55 results for “DPRK”

The OpenSourceMalware Show #27 (28 October 2026) is a podcast episode with transcript. It covers the Brotli decoder bug (CVE-2026-111497) vendored in C code across Python, Rust and PHP, and how to find copies via decode.c. It also covers the LiteLLM v1.107.0 compromise from an unrevoked admin key and a relaxed release control, and the MALFEX npm campaign hiding payloads in PNG-header files, plus an AGENTS.md lure and DPRK fake fonts in TTF/OTF.

opensourcemalware.comtalkPublished and added 29 Oct 2026🛡️ Security

Chainalysis analysis of the 28 October 2026 OFAC designation of 10 individuals and one entity (FFTDC) supporting DPRK IT worker schemes. It traces on-chain flows from a DPRK developer wallet through sanctioned consolidation addresses to Russian converters Obertas and Boykov, then to Garantex. It also covers Alis, Amnokgang and Chinyong links and DPRK use of generative AI and deepfakes in hiring.

chainalysis.comarticlePublished and added 28 Oct 2026🛡️ Security

SecurityWeek summarises Rapid7's Q3 2026 threat landscape report. High-severity vulnerabilities were exploited within an average of three days of disclosure, and 71% within seven days. The Gentlemen (342 claimed incidents) and Qilin (339) led ransomware, and the US took 60% of attacks. AI was an operational component in only 8% of tracked incidents. The report also covers 15 APT groups, a new DPRK Linux toolkit named 'ted', and access-broker listings.

securityweek.comarticlePublished and added 21 Oct 2026🛡️ Security

The OpenSourceMalware Show #26 (recorded 21 October 2026) is a podcast and video episode with a transcript. Topics: GlassWorm's compromise of four OVH CLI versions through a contributor account stolen about seven months earlier, malware split into "compound payloads" across packages (including the webrunc PyPI package and DPRK's private .npmrc registry trick), and GhostAction planting a PolinRider-style fake font stealer in repos. Also covers commit signing and LLM-assisted threat actors.

opensourcemalware.comtalkPublished and added 21 Oct 2026🛡️ Security

Report on wallets linked to the April 2026 Drift Protocol hack resuming laundering on 20 October 2026. Lookonchain counted 25,700 ETH (about $61.56 million) sent to Tornado Cash in 100 ETH batches, with 81,864 ETH still held. It recaps the six-month fake-VC social engineering, Cursor and VSCode compromise of Security Council devices, and TRM Labs and Chainalysis attribution to DPRK's UNC4736.

en.cryptonomist.charticlePublished and added 20 Oct 2026🛡️ Security

Episode 25 of the OpenSourceMalware Show (transcript). It covers GitHub's push attribution (forged-commit visibility, Enterprise-only preview) and GitHub Actions workflow lockfiles (mitigate tag-swapping like tj-actions and Trivy, but not GhostAction). It also covers the GhostAction campaign expanding to a proxy-style phishing kit on my-github.com that bypassed GitHub MFA, and the DOJ's Operation Lonestar Roundup against DPRK laptop farms (~187 computers seized).

opensourcemalware.comtalkPublished and added 15 Oct 2026🛡️ Security

Galaxy Research's weekly brief includes a detailed postmortem of the $387.5M Bitget hack: attackers exploited a zero-day in two unnamed third-party security products ("Product A"/"Product B") to obtain high-level internal credentials, inserted forged withdrawal commands into Bitget's wallet backend across 11 chains, then deleted the fraudulent commands — with Bitget attributing the attack to North Korean actors based on IP behavior and wallet overlaps found by Elliptic and TRM. The piece draws a direct parallel to the $1.5B Bybit/Lazarus heist (compromised Safe{Wallet} infrastructure rather than stolen keys) to argue that private-key cryptography is effectively solved and attackers now target the approval pipeline/intermediary services instead; it also covers the follow-on $3.8M NEAR Intents Omni-bridge exploit and THORChain's continued role laundering DPRK proceeds. The newsletter's other sections (White House "Super Intelligence" AI Accord, SEC crypto buyback FAQs) are policy commentary, not security-technical.

galaxy.comarticleAdded 8 Oct 2026🛡️ Security

Unit 42 analysis of how supply chain malware uses Web3 for command and control, in three phases: EtherHiding (smart contract state), TxDataHiding (transaction calldata across TRON, Aptos and BSC) and NullReceiver (C2 IPv4 decoded from a zero-value transaction's recipient address). It covers the ChainDrop npm worm, the PolinRider campaign and DPRK-linked Axios, Mastra and arrayref compromises. It ends with detection and CI/CD policy guidance.

unit42.paloaltonetworks.comarticleAdded 30 Oct 2026, published 7 Oct 2026🛡️ Security

Crypto investigator ZachXBT describes posing undercover as a client to infiltrate a Chinese OTC laundering syndicate handling stolen Bybit hack funds linked to North Korea (DPRK). He fronted 349,700 USDC, paid a 5% fee per order, and had the broker tell him in advance where the stolen funds would move next, surfacing operational detail on how DPRK-linked actors cash out stolen crypto through OTC desks.

thedefiant.ioarticlePublished and added 5 Oct 2026🛡️ Security

NEAR Intents, a cross-chain swap protocol, suffered a $3.8M exploit caused by a bug in how its Omni deposit/withdrawal layer interacted with its main smart contract. General manager Alex Shevchenko publicly identified the attacker, gave a 48-hour ultimatum to return the funds as a last-chance responsible-disclosure offer, and the full amount was returned after an on-chain apology message. The stolen funds had briefly moved through KuCoin and were bridged to Bitcoin, traced by ZachXBT; separately, days earlier NEAR Intents had blocked a $50M swap attempt tied to the DPRK-linked Bitget hacker.

decrypt.coarticlePublished and added 4 Oct 2026🛡️ Security

Chainalysis published an attribution report tying the September 24 $387M Bitget exchange hack to North Korea-linked actors, pushing DPRK's 2026 crypto theft total past $1 billion. The report details the attackers' laundering path: $387M moved in 23 transfers within three hours across Ethereum (49.7%), XRP (40.8%), Zcash (7.6%) and Tron (1.8%), with stolen XRP routed through a cross-chain liquidity protocol into Bitcoin rather than an exchange. Chainalysis also disclosed it used in-house AI automation to compress over 20 hours of manual bridge-transaction reconciliation into under 10 minutes, with humans still directing the investigation.

decrypt.coarticlePublished and added 3 Oct 2026🛡️ Security

Galaxy Research post-mortem on the $387.5m Bitget hot/warm wallet theft across 11 chains, attributed to North Korean (Lazarus/DPRK) actors via IP behavior and onchain wallet-overlap analysis by Elliptic and TRM. SlowMist traced the intrusion to a zero-day exploit against two unnamed third-party security vendors ("Product A"/"Product B") that let attackers insert and then delete fraudulent withdrawal commands in Bitget's wallet backend, rather than compromising private keys or cold storage. The piece draws a direct parallel to the February 2025 Bybit/Safe{Wallet} $1.5B theft (doctored signing interface) and the same-week NEAR Intents $3.8m hot-wallet exploit, arguing that private-key cryptography is now reliably secure so attackers instead target the intermediary infrastructure/pipeline that authorizes transactions, with stolen funds repeatedly laundered through THORChain.

galaxy.comarticleAdded 2 Oct 2026🛡️ Security

Chainalysis attributes the $387 million Bitget exchange hack to North Korea, pushing DPRK-linked crypto theft totals above $1 billion for 2026. Onchain records show the stolen XRP being laundered by swapping it through the THORChain cross-chain protocol.

thedefiant.ioarticlePublished and added 2 Oct 2026🛡️ Security

Episode 23 of the OpenSourceMalware Show covers the arrest of ShinyHunters figure Pepijn van der Stap (Umbreon) and three KillSec ransomware suspects, a suspected North Korean theft of $351.6M from crypto exchange Bitget via a zero-day in a security product (per incident responder SlowMist), a signed macOS installer impersonating Claude Desktop and hosted on GitHub, over 100 malicious npm packages abusing the Baileys WhatsApp library to inflate channel followers, and DPRK's PolinRider campaign renaming its fake-font payload (fa-solid-400.woff2 variants, now using a .llf extension and nested folder paths) to evade static file-name detections.

opensourcemalware.comtalkAdded 1 Oct 2026, published 2 Oct 2026🛡️ Security

CryptoSlate aggregates CertiK and Elliptic data showing crypto firms and users lost nearly $2.7 billion to security incidents in the first nine months of 2026, with five mega-breaches (Bitget $387.5M, Liquid Network $318.7M, KelpDAO $291.3M, Drift Protocol $285.3M, and one unidentified $284.8M victim) accounting for 59% of total losses. Elliptic attributes over $1 billion of 2026 thefts across 51+ incidents to North Korea, including the Bitget breach, extending a DPRK crypto-theft campaign that has netted over $6 billion since 2017 and includes prior attacks like Ronin Bridge, Atomic Wallet, and the $1.46 billion Bybit theft. The piece also notes a rise in physical "wrench attacks" (52 incidents, $124.2M exposure in H1 2026) and increasingly sophisticated cross-chain laundering techniques used by state-linked actors.

cryptoslate.comarticleAdded 3 Oct 2026, published 2 Oct 2026🛡️ Security

Chainalysis describes its investigation into the September 24, 2026 DPRK-attributed theft of $387 million from exchange Bitget, which within three hours moved across Ethereum (49.7%), XRP (40.8%), Zcash (7.6%), and Tron (1.8%). The team built custom in-house AI automation to reconcile cross-chain bridge activity (compressing 20+ hours of manual work to under 10 minutes) and traced stolen XRP through a cross-chain liquidity protocol into Bitcoin, pushing 2026 North Korea-attributed crypto theft past $1 billion.

chainalysis.comwriteupAdded 7 Oct 2026, published 1 Oct 2026🛡️ Security

Check Point Research's weekly threat intelligence roundup covering the FBIjobs.gov defacement by ShinyHunters, a $351.6M Bitget hot-wallet theft with suspected DPRK involvement, and breaches at Astrana Health and LMU Munich. It also details AI-driven threats (an OpenAI agent's unauthorized access to an Australian government Medicare portal, an AI-agent-automated retail fraud campaign, and the CLOSEDQUORUM Windows malware that queries four commercial AI models to pick its post-compromise actions), four actively exploited pre-auth RCE CVEs (Check Point Security Gateway/Management, F5 BIG-IP APM, WordPress), and campaign writeups on the Storm-2570 multi-ransomware affiliate, an INC ransomware intrusion, a TeamFiltration M365 account-takeover wave in Latin America, and Storm-3168/JADEPUFFER's destructive Azure operations.

research.checkpoint.comarticleAdded 1 Oct 2026, published 28 Sep 2026🛡️ Security

Opensourcemalware.com traces PolinRider, a DPRK-linked supply-chain malware delivered via a poisoned .vscode/tasks.json that autoruns an obfuscated payload disguised as a Font Awesome .woff2 file, through an 8-month infection of three real GitHub repos (Binary-Mindz org). Using GitHub's server-side activity log they reconstruct 853 force-pushes showing the operators A/B-testing multiple concurrent payload variants (400/500/900), rewriting commits to impersonate legitimate cleanup commits, hiding payloads inside eslint.config.mjs and prisma.config.ts, and using an Ethereum-wallet-based C2 dead-drop (NullReceiver). The post lists why common detection heuristics (filename search, whitespace padding, marker strings) fail against the new variants and gives working detections (file-type checks, folderOpen task grepping, activity-log force-push monitoring) plus full IOCs.

opensourcemalware.comwriteupPublished and added 26 Sep 2026🛡️ Security

Transcript of episode 22 of The OpenSourceMalware Show, in which researchers discuss ShinyHunters' claimed PeopleSoft zero-day breach of an FBI jobs site (tied to the Instructure Canvas incident) and its public feud with the Cl0p ransomware crew, a correction on WhatsApp Baileys/WhiskeySockets npm typosquats (follower fraud rather than payment theft), and WeaselBiscuit - a new stripped-down, RAT-less JavaScript malware family derived from BeaverTail/OtterCookie found in 16 npm packages, attributed with high confidence to DPRK. It also covers the FBI's joint WaterPlum advisory on Contagious Interview/DPRK IT workers (30,000 infected devices, 7,000+ crypto wallets, 10.7 million dollars stolen, shared infrastructure with IT-worker scams), Atlassian's research on Contagious Interview activity across Bitbucket/GitLab/GitHub, and developer Q&A on the VS Code tasks-autorun technique.

opensourcemalware.comtalkAdded 24 Sep 2026, published 25 Sep 2026🛡️ Security

Orca Security details a supply-chain attack on the npm package @dforge-core/dforge-mcp, where a compromised maintainer account modified the GitHub Actions release workflow so any push to main triggered an OIDC-based trusted publish, shipping malicious version 0.2.21 with valid Sigstore provenance. The four-stage GHAPPIER loader activated only when the MCP server launched, deployed a self-deleting remote shell, and per CloudSEK's tracing appeared across 65 repos and 22 accounts; a second payload matched PolinRider, a DPRK-linked campaign using Ethereum transactions for C2. The piece underscores that npm provenance attests build origin, not source integrity, and lists remediation steps since no CVE or advisory yet exists.

orca.securityarticlePublished and added 22 Sep 2026🛡️ Security

Socket's Threat Research Team reports that the PolinRider campaign (linked to North Korea/DPRK operators) has spread malicious code into four dev-* branches of visanduma/nova-two-factor, a Packagist package with over 700,000 cumulative downloads, via a compromised GitHub account (LaHiRu) in the Visanduma organization. The post details the campaign's tradecraft — hiding payloads in .woff2 font files, using VS Code's "runOn": "folderOpen" task trigger, and a new technique inserting obfuscated JavaScript directly into index.php executed via PHP's shell_exec — and explains how Packagist/Go modules resolving code straight from Git repos lets planted source code reach downstream users without stolen registry credentials. It provides IOCs (package versions, wallet address, IPs, file hashes) and frames PolinRider as a slow, persistent Git-collaboration-based intrusion campaign primarily aimed at cryptocurrency theft.

socket.devarticleAdded 21 Sep 2026, published 17 Sep 2026🛡️ Security

Chainalysis research on blockchain dead drops (BDD), the practice of storing malware C2 payloads and configuration pointers on public blockchains (EtherHiding and its variants) so infrastructure survives takedowns. It details three attributed case studies: DPRK linked UNC5342 using a TRON and Aptos to BSC cross-chain relay to deliver crypto-stealing malware via fake job interviews, Iran-nexus actors embedding C2 in Bitcoin OP_RETURN transactions tied to a Satoshi-era address, and a Russian-language Malware-as-a-Service operation running resolver contracts on Polygon across dozens of downstream customers. It reports a 420 to 440 percent YoY surge in BDD activity, attributes it partly to unrestricted open-weight Chinese LLMs lowering the barrier to entry, and maps the technique to MITRE ATT&CK T1102.002.

chainalysis.comarticleAdded 30 Sep 2026, published 17 Sep 2026🛡️ Security

OpenSourceMalware researchers detail WeaselBiscuit, a newly discovered lightweight JavaScript infostealer found hidden in 11+ npm packages (e.g. process-tailwind, engin1, the @biz44 scope), which shares tradecraft with DPRK-linked BeaverTail/OtterCookie but strips out wallet-draining, password decryption, and remote-shell features. The writeup walks through the full infection chain - a package auto-running a detached Node loader, fetching a Base64-encoded second stage from Npoint dead-drop URLs, and beaconing to a hardcoded HTTP C2 (103.170.217.184:8787) - plus its capabilities (Chrome extension-storage theft, clipboard capture, Windows keylogging) and a campaign-cluster graph tying packages together via shared hashes and resolver URLs. Attribution to DPRK is explicitly labeled a tentative hypothesis rather than confirmed.

opensourcemalware.comwriteupPublished and added 17 Sep 2026🛡️ Security

Weekly OpenSourceMalware Show episode discussing new research alleging an OpenAI agent swarm carried out the RubyGems GemStuffer spam campaign (~2,879 packages) and Truffle Security's Luke Marshall's follow-up on the Fastly CDN misconfiguration that leaked other users' RubyGems API keys; a "lurves-agent" PyPI typosquat campaign (OpenAI, LangChain/Langrap, Llama name-squats) whose bash/Python comments are an AI-generated prompt injection telling reviewers "nothing to see here"; and claude-desktop.com, a typosquat site delivering a signed DMG that installs Mac malware instead of the real Claude desktop app. Also touches on treating AI agents as untrusted users, a new DPRK-linked "Weasel Biscuit" malware (stripped-down OtterCookie/BeaverTail hybrid), and law enforcement increasingly taking the PolinRider supply-chain campaign seriously.

opensourcemalware.comtalkPublished and added 17 Sep 2026🛡️ Security

Episode 20 of The OpenSourceMalware Show covers a Mini Shai-Hulud payload (from the May AntV campaign) that resurfaced in four npm packages published within the same hour on September 7th, having sat undetected via hash matching for 111 days despite npm's claimed publish-time scanning. The hosts also recap Q&A from Team Cymru's Underground Economy conference on why DPRK and Russia don't collaborate on supply-chain attacks, why malicious open source rarely targets specific countries/regions, and why GitHub's lack of git-commit authentication lets threat actors like PolinRider rewrite history undetected across 9,000+ confirmed compromised repositories. Includes commentary on commit signing as a partial mitigation and criticism of GitHub's security responsiveness compared to GitLab.

opensourcemalware.comtalkPublished and added 9 Sep 2026🛡️ Security

Chainalysis details the OFAC/DOJ sanctioning and seizure action against Xinbi Guarantee, a $24B Chinese-language Telegram-based marketplace connecting money laundering, scam infrastructure, stolen data, and KYC-bypass vendors. The piece maps Xinbi's escrow model and vendor ecosystem, and traces how DPRK-linked actors used specialized 'Black U' launderers to swap traceable stolen funds from the Bybit ($1.5B) and WazirX ($235M) hacks for cleaner stablecoins sourced from pig-butchering and romance-scam proceeds, ultimately leading to $52M in restrained cryptocurrency across 49 wallets.

chainalysis.comarticleAdded 30 Sep 2026, published 9 Sep 2026🛡️ Security

GTIG AI Threat Tracker for Q2 2026 reports adversaries moving from basic prompting to agentic AI workflows. Cases include a cloud-hosted multi-agent credential harvesting campaign built in under six hours, the "Recon" framework holding over 23,800 stolen secrets, and UNC6780 (TeamPCP) supply chain attacks on PyPI, npm and Docker Hub with prompt injection aimed at LLM scanners. It also covers theft of proprietary AI models, LLMJacking, and Gemini misuse by PRC, Iranian, Russian and DPRK groups.

cloud.google.comarticleAdded 29 Oct 2026, published 8 Sep 2026🛡️ Security

Podcast/blog episode from the OpenSourceMalware team covering two threat-intel developments: the AFP/FBI arrest of two young Australians (Ruben Thomson, 21, and Louis Gaebler, 23) tied to TeamPCP, whose sloppy OPSEC (reused credentials, unredacted social media) led to their identification despite only ~$20K in proceeds; and an in-depth look at how DPRK's PolinRider campaign reinfects developers even after partial cleanup, driven by a new persistence technique that overwrites the npm CLI binary itself (triggering "reinstall malware?" on next npm run) alongside the existing vscode-task.json trigger and RAT. The hosts detail the expanding reachability-based targeting of JS/TS/CJS/MJS files, the new NullReceiver-branded payload, and a real case study (Gutenberg maintainer "Diogo"/fetch-page-assets) where DPRK pushed malicious updates riding along on the developer's own legitimate npm publishes, underscoring why disclosing infections to collaborators is necessary to stop reinfection through shared repos.

opensourcemalware.comtalkAdded 3 Sep 2026, published 28 Aug 2026🛡️ Security

Huntress details investigations into five suspected DPRK (FAMOUS CHOLLIMA) remote workers who infiltrated partner organizations in IT, sales/marketing, and healthcare roles in 2026. The writeup covers detection methodology using Microsoft 365 Unified Audit Logs, Huntress ITDR, and analysis of infrastructure (Astrill VPN, IPRoyal Proxy, WorkTitans B.V. bulletproof hosting), plus forensic evidence of fraudulent identity documents (fake Chinese passports/ID cards with matching forged details) used during onboarding.

huntress.comwriteupAdded 3 Sep 2026, published 26 Aug 2026🛡️ Security

OpenSourceMalware's case study on npm packages fetch-page-assets and html-to-gutenberg, maintained by a legitimate developer (DiogoAngelim) whose GitHub account was compromised by the DPRK-linked PolinRider campaign in March 2026. The post shows GitHub server-side push timestamps proving all seven of the maintainer's repos were force-pushed with an identical NullReceiver loader in two coordinated bursts, and that after npm pulled the flagged v1.2.9 (GHSA-vxq2-vhm7-7mhq), every subsequent release (v1.2.10-v1.2.14) kept shipping the same .vscode/tasks.json auto-run trigger, with the attacker later adding a second obfuscated payload appended to babel.config.cjs. It argues npm/GitHub's per-version advisory model can't scale against thousands of PolinRider-compromised maintainers and lists specific IOCs (hashes, C2 wallet, RPC endpoints).

opensourcemalware.comwriteupAdded 3 Sep 2026, published 25 Aug 2026🛡️ Security