Loading story…
Sansec reported that North Korean hackers were skimming payment data from U.S. and European online shoppers in a Magecart-style campaign, reviving scrutiny of earlier compromises at retailers including FocusCamera and PaperSource. A prior Walmart Global Tech analysis of those incidents said the affected environments appeared to show signs of earlier TrickBot activity and argued that the public attribution to Lazarus relied heavily on infrastructure overlap, particularly reused LeaseWeb IP space, which by itself was presented as weak evidence.
SentinelLabs' later research on TrickBot's Anchor project adds context to that dispute by describing Anchor as a stealthier, APT-like framework used for targeted intrusions and noting that it incorporated PowerRatankba, a tool previously associated with Lazarus. Taken together, the reporting points to either a misattributed skimming operation conducted by TrickBot-linked actors or a more consequential scenario in which Lazarus operated inside networks previously compromised by TrickBot/Anchor, underscoring the blurred line between financially motivated crimeware and state-linked intrusion tradecraft.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
On 2020-07-06, Sansec reported that a North Korea-linked group identified as Lazarus or HIDDEN COBRA was conducting Magecart-style web-skimming attacks against websites, including PaperSource and FocusCamera.
The SentinelLabs report says international law enforcement charged or indicted Dridex botnet operators and imposed sanctions in December 2019, naming Maksim Yakubets and Igor Turashev among those associated with the operation.
The Walmart Global Tech article states that FocusCamera was initially compromised by TrickBot around October 2019, before later activity involving PowerTrick in the environment.
The SentinelLabs report states that TrickBot was developed in 2016 as banking malware, with early public reporting appearing in fall 2016. It says the malware was already tested and functional by November 2016 and initially targeted Australian banks before expanding to other countries.
According to the Walmart Global Tech article quoting Sansec, the malware was removed within 24 hours from an affected store and resurfaced on the same store a week later, suggesting the attackers may have retained access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
labs.sentinelone.com
Open sourcesentinelone.com
Open sourcesansec.io
Open sourcemedium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korean threat actors have expanded from distinct intrusion sets into overlapping cyber operations that mix espionage, financial theft, and targeted ransomware while reusing malware, infrastructure, and delivery tradecraft. Research across Lazarus, Kimsuky, APT43, and related DPRK-linked clusters shows campaigns against governments, think tanks, defense-linked individuals, banks, cryptocurrency firms, and South Korea-focused political and academic targets. Analysts tied these operations to spear-phishing with Word, HWP, ZIP, and password-protected archive lures; trojanized cryptocurrency software in the **AppleJeus** family; bank intrusions associated with **Bluenoroff** and SWIFT fraud; and crypto theft campaigns such as **CryptoCore**. Trellix also linked several narrowly targeted ransomware families to North Korea’s financial cyber apparatus, reinforcing the regime’s dual use of cyber operations for intelligence collection and revenue generation. Recent reporting shows attribution is becoming harder because DPRK operators increasingly share tools and infrastructure across sub-clusters and adapt quickly to evade detection. Kimsuky campaigns used **AppleSeed**, **AlphaSeed**, **GoldDragon**, and **DEEP#GOSU** infection chains with cloud-hosted staging, `mshta.exe`, PowerShell, VBS, Dropbox, Google Docs, fake Blogspot pages, and strict victim-validation logic, while a later Korea-focused phishing operation combined Facebook, email, and Telegram to deliver obfuscated JSE malware. Separate analysis described a late-2023 crypto supply-chain intrusion delivering the **Durian** Golang RAT with signs of collaboration between Kimsuky and Andariel, and another case where **PEBBLEDASH**, long associated with Lazarus, appeared alongside Kimsuky-linked infrastructure. Researchers concluded that malware names alone no longer reliably identify the operator and that accurate attribution now depends on reconstructing the full intrusion chain, infrastructure, targeting, and strategic objective.
Aug 15, 2026
Multiple reports and threat-intel posts highlighted **North Korea-linked cyber activity** spanning social engineering, malware, and broader ecosystem analysis. AllSecure described an attempted compromise of a CEO via a **fake LinkedIn job interview** attributed to **Lazarus** tradecraft (tagged *BeaverTail* / *Contagious Interview*), indicating continued use of recruiter-style lures and developer tooling themes (e.g., *VSCode*) to gain execution on target systems. Separately, eSentire published technical analysis on the **DEV#POPPER remote access trojan** and associated **OmniStealer** activity, framing it as DPRK-linked malware and providing defensive guidance for organizations facing this threat class. Additional DPRK-focused intelligence covered both strategic and operational dimensions. Google’s *Cloud Threat Horizons Report H1 2026* discussed cloud-focused threat activity and tracked DPRK-linked clusters (including **UNC4899** and **UNC5267**), while Logpresso published an OSINT report on **DPRK remote IT worker** infiltration tactics (fraudulent employment/contractor placement). NKInternet released a catalog-style overview of **North Korea’s software export ecosystem**, and RedAsgard’s “Hunting Lazarus” series contributed hands-on investigative detail into Lazarus operator artifacts. A separate Lazarus threat-actor profile page aggregated historical reporting and statistics, but did not add a discrete new incident beyond compilation.
Jun 29, 2026
Researchers reported multiple **DPRK-linked intrusion campaigns** tied to **Lazarus** and **Kimsuky**, highlighting new malware, refreshed delivery chains, and reusable infrastructure. Gen Digital identified Kimsuky using a new `HttpTroy` backdoor against a South Korean target via a fake VPN invoice ZIP and `.scr` dropper, while Lazarus targeted victims in Canada with an updated chain that used a new `Comebacker` variant to memory-load a new `BLINDINGCAN` RAT. Separate reporting also described Lazarus using fake hiring workflows and an NVIDIA-themed lure to trick victims into copying a malicious command that deployed credential theft tools, MeshAgent remote access, Python-based payloads, and cryptocurrency data theft components.
Aug 14, 2026