A weekly briefing on DPRK state-sponsored cyber threat activity, tracked using lazarus.day.
Written and curated with AI.
Last week’s reporting followed attacks on developers, email users, and remote hiring pipelines. A fake coding challenge delivered a new JavaScript implant to a cryptocurrency developer. A separate Rust supply-chain incident caused malware to run when affected projects compiled, with infrastructure overlaps that researchers tied to earlier DPRK campaigns without reaching a conclusive attribution for the crate compromise.
Last week’s reporting covered two distinct routes into trusted environments. Lazarus used recruitment lures and trojanized PDF software against defense, aerospace, and aviation organizations, then exploited a Windows zero-day to run its FudModule rootkit. A separate package campaign hid malicious loaders in six npm packages and recovered changing command infrastructure from Ethereum transactions.
Last week’s reporting covered DPRK activity against developers, software supply chains, and remote hiring. Genians found Kimsuky infrastructure running local AI tools and document retrieval software. CrowdStrike attributed the poisoning of 131 AI framework packages to STARDUST CHOLLIMA, while an investigation into North Korean command-and-control servers found evidence of intrusions at hundreds of organizations.
Last week’s DPRK-related reporting focused on open-source compromise, blockchain-based command delivery, and attacks through trusted South Korean websites and security software. Supply-chain campaigns first compromised developers or maintainers, then pushed malicious code into legitimate npm packages and Go modules. Separate research documented APT37’s NarwhalRAT infrastructure and an AFX bridge theft attributed in a detailed post-mortem to UNC4899 / TraderTraitor.
Fake meetings and job interviews drove several DPRK-linked operations last week. BlueNoroff, Sapphire Sleet, and Famous Chollima used compromised contacts or recruiter personas to direct targets to imitation meeting pages, then persuaded Windows and macOS users to execute commands. The resulting malware targeted browser credentials, cryptocurrency wallets, and remote control of the host.
Last week’s reporting joined two risks that often begin with developer access. Fake coding tests delivered cross-platform credential theft, while stolen developer accounts and package publishing access spread malicious code through GitHub and npm. PolinRider’s confirmed footprint rose to 4,367 repositories, and separate research connected the ChainVeil and ViteVenom package clusters to the same campaign with differing attribution confidence.
Last week’s reporting covered developer ecosystem compromise, digital-asset theft and laundering, and an APT37 RokRAT campaign. PolinRider expanded from npm into Go modules, Packagist packages, and Chrome extensions. The reporting tied that expansion to compromised GitHub accounts and repository release paths, putting source-control identity at the center of package security.
Last week’s reporting expanded the visible scale of DPRK access operations around developers. Ossprey mapped hundreds of Contagious Interview payload URLs and a separate Node.js RAT cluster. Other researchers documented malicious open-source packages, trojanized interview projects, compromised maintainer accounts, and GitHub personas apparently built to support fraudulent employment.
Last week’s reporting covered several routes into developer and financial environments. Internal records obtained by the BBC described a managed DPRK IT worker operation built around borrowed identities, assigned roles, close supervision, and foreign-currency quotas. Malware research documented memory-resident Windows tooling, macOS surveillance implants, malicious npm packages, and Kimsuky phishing chains.
Last week’s reporting centered on developer access as a route into software supply chains and cryptocurrency systems. The Mastra incident put that risk into production at scale: a compromised maintainer account added easy-day-js to more than 140 npm packages, exposing developer workstations and CI runners to a cross-platform Node.js implant. Other reports described malicious code hidden in configuration files, blockchain-based payload resolution, fake interviews, and poisoned packages.