Loading story…
Google reported that a single threat actor used five zero-day vulnerabilities across Internet Explorer, Chrome, and the Windows kernel in a 2019 campaign that primarily targeted people in North Korea and individuals working on North Korea-related issues. The attacks were delivered through compromised legitimate websites, links to malicious sites, and limited spear-phishing emails carrying attachments, showing a mix of web compromise and direct social-engineering tactics.
Google said its Threat Analysis Group identified zero-days affecting Android, Chrome, iOS, Internet Explorer, and Windows, and published technical details on exploitation methods including escapes from the Internet Explorer EPM sandbox using WPAD. The company also highlighted its role in identifying CVE-2020-0674, an Internet Explorer remote code execution flaw later acknowledged by Microsoft, framing the disclosures as part of broader cross-platform vulnerability reporting intended to protect users.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Google said it was acknowledged in January 2020 for helping identify CVE-2020-0674, a remote code execution vulnerability in Internet Explorer. The report also linked this flaw to sandbox-escape techniques later discussed in TAG's analysis.
Google's Threat Analysis Group said it discovered zero-day vulnerabilities affecting Android, Chrome, iOS, Internet Explorer, and Windows in 2019. It also identified a cluster of 2019 attacks in which a single threat actor exploited five zero-days over a short period, primarily targeting people in North Korea or working on North Korea-related issues.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google's Threat Analysis Group said a North Korean government-backed actor continued a campaign against security researchers by creating a fake offensive security company, **SecuriElite**, and associated social media profiles to build credibility and lure targets. The operation followed earlier activity in which the attackers used a PGP key posted on an attacker-controlled blog to entice researchers to visit a website where a browser exploit would be triggered, and Google added the new SecuriElite site to Safe Browsing as a precaution even though it had not yet been seen serving malicious content. The campaign was linked by researchers to exploitation of an **Internet Explorer zero-day**, reinforcing concerns that the group maintains access to multiple previously unknown vulnerabilities. Google warned that the operators likely possess additional zero-days, underscoring the risk to vulnerability researchers and offensive security professionals who may be approached through seemingly legitimate research collaboration or recruiting outreach.
Aug 15, 2026
North Korean threat actor **APT37** targeted South Korean users through multiple intrusion chains that combined malicious documents with Internet Explorer engine exploitation. Google linked the group to **`CVE-2022-41128`**, a type confusion flaw in **`jscript9.dll`** that enabled arbitrary code execution after victims opened Office lures themed around the Itaewon tragedy; the documents fetched remote content that was rendered through Internet Explorer, validated infections with cookies, reported to command-and-control servers, and then downloaded follow-on payloads while clearing browser artifacts. Genian later reported a sustained 2023 campaign in which APT37 used **HWP**, **HWPX**, **LNK**, **DOCX**, and **XLSX** files, with embedded **OLE** objects in Korean document formats triggering connections to attacker-controlled infrastructure and reflecting techniques tied to the earlier Internet Explorer exploit activity. AhnLab and South Korea’s **NCSC** also disclosed a separate APT37 operation exploiting **`CVE-2024-38178`**, another **`jscript9.dll`** type confusion vulnerability in the legacy Internet Explorer engine. In that campaign, attackers compromised a domestic advertising agency server and weaponized toast-style ad software that still depended on Internet Explorer, creating a **zero-click** infection path in which malicious ad content was automatically downloaded and rendered without user interaction. The resulting malware provided remote command execution and other post-compromise capabilities, underscoring APT37’s continued focus on South Korean targets and its repeated abuse of deprecated browser components and document-based lures to gain code execution.
Aug 15, 2026
Google and Zscaler tied multiple intrusion campaigns to North Korean state-backed operators, including Lazarus-linked activity that targeted South Korean users, security researchers, cryptocurrency firms, fintech companies, IT organizations, and media entities. Google reported that two North Korean threat groups exploited the Chrome remote code execution flaw **`CVE-2022-0609`** in campaigns associated with **Operation Dream Job** and **Operation AppleJeus**, and assessed that the groups likely worked for the same entity while sharing a common exploit supply chain. Google also said one campaign overlapped with an earlier operation aimed at security researchers, where attackers created the fake security company **SecuriElite** and used social engineering tied to browser exploitation.
Aug 15, 2026