Executive Summary

Last week’s reporting traced several DPRK operations through developer accounts, source repositories, package registries, and fake recruitment. The GHAPPIER investigation found one loader across at least 65 repositories and 22 accounts, including a malicious npm release built by a legitimate GitHub Actions workflow. Separate research found PolinRider in Packagist development versions, while a joint government advisory said WaterPlum had infected at least 30,000 devices in more than 100 countries.

The same access model extended beyond cryptocurrency companies. TraderTraitor compromised a DevOps engineer at an Indian IT services provider, and public blockchains continued to carry resilient command instructions for malware aimed at cryptocurrency developers. Reporting on overseas labor and facilitator recruitment also documented how DPRK workers obtain local identities, interviews, payment channels, and remote access to employer systems.

Key Trends

1. Compromised developer accounts became publication infrastructure

CloudSEK found 73 GHAPPIER-infected files across at least 65 public repositories and 22 accounts. During a 105-minute compromise of the @dforge-core/dforge-mcp maintainer account, the operator changed its GitHub Actions release workflow and published malicious npm version 0.2.21. The package carried valid npm provenance because the legitimate workflow built it through OIDC trusted publishing. Its four-stage chain brought its own Node.js runtime to the host and launched a self-deleting remote shell connected to 193.26.115.131:15152.¹

CloudSEK tied the loader operation to PolinRider after finding a byte-identical loader beside a second payload that queried the same Ethereum wallet and used the same address-decoding marker previously reported with NullReceiver. The researchers established the technical overlap but relied on prior research for the operation’s North Korean attribution.¹

Socket found another PolinRider path in four development versions of the Packagist package visanduma/nova-two-factor. The compromised GitHub account had also contributed to private repositories, leaving the full exposure unknown. The operators rewrote Git history, hid JavaScript in configuration or font-like files, abused VS Code folder-open tasks, and introduced a PHP variant that launched obfuscated JavaScript through shell_exec. No malicious stable package release had been identified when Socket published its findings.²

AhnLab’s August review placed this activity within a wider set of DPRK operations. It reported continued PolinRider supply-chain activity by Famous Chollima, AI-generated identities used by Jasper Sleet in remote-job fraud, AI-assisted decoys and Git-based command traffic associated with Kimsuky, and Lazarus exploitation of CVE-2026-68820 against defense targets in Operation Dream Job.³⁴

2. Fake recruitment reached developers with valuable infrastructure access

A joint advisory from authorities in Japan, the United States, Australia, and Germany identified WaterPlum, commonly known as Contagious Interview, as a North Korean group operating under the 313 General Bureau alongside some DPRK IT workers. The advisory said WaterPlum had infected at least 30,000 devices across more than 100 countries, taken funds or credentials from over 7,000 cryptocurrency wallets, and transferred about JPY 1.7 billion in cryptocurrency assets to North Korea. Its recruiters delivered malicious npm packages and VS Code projects carrying BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, and StoatWaffle.⁵

SentinelOne found FLATROOF and ROOFDECK on a DevOps engineer’s Mac at an Indian IT services provider with no cryptocurrency affiliation. Fake coding assignments used weaponized Terraform lock files to redirect terraform init toward attacker-controlled provider registries. The workstation held access to AWS, OVH, OpenStack, and source-control environments, which SentinelOne assessed as the likely attraction for TraderTraitor. The implants collected credentials and host data, used Telegram and Nostr in their command channels, and later installed a stripped ROOFDECK stage that deleted the original backdoors.⁶

The case broadens the practical target set from cryptocurrency companies to developers whose endpoints can open cloud, code, or customer environments. It also puts infrastructure-as-code files beside package manifests, editor tasks, and build configuration as material that requires review before execution.

3. Public blockchains carried durable instructions while malware became leaner

Chainalysis linked UNC5342 to a redundant blockchain relay used against cryptocurrency developers approached through fraudulent job interviews. Malware queried TRON first and Aptos as a fallback; both routes pointed to encrypted instructions stored in a Binance Smart Chain transaction. An infected host could recover updated command infrastructure after a conventional domain or server takedown, and disruption would require action across all three chains.⁷

OpenSourceMalware found 11 npm packages delivering WeaselBiscuit, a compact Node.js infostealer that retrieved an in-memory payload through Npoint and polled an HTTP server at 103.170.217.184:8787. It profiled hosts, stole Chrome extension storage, and could collect clipboard contents and Windows keystrokes. The researchers rated the connection to Contagious Interview tradecraft at low to moderate confidence, citing npm delivery, Npoint dead drops, data targets, and operational patterns while noting substantial differences from BeaverTail and OtterCookie.⁸

These reports describe two ways to reduce dependence on exposed attacker infrastructure. Blockchain transactions can redirect implants after takedowns, while public JSON services can separate a small package loader from later code and command configuration.

4. IT-worker operations depended on local facilitators and payment channels

Silent Push engaged an operator advertising for facilitators through Discord and Telegram. The proposed arrangement gave the facilitator 35% of earnings for providing an identity, appearing in interviews, receiving employer payments, and enabling remote completion of technical assessments. The operator offered real-time coaching during interviews and discussed remote access to the facilitator’s computer, while payments could move through cryptocurrency, wire transfers, or third-party processors.⁹

The Multilateral Sanctions Monitoring Team estimated that North Korea had 35,600 to 101,280 overseas laborers across at least 17 countries and generated roughly $450 million to $800 million for the DPRK government in 2025. Its cyber-related findings described IT-worker cells using forged passports, coordinating through Slack, receiving cryptocurrency through designated wallets, and relying on diplomatic personnel, underground banks, and over-the-counter brokers to convert and remit funds.¹⁰

Together, the reports place the applicant visible on camera inside a larger operating chain. Identity providers, interview stand-ins, residential endpoints, payment recipients, remote-access operators, and conversion services can each supply evidence that a resume or technical assessment alone will not reveal.

5. Financial losses often followed months of retained access

Security Alliance attributed about $2.9 million in losses to three cases involving Contagious Interview, a DPRK IT worker, and SINT-01. It said each successful intrusion occurred months before the theft. In the IT-worker case, an insider used access to critical infrastructure to withdraw funds to his own wallet.¹¹

S2W’s first-half ransomware review covered two cases it linked to Andariel activity. It cited Symantec evidence associating a Medusa ransomware intrusion at a U.S. healthcare organization with the North Korea-backed group, though S2W tracks that activity separately as puNK-012 because the responsible Lazarus sub-organization remains unresolved. It also cited ESET reporting in which TigerRAT appeared at a South Korean engineering company before a Rook ransomware variant encrypted multiple endpoints.¹²

The timing matters for incident response. Removing an initial lure, repository change, or employee account does not establish that downstream credentials, cloud access, wallet material, or persistence have been removed.

What to Watch

Development teams should treat repository control and trusted publishing as separate security boundaries. Review force-pushes, workflow edits, OIDC publication events, development package versions, Terraform provider registries, editor tasks, and executable content hidden in configuration or asset files. A valid build attestation proves where an artifact was built, not that the source account or commit was trustworthy.

Hiring and security teams should correlate interviews with device, location, payment, and remote-access evidence. After a suspected fake-recruiter or IT-worker case, investigate cloud credentials, source-control tokens, wallet access, and activity that predates the visible loss by months. Network monitoring should also distinguish expected blockchain RPC and public JSON-service traffic from processes that use those services to recover command infrastructure.

Reports Reviewed