Profile assembled from related reporting. Attribution: reported.

North Korea

highCyber Attacks

U.S. Disrupts North Korean IT Worker Fraud Scheme, Seizes 187 Computers from 40 Laptop Farms

The U.S. Department of Justice announced the disruption of a North Korea-linked fraud operation involving fraudulent remote IT workers. Authorities seized approximately 187 computers from over 40 "laptop farms" and charged 14 individuals — a mix of U.S. citizens and Chinese nationals — with wire fraud conspiracy and related offenses. The scheme allegedly affected more than 70 U.S. companies, using stolen résumés and fake identities to secure remote employment and generate revenue for the Democratic People's Republic of Korea.

The Hacker News6 days ago1 min read

mediumPhishing

DPRK Threat Actors Conduct Reply-Baiting Phishing Against Ukrainian Targets

According to reporting from Dark Reading, threat actors associated with the Democratic People's Republic of Korea (DPRK) have initiated a phishing campaign targeting Ukrainian individuals. The attacks utilize a reply-baiting technique, where attackers initiate contact and wait for targets to respond, potentially revealing sensitive military or conflict-related information without relying on malicious links or attachments. The reporting notes the campaign aims to gather insight into the war effort, though the exact nature of the DPRK's involvement and the specific targets remain subject to ongoing assessment.

Dark reading7 days ago1 min read

highCyber Attacks

Bitget Resumes Bitcoin Withdrawals After $387.5 Million Crypto Heist

Bitget, a cryptocurrency exchange, has resumed Bitcoin withdrawals after suspending them last week amid reports of a suspected breach by North Korean hackers. The incident resulted in the theft of over $350 million, with some reports citing $387.5 million. The exchange had suspended withdrawals as a containment measure while investigating the intrusion.

BleepingComputer20 days ago1 min read

highCyber Attacks

North Korean APT Targets South Korean Media and Automotive Sectors with Novel Linux Espionage Toolkit

A likely North Korean advanced persistent threat (APT) group has been linked to a campaign against South Korean media and automotive companies. The attackers used a previously undocumented Linux espionage toolkit to compromise load balancers, gain unauthorized access to communications, and further exploit victim networks. The full scope of the operation remains undisclosed, and attribution is reported as 'likely' rather than confirmed.

Dark readingabout 1 month ago1 min read

highThreat Actors

North Korean Job Fraud Scheme Expands into Healthcare and Sales Sectors

Threat actors with ties to the Democratic People's Republic of Korea have been observed seeking job opportunities beyond the information technology sector. Recent investigations have identified suspected workers employed in sales, marketing, and medical professions as part of an ongoing insider threat campaign. The expansion represents an evolution of the established IT worker scheme, with operatives using falsified identities to gain employment in new target domains.

The Hacker Newsabout 2 months ago1 min read

highThreat Actors

Researchers Identify Red Flags Exposing Fake North Korean IT Workers

A Dark Reading report highlights how North Korean state-sponsored operatives are refining their impersonation tactics to infiltrate organizations as IT workers, and outlines specific red flags researchers have identified to detect these fraudulent hires before they can cause harm.

Dark readingabout 2 months ago1 min read

highThreat Actors

North Korean Remote IT Workers Infiltrate Government and Businesses via Fraudulent Job Applications

North Korean state-sponsored IT workers are infiltrating government agencies and private businesses by applying for remote positions using fake identities and stolen personally identifiable information. The FBI is actively investigating a specific case involving a North Korean remote IT worker who gained employment at an unnamed organization. These operatives use sophisticated interview techniques and fraudulent documentation to bypass hiring vetting, posing risks of data exfiltration, intellectual property theft, and compromised security postures for affected entities.

The Hacker Newsabout 2 months ago2 min read

North Korea

Quick answers

Related Articles

U.S. Disrupts North Korean IT Worker Fraud Scheme, Seizes 187 Computers from 40 Laptop Farms

DPRK Threat Actors Conduct Reply-Baiting Phishing Against Ukrainian Targets

Bitget Resumes Bitcoin Withdrawals After $387.5 Million Crypto Heist

North Korean APT Targets South Korean Media and Automotive Sectors with Novel Linux Espionage Toolkit

North Korean Job Fraud Scheme Expands into Healthcare and Sales Sectors

Researchers Identify Red Flags Exposing Fake North Korean IT Workers

North Korean Remote IT Workers Infiltrate Government and Businesses via Fraudulent Job Applications