A weekly briefing on DPRK state-sponsored cyber threat activity, tracked using lazarus.day.
Written and curated with AI.
Last week’s reporting was dominated by the theft of more than $6 billion in cryptocurrency from Binance. The FBI attributed the attack to North Korea and named the activity TraderTraitor. Binance said its initial investigation pointed to a compromised DevOps laptop and access to a service container, while blockchain investigators documented abuse of Ethereum account delegation and rapid, automated laundering across multiple chains.
Last week’s reporting covered two different routes into exposed systems. Kaspersky attributed Operation FlashHole to Lazarus Group and traced a tailored phishing chain through a mandatory South Korean security product. CYFIRMA assessed that a Korean-speaking team linked to the Lazarus ecosystem was preparing to exploit two critical PHP flaws against internet-facing servers.
Last week’s reporting combined a large U.S. disruption of North Korean remote IT-worker infrastructure with new detail on how the scheme is changing. Federal authorities charged 14 people, arrested two alleged facilitators, searched more than 40 suspected Texas laptop farms, and seized about 187 devices. The FBI also warned that the workers are spreading devices across smaller farms, subcontracting jobs, and paying third parties for interviews, identity checks, and in-person tasks.
Last week’s reporting returned to a familiar target: developers with access to cloud, source-code, and cryptocurrency environments. Zscaler analyzed a trojanized Terraform provider that delivered FLATROOF and ROOFDECK across macOS, Linux, and Windows. Unit 42 connected this approach to a wider set of poisoned dependencies and blockchain-based command channels, while OpenSourceMalware reconstructed how PolinRider hid the real timing of a GitHub repository compromise.
Last week’s reporting filled in the technical path behind the $387.5 million Bitget theft. Investigators found that the attacker reached the exchange’s production wallet environment through compromised third-party security systems, then used a custom withdrawal tool to forge risk-control parameters. On-chain analysts tracked the proceeds across multiple networks, bridges, swaps, and laundering services.
Last week’s reporting centered on a $387.5 million theft from Bitget and another round of developer-focused malware. Elliptic assessed the exchange attack as highly likely to be DPRK-linked after tracing laundering infrastructure shared with earlier thefts. Elsewhere, PolinRider kept reinfecting GitHub repositories through compromised developer machines, and Graphalgo moved into Terraform providers and Go modules.
Last week’s reporting traced several DPRK operations through developer accounts, source repositories, package registries, and fake recruitment. The GHAPPIER investigation found one loader across at least 65 repositories and 22 accounts, including a malicious npm release built by a legitimate GitHub Actions workflow. Separate research found PolinRider in Packagist development versions, while a joint government advisory said WaterPlum had infected at least 30,000 devices in more than 100 countries.
Last week’s reporting followed Kimsuky across malicious shortcuts, a trojanized installer, fake meeting pages, and legitimate remote-access tools. The delivery methods varied, but the campaigns repeatedly used scheduled execution and trusted internet services to keep access alive and divide command, collection, and exfiltration traffic.
Last week’s reporting documented several ways attackers turned familiar software and services into execution paths. A malicious npm package sat three dependencies below the package a developer chose to install. A forged BindsNET merge commit ran JavaScript when affected clones opened in VS Code-compatible editors, while trojanized macOS installers delivered OtterCookie outside the usual fake coding-test workflow.
Last week’s reporting returned to two recurring routes into trusted environments: compromised developer accounts and fraudulent remote employment. PolinRider operators retained control of a legitimate developer’s GitHub identity, infected all seven of his active repositories, and published new malicious versions after an earlier npm takedown. Huntress, meanwhile, documented suspected DPRK workers using altered identity records, location-masking services, and hardware that provided remote control and redirected audio or video.