Loading story…
North Korean operators are expanding access and revenue-generation operations through fraudulent remote employment, targeted intrusions, and cryptocurrency theft. The DPRK-linked Famous Chollima group—also tracked as UNC5267 and Jasper Sleet—uses fabricated identities, falsified documents, AI-assisted communications, proxy interviewers, laptop farms, and payment fraud to secure remote IT roles at technology, aerospace, defense, software, blockchain, cryptocurrency, and DeFi organizations. The workers gain legitimate internal access by abusing recruiting, onboarding, payroll, and remote-work processes, with activity concentrated in the United States and increasingly observed in Europe.
Other DPRK-linked activity demonstrates a broader intrusion capability. Andariel has used watering-hole compromises, spearphishing attachments, malicious macros, and exploitation of client-side ActiveX vulnerabilities—including zero-days—to access targets, then deploys additional tools, enumerates systems and network connections, and collects files for exfiltration; it has also concealed executables in PNG files using steganography. Separately, the FBI, DC3, and Japan's National Police Agency attributed the theft of approximately $308 million from Bitcoin.DMM.com to North Korean actors tracked as TraderTraitor, underscoring the financial risk to cryptocurrency businesses and organizations with digital-asset exposure.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Google Threat Intelligence Group identified increased coordinated DPRK-linked fake-worker operations in several European countries.
The DPRK-linked fake IT worker scam emerged, using fraudulent identities to place operatives in remote jobs at foreign organizations and gain trusted access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
blog.barracuda.com
Open sourcefbi.gov
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft-linked reporting says **North Korean threat actors** are using **AI** to scale and refine long-running “fake IT worker” schemes, where operatives pose as legitimate remote hires to obtain *authorized* access inside victim organizations. The activity is attributed to DPRK-linked clusters **Jasper Sleet** and **Coral Sleet**, with AI used to improve identity fabrication and maintenance (including face/voice manipulation) and to sustain day-to-day communications that help keep fraudulent personas credible, enabling “sustained, large-scale misuse of legitimate access.” Separately, reporting on suspected DPRK-linked intrusions describes a coordinated campaign against **cryptocurrency organizations** spanning staking platforms, exchange software providers, and exchanges, with theft of **source code, private keys, and cloud secrets**. Investigators described two primary access paths: exploitation of `CVE-2025-55182` in the *React2Shell* framework (including mass scanning and WAF-bypass techniques) and the use of **pre-obtained valid AWS access tokens** to move directly into cloud enumeration; researchers also recovered artifacts from attacker infrastructure (e.g., shell history, archived code, and tool configurations) that provided visibility into post-compromise activity and C2 setup.
Jun 29, 2026
North Korean threat actors expanded beyond traditional espionage into large-scale cryptocurrency theft and intrusion campaigns, with research presented at Black Hat identifying **1,640 organizations in 57 countries** touched by the activity and roughly **700 to 800** showing clearly malicious compromise. Investigators said some intrusions reached **root-level access** on servers and **AWS accounts**, while attackers also abused third-party contractors to reach government, healthcare, and private-sector victims. The activity was linked broadly to DPRK operations including **Lazarus Group**, which researchers said continues to pair social engineering with crypto theft and laundering to generate revenue believed to support sanctions evasion and state priorities. Separate reporting tied the shift to specific DPRK espionage clusters now targeting crypto users and firms directly. **Konni** was described as moving from South Korea-focused Windows espionage to a global **macOS** campaign using fake recruiter or document lures, **AppleScript**, `LaunchAgents`, **TCC** abuse, and payloads including **FileRATClient** and an **EggShell** variant. **Kimsuky** was reported to have operated a fake trading platform, **Tralert FX**, distributing a trojanized desktop app through direct download and the Microsoft Store before deploying a customized **Xeno RAT** via GitLab staging; researchers said that campaign affected more than **250 victim IPs across 28 countries**.
Aug 25, 2026
The U.S. State Department, FBI, and allied governments warned that North Korean IT workers are obtaining freelance and full-time jobs at companies worldwide by using stolen identities, forged documents, proxy interview participants, VPNs, remote desktop tools, and overseas **"laptop farms"** that make them appear to be operating from trusted jurisdictions. Authorities said the workers funnel wages and cryptocurrency payments back to Pyongyang, helping fund North Korea’s nuclear weapons and ballistic missile programs while exposing employers to insider threats including **data exfiltration, credential theft, and cryptocurrency theft**. The warning builds on earlier reporting and government actions showing that DPRK-linked workers have infiltrated Western technology and cryptocurrency firms under false identities, sometimes through front companies and facilitators based in **Russia and China**. Researchers and prior U.S. cases have tied the scheme to broader risks beyond sanctions exposure, including potential malware deployment, espionage, disruption, and money laundering, prompting officials to urge stronger identity verification, closer scrutiny of interviews and payment arrangements, monitoring for anomalous account activity, and rapid reporting of suspected hires.
Aug 6, 2026