GitLab published a report detailing a fresh wave of attacks in which researcher Oliver Smith analyzed a shift in tactics by a North Korean cyber group employing the BeaverTail and InvisibleFerret malware families. The...
The North Korean threat group APT37 (also known as ScarCruft, InkySquid, Reaper, and Ricochet Chollima) has launched a sweeping espionage campaign under the codename Operation HanKook Phantom, targeting government and research organizations in South...
On July 24, 2025, the cryptocurrency platform WOO X suffered a sophisticated targeted attack in which $14 million was siphoned from nine user accounts. All evidence points to the operation being orchestrated by the...
In the United States, a recruiter conducting a live video interview encountered a bot impersonating a job applicant. This incident highlighted the rapid evolution of AI-driven fraud schemes: no longer limited to generating resumes,...
The United Kingdom has formally accused North Korea of stealing £17 million ($22.8 million) in cryptocurrency from Lykke, a London-registered exchange. The breach forced the platform to suspend operations, cease activity altogether, and ultimately...
At the beginning of 2025, Trellix specialists uncovered a sweeping cyber-espionage campaign targeting diplomatic missions in Seoul. Between March and July, at least nineteen phishing attacks were recorded, in which North Korean–linked actors impersonated...
In the latest issue of the hacker magazine Phrack, a vast archive has been published detailing the operations of North Korean cybercriminal groups. The leak includes exploitation techniques, information on compromised systems, and a...
The North Korean cyber-espionage group Kimsuky has unexpectedly found itself in the role of victim after two hackers — identifying themselves as the “antithesis of Kimsuky’s values” — infiltrated its infrastructure and released stolen...
Generative AI models are rapidly evolving into fully-fledged instruments within the arsenals of cyber adversaries. This trend is underscored in CrowdStrike’s 2025 annual report, which highlights a sharp increase in the use of artificial...
In the first half of 2025, Sonatype uncovered a large-scale, ongoing assault on the open-source software ecosystem, orchestrated by the North Korean threat actor known as Lazarus. Sonatype’s automated malware detection systems were the...
The ShadowSyndicate infrastructure—also known by the alias Infra Storm—has come under intense scrutiny from cybersecurity professionals following its significant overlaps with some of the world’s most notorious ransomware operations. Active since mid-2022, the group...
Experts at the Genians Security Center have uncovered a sophisticated new variant of the RoKRAT malware, attributed to the North Korean threat group APT37. This latest iteration employs an unusually covert method of hiding...
