries and indicated 700 to 800 seriously damaging intrusions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcemalware.news
Open sourcedatabreaches.net
Open sourcewired.com
Open sourcebsky.app
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean threat actors expanded beyond traditional espionage into large-scale cryptocurrency theft and intrusion campaigns, with research presented at Black Hat identifying **1,640 organizations in 57 countries** touched by the activity and roughly **700 to 800** showing clearly malicious compromise. Investigators said some intrusions reached **root-level access** on servers and **AWS accounts**, while attackers also abused third-party contractors to reach government, healthcare, and private-sector victims. The activity was linked broadly to DPRK operations including **Lazarus Group**, which researchers said continues to pair social engineering with crypto theft and laundering to generate revenue believed to support sanctions evasion and state priorities. Separate reporting tied the shift to specific DPRK espionage clusters now targeting crypto users and firms directly. **Konni** was described as moving from South Korea-focused Windows espionage to a global **macOS** campaign using fake recruiter or document lures, **AppleScript**, `LaunchAgents`, **TCC** abuse, and payloads including **FileRATClient** and an **EggShell** variant. **Kimsuky** was reported to have operated a fake trading platform, **Tralert FX**, distributing a trojanized desktop app through direct download and the Microsoft Store before deploying a customized **Xeno RAT** via GitLab staging; researchers said that campaign affected more than **250 victim IPs across 28 countries**.
Aug 25, 2026
North Korean IT workers have significantly expanded their operations to infiltrate a wide range of industries beyond the traditional technology sector, according to research published by Okta Threat Intelligence. The scheme involves North Korean nationals, or individuals funneling money back to Pyongyang, fraudulently obtaining remote employment, primarily in software development roles. Okta's research indicates that nearly half of the targeted companies are outside the IT sector, with finance, healthcare, public administration, and professional services now among the most affected industries. The campaign, which initially focused on U.S.-based cryptocurrency and blockchain firms, has evolved to target organizations in dozens of countries, with 27% of targeted entities now located outside the United States. Okta tracked more than 130 identities associated with North Korean facilitators and workers, linking them to over 6,500 initial job interviews at more than 5,000 companies from 2021 through mid-2025. The methodology for identifying these DPRK-aligned identities relies on a combination of technical indicators, behavioral patterns, and employer reporting, though Okta has withheld some details to avoid alerting the threat actors. The scale of the operation is believed to be much larger than the tracked sample, with the FBI and private security firms, including Google's Mandiant, warning that the problem is widespread among Fortune 500 companies. Mandiant's CTO, Charles Carmakal, noted that almost every CISO of a Fortune 500 company he has spoken to has encountered issues with North Korean IT workers. The North Korean operatives use fake or stolen identities to secure remote roles, circumventing international sanctions and generating millions of dollars for the North Korean military. The campaign's adaptability is evident in its shift to any remote role that fits the scheme's requirements, regardless of industry or geography. Okta's findings highlight the persistent and evolving nature of the threat, with North Korean IT workers now targeting a broad spectrum of organizations globally. The report underscores the need for enhanced identity verification and vigilance in remote hiring processes. The expansion of this scheme poses significant risks to sensitive data, intellectual property, and the integrity of critical sectors such as healthcare and finance. The threat is compounded by the difficulty in detecting these operatives, given their use of sophisticated identity obfuscation techniques. Okta's research suggests that the true scale of North Korean IT worker activity is likely much greater than currently documented. The ongoing campaign demonstrates North Korea's commitment to leveraging cyber-enabled means to generate revenue and evade international restrictions. Organizations are urged to review their remote hiring practices and strengthen controls to mitigate the risk of inadvertently employing North Korean operatives. The findings also highlight the importance of cross-sector collaboration and intelligence sharing to counter this persistent threat. The expansion of North Korean IT worker infiltration represents a significant evolution in state-sponsored cyber-enabled financial operations.
Aug 14, 2026A suspected North Korean threat actor compromised a maintainer account for the widely used open-source package **Axios** and pushed malicious updates for about three hours in a software supply-chain attack, according to reporting from CNN, NK News, and security researchers cited by both outlets. Google Threat Intelligence Group and Mandiant linked the operation to North Korean actors, saying the attackers likely sought information to support follow-on intrusions and cryptocurrency theft. Axios is broadly embedded in web applications and server-to-server communications, raising concern that the compromise could affect organizations across healthcare, finance, and cryptocurrency-related sectors. Incident responders said the known impact was still developing, with Huntress identifying roughly **135 compromised devices across about 12 companies** while warning the downstream victim count could grow substantially because Axios is used by thousands of enterprises. Researchers said the campaign fits Pyongyang’s established pattern of using cyber operations for revenue generation and strategic access, and warned that determining the full scope of exposure and any secondary compromises could take months.
Jun 29, 2026