🕵️ DPRK

The items that name it 97

• Binance Just Suffered the Biggest Hack in Crypto History. What Now?
  articleas classification.key entities2026-10-30
• Secret Service, FBI Join Binance Hack Probe as Circle Freezes $823 Million
  articleas classification.key entities2026-10-30
• In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak
  articleas classification.key entities2026-10-30
• Binance hack: the largest robbery in financial history
  articleas classification.key entities2026-10-30
• What is EIP-7702? The Ethereum Upgrade Behind the $6.4B Binance Hack
  articleas classification.key entities2026-10-30
• Binance hack: how a compromised developer laptop can lead to a $6.3 billion breach
  articleas classification.key entities2026-10-30
• TRM and Chainalysis Tie $6.4B Binance Hack to North Korea's TraderTraitor
  articleas classification.key entities2026-10-30
• TRM says Binance crypto hack stole $6.36B across 10 chains, mostly in 20 minutes
  articleas classification.key entities2026-10-30
• Binance Exploit: Latest Findings and Response
  articleas classification.key entities2026-10-30
• Binance links $6.3 billion crypto theft to compromised DevOps laptop
  articleas classification.key entities2026-10-30
• $6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor
  articleas classification.key entities2026-10-30
• Binance probes a suspected cryptocurrency breach: $6.3B affected, about $3B frozen
  articleas classification.key entities2026-10-30
• Earliest Known PolinRider Malware Found in 2025 npm Packages
  writeupas classification.key entities2026-10-30
• Tracking AI adoption in North Korean threat actor tradecraft
  articleas classification.key entities2026-10-29
• Treasury Sanctions 11 Over North Korean IT Worker Scheme That Moved Millions in Crypto
  articleas classification.key entities2026-10-29
• The OpenSourceMalware Show #27
  talkas classification.key entities2026-10-29
• Treasury Sanctions Russians, North Koreans supporting DPRK IT Worker Fraud
  articleas classification.key entities2026-10-28
• Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles
  writeupas classification.key entities2026-10-25
• High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
  articleas classification.key entities2026-10-21
• The OpenSourceMalware Show #26
  talkas classification.key entities2026-10-21
• AI Is Calling In Every Risk You've Accepted: Seven Insights From The AI Security Panel: Unfiltered
  articleas classification.key entities2026-10-21
• Wallet Linked to Drift Exploit Sends $61 Million in Ethereum to Tornado Cash
  articleas classification.key entities2026-10-20
• Stolen Ethereum laundering resumes as 25,700 ETH flow into Tornado Cash mixer
  articleas classification.key entities2026-10-20
• GhostAction Copycats PolinRider by Hiding a Stealer in a Fake Font File
  writeupas classification.key entities2026-10-16
• The OpenSourceMalware Show #25
  talkas classification.key entities2026-10-15
• The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
  articleas classification.key entities2026-10-15
• US Arrests Two in Crackdown on North Korean IT Worker Laptop Farms
  articleas classification.key entities2026-10-14
• New research: malware in open source ecosystems surges 14x as attackers hijack trusted packages | Endor Labs
  articleas classification.key entities2026-10-12
• The OpenSourceMalware Show #24
  talkas classification.key entities2026-10-09
• Evolution of Web3 in Cloud Supply Chain Attacks
  articleas classification.key entities2026-10-07
• How to Investigate a GitHub Repo's Real History
  writeupas classification.key entities2026-10-06
• Chinese network laundered $1B+ for North Korea's Lazarus Group — ZachXBT
  articleas classification.key entities2026-10-06
• Flash Loan Attacks Drained $1.2B From DeFi Between 2020 and 2024: Study
  articleas classification.key entities2026-10-06
• Crypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers
  articleas classification.key entities2026-10-05
• ZachXBT Posed as a Client to Infiltrate Chinese Syndicate Laundering Bybit Hack Funds
  articleas classification.key entities2026-10-05
• 'We Have Identified You, Sir': Near Intents Recovers $3.8 Million After 48-Hour Ultimatum
  articleas classification.key entities2026-10-04
• Chainalysis Links $387 Million Bitget Hack to North Korea
  articleas classification.key entities2026-10-02
• The OpenSourceMalware Show #23
  talkas threat actors2026-10-02It is written here as DPRK (North Korean state-sponsored hackers).

  Suspected in the $351.6 million Bitget crypto exchange theft via a zero-day in an unnamed security product; also linked to the PolinRider campaign.

• How AI Helped Chainalysis Investigators Trace the $387 Million North Korea Stole from Bitget
  writeupas classification.key entities2026-10-01
• Bitget Hacker Turns to Zcash Privacy Pool After Near Rejects $50M in Swaps
  articleas classification.key entities2026-09-30
• NEAR Stopped Bitget's Hackers Without Breaking Privacy
  articleas classification.key entities2026-09-29
• Check Point Research — 28th September Threat Intelligence Report
  articleas classification.key entities2026-09-28
• PolinRider is A/B Testing its Way Past Your Detections
  writeupas threat actors2026-09-26

  Attributed by the author as the actor behind PolinRider, using it to infect developers with malware.

• Bitget Hacked for $351.6M
  articleas classification.key entities2026-09-25
• The OpenSourceMalware Show #22
  talkas classification.key entities2026-09-25
• Trust and the enticing consultancy offer
  articleas classification.key entities2026-09-24
• Package Manager Sandboxing (Andrew Nesbitt)
  articleas classification.key entities2026-09-24
• npm Supply-Chain Attack Abuses Trusted Publishing to Ship GHAPPIER Loader
  articleas classification.key entities2026-09-22
• PolinRider Spreads Through Compromised GitHub Accounts and Packagist
  articleas classification.key entities2026-09-17
• DPRK and Iran are Leading a 5.2x Surge YoY in Blockchain-Assisted Cyberattacks
  articleas classification.key entities2026-09-17
• WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials
  writeupas threat actors2026-09-17

  Suspected state-linked actor tentatively attributed to WeaselBiscuit based on tradecraft overlap (Npoint dead-drop pattern, nested ipify/ip-api geolocation lookup, Express polling C2 as simplified port of OtterCookie's Socket.IO plane); confidence rated low to moderate, no exclusive infrastructure o

• The OpenSourceMalware Show #21
  talkas classification.key entities2026-09-17
• The OpenSourceMalware Show #20
  talkas classification.key entities2026-09-09
• OFAC and DOJ Strike Xinbi, a Multibillion-Dollar Marketplace for Cybercriminals
  articleas classification.key entities2026-09-09
• GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI
  articleas classification.key entities2026-09-08
• The OpenSourceMalware Show #19
  talkas classification.key entities2026-08-28
• NPM Isn't Prepared For North Korean PolinRider Attack
  writeupas classification.key entities2026-08-25
• Shai-Hulud was the best thing to happen to supply chain security
  articleas classification.key entities2026-08-24
• The OpenSourceMalware Show #18
  talkas classification.key entities2026-08-21
• Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns
  writeupas classification.key entities2026-08-20
• Popular Rust crates arrayref, append-only-vec, and internment compromised in Supply Chain Attack
  writeupas classification.key entities2026-08-20
• The OpenSourceMalware Show #17
  talkas classification.key entities2026-08-14
• The OpenSourceMalware Show #16
  talkas classification.key entities2026-08-08
• Cloud Threat Highlights: H1 2026
  writeupas classification.key entities2026-08-06
• NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding
  writeupas classification.key entities2026-08-02
• The OpenSourceMalware Show #15
  talkas classification.key entities2026-07-31
• PolinRider Caused Dozens of npm, Go, PHP Compromises
  writeupas classification.key entities2026-07-31
• NPM Implements Pre-Publication Malware Scanning, But Will It Work?
  articleas classification.key entities2026-07-31
• The OpenSourceMalware Show #14
  talkas classification.key entities2026-07-23
• OpenSourceMalware Blog
  articleas threat actors2026-07-18

  North Korean state threat actor linked to PolinRider, chalk/debug attack, Axios-linked packages, NullReceiver C2 technique, and Neutralinojs compromise; automation enabled compromise of 27 legitimate packages without targeting.

• ChainVeil and ViteVenom are DPRK’s PolinRider Campaign
  writeupas classification.key entities2026-07-17
• KUDANKULAM NUCLEAR POWER PLANT LEAK: AN ACCIDENTAL DISCLOSURE
  writeupas classification.key entities2026-07-17
• The OpenSourceMalware Show #13
  talkas threat actors2026-07-16It is written here as DPRK (North Korea).

  State-sponsored actor attributed to PolinRider and Contagious Interview campaigns; described as compromising developer laptops via contagious interview lures and malicious npm/PyPI packages, then reusing access for supply-chain poisoning

• PolinRider Confirmed Footprint Grows 6.5x Since March
  writeupas classification.key entities2026-07-15
• The OpenSourceMalware Show #12
  talkas classification.key entities2026-07-09
• PolinRider Jumps the Fence to Go, Packagist, npm, PyPI
  writeupas classification.key entities2026-07-08
• Socket: PolinRider
  writeupas classification.key entities2026-07-02
• MCP Auto-Execution: From Git Clone to Cloud Compromise in Amazon Q VS Code Extension
  writeupas classification.key entities2026-06-26
• The OpenSourceMalware Show #10
  talkas classification.key entities2026-06-25
• macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox
  writeupas classification.key entities2026-06-23
• The OpenSourceMalware Show #9
  talkas threat actors2026-06-18It is written here as DPRK (North Korea-linked actors, referenced alongside Lazarus Group).

  Discussed as historically focused on cryptocurrency theft; noted by host as consistently importing the Sentry IO library early in obfuscated malware (e.g., index.js) as a 'calling card' for exfiltration ('living off the SaaS'); speculated to possibly be diversifying into initial access brokering. As

• Mastra Attack Targets Crypto, Password Managers, Authenticators, and Zapier
  writeupas classification.key entities2026-06-18
• The Pros and Cons of NPM v12's Security Improvements
  articleas classification.key entities2026-06-10
• DECODING GRIXBA — A PLAY RANSOMWARE SCANNER
  writeupas classification.key entities2026-06-08
• Socket: Famous Chollima Targets PHP Developers via Compromised Packagist Package
  writeupas classification.key entities2026-06-01
• Open Source Malware Podcast — episodes
  otheras classification.key entities2026-05-22
• Criminal Liabilities for Disclosure of IT Security Vulnerabilities
  videoas threat actors2026-05-20
• Tradecraft Tuesday Recap: axios npm Supply Chain Compromise
  articleas classification.key entities2026-04-21
• Supply Chain Compromise of axios npm Package
  writeupas classification.key entities2026-03-31
• Here We Go Again: Binance Loses $6.3b in Largest Robbery in History
  articleas classification.key entities
• Weekly Research Brief: PHP Vulnerability; Objections to OKX-ICE’s Stock Tokenization; Solana Alpenglow Ships
  articleas threat actorsIt is written here as DPRK: mentioned by the author, Thad Pinakiewicz, as a hypothetical threat to IoT devices, with no specific campaign described.
• Weekly Research Brief: Ledger’s $91M Theft, Papertrade
  articleas classification.key entities
• Weekly Research Brief: Bitget Hack, AI Accord and SEC FAQs
  articleas classification.key entities
• Bitget — Rekt
  writeupas classification.key entities
• Déjà Vu, Lazarus Crew: $387.5m Bitget Exploit Repeats a Pattern
  articleas classification.key entities
• Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft
  articleas classification.key entities
• 973 MCP Packages, 71% Single-Maintainer: A Practitioner
  articleas classification.key entities