Loading story…
Google's Threat Analysis Group said a North Korean government-backed actor continued a campaign against security researchers by creating a fake offensive security company, SecuriElite, and associated social media profiles to build credibility and lure targets. The operation followed earlier activity in which the attackers used a PGP key posted on an attacker-controlled blog to entice researchers to visit a website where a browser exploit would be triggered, and Google added the new SecuriElite site to Safe Browsing as a precaution even though it had not yet been seen serving malicious content.
The campaign was linked by researchers to exploitation of an Internet Explorer zero-day, reinforcing concerns that the group maintains access to multiple previously unknown vulnerabilities. Google warned that the operators likely possess additional zero-days, underscoring the risk to vulnerability researchers and offensive security professionals who may be approached through seemingly legitimate research collaboration or recruiting outreach.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
On March 17, 2021, the actors created a fake offensive security company called SecuriElite, along with a website and associated social media profiles, to continue social engineering against security researchers. The site claimed the company was based in Turkey and advertised pentests, software security assessments, and exploits.
Following Google's January blog post, security researchers identified the actors as using an Internet Explorer zero-day. Google also warned that the group likely possesses additional zero-days.
Google Threat Analysis Group said it had previously documented a campaign targeting security researchers in January 2021. In the March update, Google attributed the activity to a North Korean government-backed entity.
Google identified LinkedIn accounts impersonating recruiters for antivirus and security companies and reported the social media profiles to the relevant platforms. Google also added the new SecuriElite website to Safe Browsing as a precaution, while noting it had not yet observed the site serving malicious content.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google reported that a single threat actor used five **zero-day vulnerabilities** across **Internet Explorer, Chrome, and the Windows kernel** in a 2019 campaign that primarily targeted people in North Korea and individuals working on North Korea-related issues. The attacks were delivered through compromised legitimate websites, links to malicious sites, and limited spear-phishing emails carrying attachments, showing a mix of web compromise and direct social-engineering tactics. Google said its Threat Analysis Group identified zero-days affecting **Android, Chrome, iOS, Internet Explorer, and Windows**, and published technical details on exploitation methods including escapes from the Internet Explorer **EPM sandbox** using **WPAD**. The company also highlighted its role in identifying **`CVE-2020-0674`**, an Internet Explorer remote code execution flaw later acknowledged by Microsoft, framing the disclosures as part of broader cross-platform vulnerability reporting intended to protect users.
Aug 15, 2026
Google and Zscaler tied multiple intrusion campaigns to North Korean state-backed operators, including Lazarus-linked activity that targeted South Korean users, security researchers, cryptocurrency firms, fintech companies, IT organizations, and media entities. Google reported that two North Korean threat groups exploited the Chrome remote code execution flaw **`CVE-2022-0609`** in campaigns associated with **Operation Dream Job** and **Operation AppleJeus**, and assessed that the groups likely worked for the same entity while sharing a common exploit supply chain. Google also said one campaign overlapped with an earlier operation aimed at security researchers, where attackers created the fake security company **SecuriElite** and used social engineering tied to browser exploitation.
Aug 15, 2026
North Korean threat actors expanded beyond traditional espionage into large-scale cryptocurrency theft and intrusion campaigns, with research presented at Black Hat identifying **1,640 organizations in 57 countries** touched by the activity and roughly **700 to 800** showing clearly malicious compromise. Investigators said some intrusions reached **root-level access** on servers and **AWS accounts**, while attackers also abused third-party contractors to reach government, healthcare, and private-sector victims. The activity was linked broadly to DPRK operations including **Lazarus Group**, which researchers said continues to pair social engineering with crypto theft and laundering to generate revenue believed to support sanctions evasion and state priorities. Separate reporting tied the shift to specific DPRK espionage clusters now targeting crypto users and firms directly. **Konni** was described as moving from South Korea-focused Windows espionage to a global **macOS** campaign using fake recruiter or document lures, **AppleScript**, `LaunchAgents`, **TCC** abuse, and payloads including **FileRATClient** and an **EggShell** variant. **Kimsuky** was reported to have operated a fake trading platform, **Tralert FX**, distributing a trojanized desktop app through direct download and the Microsoft Store before deploying a customized **Xeno RAT** via GitLab staging; researchers said that campaign affected more than **250 victim IPs across 28 countries**.
Aug 25, 2026