Loading story…
Open-source malware research tied multiple intrusions against financial organizations to a cluster of PowerShell- and document-based tooling associated with North Korean operators, while also surfacing possible overlap with activity commonly tracked as TA505. Analysts described a previously undisclosed PowerShell backdoor dubbed PowerBrace in investigations of 2018 SWIFT-heist activity, alongside reporting that mixed DPRK indicators, TA505 indicators, and closely related PowerShell scripts in attacks on banks. Separate analysis also documented PSLogger, a keylogging and screen-capture utility linked to attempted intrusions against financial targets in Vietnam, with variants delivered through a modified PowerSploit framework and a standalone executable sharing the same codebase.
Additional technical work examined a malicious Hangul Word Processor (.hwp) document attributed to a DPRK threat actor, showing a zlib-compressed EPS object that unpacked shellcode, launched a suspended Internet Explorer process, injected code, and contacted a compromised Korean website for follow-on payload delivery. Based on code and infrastructure overlap, the likely final payload was assessed as NavRAT or a closely related family. Together, the reporting portrays a financially focused intrusion set using commodity code reuse, PowerShell backdoors, keylogging utilities, and weaponized documents, while leaving open the possibility that some activity attributed to TA505 and DPRK operators may intersect or share tooling.
See the actors and campaigns active against you right now.
9 events from the most recent confirmed update back to the earliest known activity.
At SAS2019, BAE Systems presented research on DPRK-linked SWIFT heist activity from 2018. The findings included a previously undisclosed PowerShell backdoor later dubbed PowerBrace and suggested possible overlap with TA505 intrusions.
A user identified as fabd7a52 in Pakistan first uploaded the standalone keylogger sample HSMBalance.exe, which shared code and behavior with the Vietnam PSLogger malware. Norfolk InfoSec used this as evidence of a related intrusion set extending beyond the Vietnam case.
Norfolk InfoSec published research on a previously undisclosed DPRK-attributed PowerShell backdoor dubbed PowerBrace and examined possible overlap between TA505 and DPRK intrusions. The post also released selected indicators and analysis linking PSLogger, PowerBrace-related samples, and financial-sector targeting.
Norfolk InfoSec dissected the malicious HWP document's EPS and shellcode stages, showing process injection into Internet Explorer and follow-on network execution logic. Based on overlap with Cisco Talos reporting, the author assessed the likely final payload as NavRAT or a close relative.
ESTsecurity reported a newly identified malicious Hangul Word Processor document sharing technical characteristics with activity attributed to North Korean threat actors. The sample used EPS-embedded shellcode to launch Internet Explorer and contact a compromised Korean website.
Norfolk InfoSec published analysis of the PSLogger keylogger and screen-capture utility, linking Vietnam and Pakistan samples through shared code, paths, and behavior. The post assessed the activity as consistent with North Korean financial-sector operations.
In early January, VNCert issued an alert on attacks targeting financial institutions that mixed DPRK and TA505 indicators. The alert included the PSLogger keylogger and PowerShell artifacts later assessed as related to DPRK activity.
A VNCert report in late July included file-based indicators tied to attempted intrusions against financial organizations in Vietnam. The alert identified a DLL-based keylogger delivered via a modified PowerSploit framework.
360 TIC reported that TA505 recently targeted financial institutions using Excel 4.0 macro lures. Norfolk InfoSec later cited this reporting as overlapping with TA505 indicators seen in the same month.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 26 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
6 references tracked. Mallory keeps watching after this page renders.
sec0wn.blogspot.com
Open sourcesec0wn.blogspot.com
Open sourcenorfolkinfosec.com
Open sourcenorfolkinfosec.com
Open sourcenorfolkinfosec.com
Open sourceti.360.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean threat actors have expanded from distinct intrusion sets into overlapping cyber operations that mix espionage, financial theft, and targeted ransomware while reusing malware, infrastructure, and delivery tradecraft. Research across Lazarus, Kimsuky, APT43, and related DPRK-linked clusters shows campaigns against governments, think tanks, defense-linked individuals, banks, cryptocurrency firms, and South Korea-focused political and academic targets. Analysts tied these operations to spear-phishing with Word, HWP, ZIP, and password-protected archive lures; trojanized cryptocurrency software in the **AppleJeus** family; bank intrusions associated with **Bluenoroff** and SWIFT fraud; and crypto theft campaigns such as **CryptoCore**. Trellix also linked several narrowly targeted ransomware families to North Korea’s financial cyber apparatus, reinforcing the regime’s dual use of cyber operations for intelligence collection and revenue generation. Recent reporting shows attribution is becoming harder because DPRK operators increasingly share tools and infrastructure across sub-clusters and adapt quickly to evade detection. Kimsuky campaigns used **AppleSeed**, **AlphaSeed**, **GoldDragon**, and **DEEP#GOSU** infection chains with cloud-hosted staging, `mshta.exe`, PowerShell, VBS, Dropbox, Google Docs, fake Blogspot pages, and strict victim-validation logic, while a later Korea-focused phishing operation combined Facebook, email, and Telegram to deliver obfuscated JSE malware. Separate analysis described a late-2023 crypto supply-chain intrusion delivering the **Durian** Golang RAT with signs of collaboration between Kimsuky and Andariel, and another case where **PEBBLEDASH**, long associated with Lazarus, appeared alongside Kimsuky-linked infrastructure. Researchers concluded that malware names alone no longer reliably identify the operator and that accurate attribution now depends on reconstructing the full intrusion chain, infrastructure, targeting, and strategic objective.
Aug 15, 2026
Multiple recent intrusion reports describe **phishing-led Windows compromises** that rely on **weaponized `.LNK` shortcuts** to trigger **obfuscated PowerShell** execution, display decoy documents, and then fetch additional payloads from public cloud/code platforms. In South Korea, attackers distributed an LNK disguised as financial trading guidance that opens a decoy PDF while running PowerShell; subsequent stages perform anti-analysis/virtualization checks, establish persistence, and retrieve a masked executable from **GitHub** that decrypts code at runtime to run **MoonPeak** malware. Researchers assessed the activity as likely **North Korea–linked** based on GitHub commit metadata and naming patterns. A separate Russia-targeted campaign used business-themed archives containing decoy documents and a malicious LNK to pull a PowerShell loader that establishes persistence and then weakens defenses (including **Microsoft Defender exclusion changes** and use of **`defendnot`**), performs reconnaissance, and tampers with system tooling and file associations before deploying **Amnesia RAT** (fetched from **Dropbox**) and a **Hakuna Matata–derived ransomware** payload for encryption. By contrast, reporting on **KazakRAT** describes a different espionage operation in Kazakhstan/Afghanistan delivered via malicious **MSI** installers and using simple, unencrypted HTTP C2; it is not part of the LNK/PowerShell delivery chains described in the other incidents.
Jun 29, 2026
Darktrace reported a spear-phishing campaign targeting **South Korean** organizations that abuses a legitimate feature in *Microsoft Visual Studio Code* to establish remote access without deploying traditional command-and-control infrastructure. The lures used government-themed content, delivering files described as **JSE** scripts disguised as Hangul Word Processor (*HWPX*) documents; when opened, they installed VS Code and enabled **VS Code Tunnels**, allowing attackers to remotely control compromised hosts over trusted Microsoft infrastructure. Darktrace assessed the activity as heavily *living-off-the-land* and noted it as an apparent first for **DPRK-linked** actors using this specific tunneling technique. Other items in the set describe separate, unrelated activity and should not be conflated with the VS Code tunneling campaign. KnowBe4 detailed a dual-wave phishing operation that steals credentials and then weaponizes legitimate **RMM** tools for persistence; CybersecurityNews described a multi-stage Windows infection chain that uses LNK/PowerShell, GitHub-hosted loaders, Telegram Bot API communications, and repurposes the *Defendnot* tool to disable Microsoft Defender before dropping additional payloads; and The Hacker News “ThreatsDay” bulletin and Black Hills InfoSec’s “common threats” article are broad roundups/generic content rather than reporting the same South Korea VS Code incident. Darktrace’s separate blog post also discusses rapid exploitation of `CVE-2025-55812` (*React2Shell*) against exposed Next.js/React Server Components, which is a different topic from the DPRK VS Code Tunnels intrusion activity.
Jun 29, 2026