Executive Summary

Last week’s reporting covered two distinct routes into trusted environments. Lazarus used recruitment lures and trojanized PDF software against defense, aerospace, and aviation organizations, then exploited a Windows zero-day to run its FudModule rootkit. A separate package campaign hid malicious loaders in six npm packages and recovered changing command infrastructure from Ethereum transactions.

Remote employment remained the larger theme. Controlled hiring experiments, an undercover interview, leaked records, and an FBI disclosure described technically capable workers using false identities to obtain legitimate access to code and internal systems. Other research examined the infrastructure around these operations, cryptocurrency off-ramps, and possible links between DPRK personnel and criminal services.

Key Trends

1. Dream Job paired recruitment with a Windows zero-day

Check Point attributed a new Operation Dream Job wave to Lazarus and reported targets in the defense sector, especially aerospace and aviation organizations in Europe and India. One chain used DLL side-loading to run MISTPEN, which retrieved modules through OneDrive and exploited CVE-2026-68820 in AFD.sys. The flaw gave FudModule SYSTEM privileges and helped the rootkit interfere with endpoint visibility. Microsoft patched the vulnerability on August 11.¹

A second chain distributed SecurityPDF, a modified MuPDF-based viewer, alongside an attacker-crafted file. Opening that file caused the viewer to decrypt and launch Troy, a newly documented backdoor. Impersonation websites for Enveil appeared in search results and offered the trojanized viewer, although Check Point found no evidence that Enveil itself was compromised.¹

The attackers also exploited vulnerable Roundcube servers and compromised content-management systems. RelayShell turned those servers into command relays, allowing the operation to use third-party infrastructure rather than expose its own control servers directly.¹

2. npm loaders recovered C2 addresses from Ethereum

Sonatype found the same JavaScript loader in six npm packages. Three were legitimate packages with malicious versions, while three were created with the loader already embedded. The malware queried an attacker-controlled Ethereum wallet, decoded two IP addresses from a transaction recipient address, and used them as primary and backup command servers.²

The loader could query several Ethereum RPC providers, race requests, and fall back to Blockscout. It then retrieved later stages through HTTP GET requests or an X-Payload-B64 response header. Sonatype linked the wallet and technique to recent NullReceiver activity attributed to the DPRK-linked Contagious Interview campaign.²

The package set matters because normal functionality remained in place. A familiar package name or working feature set did not distinguish the hijacked releases from the packages created for delivery.

3. IT workers sought durable access, not only salaries

ANY.RUN and its research partners created a controlled DeFi company and hired suspected Famous Chollima operatives. After onboarding, the workers used forged or stolen identities, mule banking details, remote-access tools, AstrillVPN, AI services, and their own proxy infrastructure. The experiment recorded how workers operated after receiving legitimate access to source code and engineering systems, rather than stopping at recruitment behavior.³

An Unchained interview provided a narrower view of the same risk. A suspected DPRK applicant gave questionable identity and location details but handled blockchain engineering and smart-contract security questions credibly. Researchers connected his profiles, email addresses, and wallets to earlier cryptocurrency work and an alleged $2.7 million MetaPlay theft. Those links were presented as allegations, not a court finding.⁴

The Wall Street Journal reported that one remote-worker cell entered at least eight U.S. companies within a few months, based on leaked browser histories, emails, calendars, recordings, interviews, and videos. Its broader estimate placed annual revenue from the operation at about $800 million.⁵ The FBI separately disclosed an active investigation into a DPRK remote IT worker found working for an unidentified U.S. federal agency. The worker’s role, access duration, and any data exposure remained unknown.⁶

Together, these accounts describe an insider-access problem with uneven outcomes. Some placements primarily produce salary revenue. Others expose source code, credentials, internal systems, or government-connected environments to people operating under false identities.

4. Research traced operational infrastructure and cash-out routes

Kudelski Security connected a DPRK-associated operator called Bismarck to gambling administration infrastructure and IP addresses that overlapped earlier FakeCalls research. It also found that a separate fake IT worker manager had stored credentials for two systems later associated with Emotet delivery. The researchers assessed with moderate confidence that the manager used those systems to deploy Emotet, while labeling parts of their physical-site reconstruction and institutional mapping as uncertain.⁷

RUSI examined how stolen cryptocurrency reaches fiat currency after the initial theft. The paper estimated that North Korea stole at least $2.8 billion in virtual assets between January 2024 and September 2025. It described flows through decentralized services, third-party launderers, OTC and peer-to-peer traders, money mules, and guarantee marketplaces, with the Bybit theft as its main large-scale example.⁸

What to Watch

Patch CVE-2026-68820 and review defense-sector recruitment contacts that delivered PDF viewers, encrypted archives, or links to software hosted on lookalike domains. Development teams should inspect affected npm versions, remove them, and look for later JavaScript execution and outbound traffic to infrastructure recovered through Ethereum queries.

Hiring controls need to continue after onboarding. Compare identity records, work location, payment ownership, remote-control software, and network behavior throughout employment, especially for roles with access to source code, signing systems, cloud consoles, or government environments. Financial institutions and virtual asset services should preserve transaction context across blockchain and fiat handoffs so investigators can follow funds after they leave a traced wallet.

Reports Reviewed