Topic
State-directed intrusion and revenue-generation activity attributed to the DPRK, including campaigns aimed at software developers and cryptocurrency holders.
Zscaler ThreatLabz says North Korea's TraderTraitor hid a malware loader inside a fake HashiCorp Terraform provider that runs the moment Terraform loads it. The crypto-theft group has pushed its operation into infrastructure-as-code, the tooling that provisions cloud environments.
Reality
Unit 42 says supply-chain attackers have moved command-and-control into blockchain smart contracts, so one transaction can re-point an entire botnet or worm. Defenders' useful choke points are now developer machines, CI runners and the chain lookup itself.
Reality
South Korea's People Power Party wants intelligence agencies in a joint probe of hacks it says have hit six lenders, four of them commercial banks. Its spokesperson concedes the attacker is unknown, so whether the six share one cause will decide who answers for them.
Reality
Bitget said a flaw in a third-party security product gave an attacker the internal credentials used to take about $388 million on September 24. With the product unnamed and no fix confirmed, other companies running it cannot yet check their own exposure.
Reality
Bitget says attackers took over a wallet backend system and fed its authorization process spoofed data, moving out $387.5 million without stolen keys. For teams running payouts, the data an approver trusts now belongs on the same review list as the keys.
Perspective Coverage
3 publishersReality
Malicious versions of three Rust crates ran code at compile time on August 20. Wiz says the infrastructure overlaps with DPRK operations, so the campaign should be treated as live.
Perspective Coverage
6 publishersReality
North Korea's WaterPlum stole $10.7 million in crypto from IT workers by posing as recruiters, infecting at least 30,000 devices. The FBI is investigating a separate ShinyHunters claim that agent data left its FBIjobs recruiting site.
Reality
Bitget says attackers took over a wallet backend, faked transaction data and got the exchange's own authorization process to move $351.6 million out. No key was reported stolen, so the failure is in where the approvers got their facts.
Reality
OpenSourceMalware says WeaselBiscuit borrows functions from DPRK's BeaverTail and OtterCookie but strips out the persistence and the wallet drainer. It runs from memory on an npm import and takes Chrome's extension storage.
Reality
Four governments have put a bureau name on the fake-recruiter campaign against software developers, and their alert says the same crews also work as North Korea's remote IT hires, from the same IP addresses.
Perspective Coverage
8 publishersReality
SentinelOne has documented North Korea's Jade Sleet inside a small Indian IT services provider, using Rust backdoors built for Apple Silicon and a Terraform lock file that points developers at a fake HashiCorp registry.
Reality
Bitget CEO Gracy Chen ties a $351 million breach of the exchange's online wallets to North Korean hackers and says a $464 million user fund covers it. Paying it out could leave about $113 million in reserve while withdrawals stay frozen and Bitget still cannot say how the attackers got in.
Reality