Loading story…
Elastic Security Labs identified a DPRK-attributed campaign, tracked as REF7001, that targeted blockchain engineers through Discord-distributed Python cryptocurrency-arbitrage bots. The multi-stage macOS infection chain downloaded SUGARLOADER, hijacked the Discord application for persistence using HLOADER, and reflectively loaded the final KANDYKORN payload in memory.
KANDYKORN is a memory-resident remote-access trojan that uses encrypted command-and-control communications and supports reconnaissance, interactive shell commands, file transfers, archiving and exfiltration, process termination, and configuration changes. Elastic assessed that the operation overlaps with the Lazarus Group based on shared infrastructure, code-signing patterns, detection logic, and tradecraft; a shared RC4 key indicated activity dating to at least April 2023.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Reddit posts reported fake recruiting contacts using similarly structured malicious URLs and Python speed-test coding challenges, consistent with the infrastructure and lures used in the campaign.
A DPRK-attributed intrusion set tracked as REF7001 began targeting blockchain engineers at a cryptocurrency exchange platform with a malicious Python cryptocurrency-arbitrage bot delivered through Discord. Elastic later traced the campaign to April 2023 through an RC4 key shared by SUGARLOADER and KANDYKORN.
Elastic Security Labs disclosed the REF7001 intrusion chain, in which a Discord-delivered Python lure downloaded SUGARLOADER, hijacked the macOS Discord application for persistence through HLOADER, and reflectively loaded the memory-resident KANDYKORN RAT. Elastic assessed overlaps with Lazarus Group based on infrastructure, code-signing patterns, detections, and techniques, and said the campaign remained active.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed two likely DPRK-linked malware operations that used public blockchains as resilient command-and-control infrastructure while targeting the cryptocurrency ecosystem and software developers. Elastic Security Labs said the **PHANTOMPULSE** Windows RAT, delivered through abused Obsidian plugins and the `PHANTOMPULL` loader, used multiple process-injection techniques, a `schuac`-based UAC bypass via `IElevatedFactoryServer`, hardware breakpoints to suppress **AMSI**, **WLDP**, and **ETW**, and scheduled tasks for persistence. The implant conducted host reconnaissance, screenshot capture, keylogging, and clipboard monitoring, and resolved its latest C2 by reading transaction data from **Ethereum**, **Base**, and **Optimism**, with Telegram and hardcoded-domain fallback paths also noted. A separate supply-chain intrusion attributed to **Famous Chollima** compromised the legitimate Packagist package `roberts/leads`, hiding malicious JavaScript in a development-branch `tailwind.js` file that fetched encrypted payloads from **TRON**, **Aptos**, and **BNB Smart Chain**. Socket linked the activity to prior DPRK tooling including **DEV#POPPER RAT**, **OmniStealer**, and **BeaverTail**, while public reporting and social-media tracking tied it to the broader **Contagious Interview** ecosystem. Elastic said PHANTOMPULSE's blockchain resolver failed to verify transaction senders, creating a rare opportunity for defenders to sinkhole infected hosts with a crafted transaction, and advised monitoring suspicious scheduled tasks, unusual `rundll32.exe` execution, hardware-breakpoint tampering, and Node.js access to blockchain or RPC services during builds.
Jun 29, 2026
A DPRK-linked **XCTDH** campaign targeting cryptocurrency and software developers has added an Ethereum-based command-and-control recovery mechanism, **HashHiding**, to its existing multichain infrastructure. Malware scans transactions from a designated Ethereum signal wallet and decodes a replacement C2 IPv4 address and port from the recipient address of ordinary coin transfers, allowing operators to rotate infrastructure without updating malware. Researchers observed 2,655 Ethereum beacon transactions and four C2 rotations; HashHiding operates alongside hardcoded C2 servers and a TRON/Aptos-to-BNB Smart Chain payload-resolution chain. The operators use fake job offers, poisoned GitHub repositories, and trojanized NPM packages to deliver the Node.js-based **DEV#POPPER.js** RAT and **OmniStealer** credential harvester across Windows, macOS, and Linux. The RAT can execute commands and collect keystrokes and clipboard data, while OmniStealer targets browser, password-manager, cloud-storage, and cryptocurrency-wallet data. The activity reflects broader adoption of blockchain dead drops—public-chain transactions, smart contracts, or wallets used to carry C2 instructions or payload pointers—by DPRK, Iranian, and criminal operators, making conventional server blocklisting insufficient without detecting the initial developer-targeting infection chain and blockchain-resolution behavior.
Sep 29, 2026
North Korean threat actors expanded beyond traditional espionage into large-scale cryptocurrency theft and intrusion campaigns, with research presented at Black Hat identifying **1,640 organizations in 57 countries** touched by the activity and roughly **700 to 800** showing clearly malicious compromise. Investigators said some intrusions reached **root-level access** on servers and **AWS accounts**, while attackers also abused third-party contractors to reach government, healthcare, and private-sector victims. The activity was linked broadly to DPRK operations including **Lazarus Group**, which researchers said continues to pair social engineering with crypto theft and laundering to generate revenue believed to support sanctions evasion and state priorities. Separate reporting tied the shift to specific DPRK espionage clusters now targeting crypto users and firms directly. **Konni** was described as moving from South Korea-focused Windows espionage to a global **macOS** campaign using fake recruiter or document lures, **AppleScript**, `LaunchAgents`, **TCC** abuse, and payloads including **FileRATClient** and an **EggShell** variant. **Kimsuky** was reported to have operated a fake trading platform, **Tralert FX**, distributing a trojanized desktop app through direct download and the Microsoft Store before deploying a customized **Xeno RAT** via GitLab staging; researchers said that campaign affected more than **250 victim IPs across 28 countries**.
Aug 25, 2026