"ClickFix, EtherHiding & a DPRK Wallet Trail" published by Allsecure. #ContagiousInterview, #ClickFix, #UNC5342, #EtherHiding https://www.allsecure.io/blog/clickfix-etherhiding-dprk-wallet
Remote
lazarusholic
@lazarusholic@infosec.exchange
mastodon 4.8.0-alpha.3+glitcha big fan of lazarus. You can find me on http://t.me/lazarusholic , https://lazarus.day.
90 Followers
0 Following
50 Posts
Joined November 09, 2022
The brand-new lazarus.day is here! https://lazarus.day
"Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan" published by StepSecurity. #NPM, #Joyfill https://www.stepsecurity.io/blog/joyfill-npm-supply-chain-compromise
"New North Korean campaign uses fake coding interviews to steal developer credentials" published by Elastic. #BeaverTail, #OtterCookie, #REF9403 https://www.elastic.co/security-labs/contagious-interview-malware-svg-steganography
"국내 엔드포인트 대상 공격의 두 축, 스피어피싱과 워터링 홀" published by Ahnlab. #Phishing, #Wateringhole, #Fileless, #Slides https://github.com/Plainbit/Slides/blob/main/2026%20상반기%20침해사고%20정보공유%20세미나/04-국내%20엔드포인트%20대상%20공격의%20두%20축,%20스피어피싱과%20워터링%20홀_이선호(안랩).pdf
"PolinRider: North Korea-Linked Supply Chain Campaign Expands Across Open Source Ecosystems" published by Socket. #SupplyChain, #OmniStealer, #PolinRider https://socket.dev/blog/polinrider-north-korea-linked-supply-chain-campaign-expands
"디지털자산 크로스 체인 보안 위협 분석" published by FSI. #Cryptocurrency, #Harmony, #AxieInfinity, #OrbitBridge, #MoneyLaundering, #Lazarus, #KelpDAO https://www.fsec.or.kr/bbs/detail?menuNo=244&bbsNo=11990
"DPRK Fake IT Workers: Inside Their Evolving Network Infrastructure" published by KudelskiSecurity. #ITWorker, #OpSec https://kudelskisecurity.com/research/dprk-fake-it-workers-inside-their-evolving-network-infrastructure
"Attack Cases by the Kimsuky Group Impersonating Diplomats (PebbleDash, PrxClient)" published by Ahnlab. #Kimsuky, #Phishing, #PebbleDash, #LNK, #PrxClient https://asec.ahnlab.com/en/94552/
"Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan" published by Socket. #SupplyChain, #NPM, #DevPopper, #OmniStealer https://socket.dev/blog/joyfill-npm-beta-releases-compromised
"nodemon-sudo: an npm Backdoor With No Install Script" published by SafeDep. #SupplyChain, #NPM https://safedep.io/malicious-nodemon-sudo-tslint-conf-npm-backdoor/
"북한 배후 조직의 자금세탁 인프라 및 네트워크 분석" published by S2W. #Cryptocurrency, #TraderTraitor, #MoneyLaundering, #Lazarus, #Bybit https://s2w.inc/ko/resource/detail/1090
"A Detailed Post-Mortem on the AFX Security Incident" published by AFXTrade. #DeFi, #UNC4899, #AFX https://medium.com/@AFXTrade/a-detailed-post-mortem-on-the-afx-security-incident-57d564ef812f
"Lazarus-Linked npm Malware Masquerades as Rollup Polyfills" published by Jfrog. #SupplyChain, #NPM, #Lazarus https://research.jfrog.com/post/rollup-polyfill-masquerading/
"Sequel to ChainVeil npm malware: ViteVenom" published by Checkmarx. #SupplyChain, #NPM, #ChainVeil, #ViteVenom, #SuccessKey https://checkmarx.com/zero-post/sequel-to-chainveil-npm-malware-targets-vite-ecosystem/
"Operation Capsule Vault: EMBED_PAYLOAD_v2 기반 RokRAT 공격 체인 분석" published by Genians. #APT37, #RokRAT, #T1566002, #T1055, #CapsuleVault https://www.genians.co.kr/blog/threat_intelligence/rokrat_capsule_vault
"Inside a DPRK BlueNoroff ClickFix Kit" published by Jumpsec. #Phishing, #Bluenoroff, #NukeSped, #Cloudzy, #Telegram, #ClickFix https://www.jumpsec.com/guides/inside-a-dprk-bluenoroff-clickfix-kit
"DPRK’s Famous Chollima Deploys RATs Through ClickFake Job Interviews" published by SOCRadar. #FamousChollima, #ClickFix, #GolangGhost, #PylangGhost https://socradar.io/blog/dprk-clickfake-pylangghost-golangghost-rats/
"Hato Tsusin: A Long-Forgotten DPRK Front Company Hiding in Plain Sight?" published by NKInternet. #OpSec https://nkinternet.com/2026/07/28/hato-tsusin-a-long-forgotten-dprk-front-company-hiding-in-plain-sight
"ChainVeil and ViteVenom are DPRK’s PolinRider Campaign" published by OpenSourceMalware. #SupplyChain, #NPM, #PolinRider, #ChainVeil, #ViteVenom https://opensourcemalware.com/blog/chainveil-and-vitevenom-dprk-polinrider-campaign
"Weekly Intelligence Report – 10 Jul 2026" published by Cyfirma. #Trend, #SupplyChain, #GitHub, #FamousChollima, #PolinRider https://www.cyfirma.com/news/weekly-intelligence-report-10-jul-2026
"H1 2026 Crypto Hacks Reach Record High as Losses Fall Below USD 1 Billion" published by Trmlabs. #Cryptocurrency, #DeFi, #DriftProtocol, #KelpDAO https://www.trmlabs.com/resources/blog/h1-2026-crypto-hacks-reach-record-high-as-losses-fall-below-usd-1-billion
"Grupo Lazarus: Análise Completa dos hackers da Coreia do Norte" published by AscenCripto. #Cryptocurrency, #Lazarus https://ascencriptonewsletter.substack.com/p/grupo-lazarus-analise-completa-dos
"합동 사이버 보안 권고문 기술 분석 보고서(워터링홀 공격)" published by ENKI. #Wateringhole, #ADS, #Copperhedge https://www.enki.co.kr/media-center/blog/joint-cybersecurity-advisory-watering-hole-malware-analysis
"Kimsuky 그룹의 외교 관련 종사자 사칭 공격 사례 (PebbleDash, PrxClient)" published by Ahnlab. #Kimsuky, #Phishing, #PebbleDash, #LNK, #PrxClient https://asec.ahnlab.com/ko/94553/
"2026 Threat Hunting Report" published by CrowdStrike. #Trend, #StardustChollima, #FamousChollima https://www.crowdstrike.com/en-us/resources/reports/threat-hunting-report
"ORO Hack Post-Mortem: The Sapphire Sleet Intrusion" published by ORO. #Cryptocurrency, #Phishing, #SapphireSleet, #ORO https://x.com/oroagents/status/2079371018880041257
"The DPRK’s Use of Overseas Labour to Violate and Evade UN Sanctions" published by MSMT. #Sanctions, #ITWorker, #MoneyLaundering https://msmt.info/Publications/detail/MSMT%20Report/4232
"Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise" published by Google. #SupplyChain, #UNC1069, #Axios, #T1195002, #T1195001, #MidnightNeptune https://cloud.google.com/blog/topics/threat-intelligence/mitigation-guidance-for-supply-chain-compromise
"June 2026 Threat Trend Report on APT Attacks (South Korea)" published by Ahnlab. #Trend, #LNK https://asec.ahnlab.com/en/94594
"Alert to Countries, Companies, and Other Entities Regarding North Korean IT Workers" published by USFBI. #Sanctions, #ITWorker https://www.ic3.gov/CSA/2026/260731.pdf
"Updated Cyber Threat Actor Naming System" published by Google. #Neptune https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/
"Operation Double Barrel (The Relationship Between a State-Sponsored Threat Actor and the Gunra Ransomware Group)" published by Ahnlab. #Phishing, #Ransomware, #Wateringhole, #Gunra, #Copperhedge, #DoubleBarrel https://asec.ahnlab.com/en/94696
"군사·안보 학술지로 위장한 Kimsuky 정찰용 악성코드" published by Hauri. #Kimsuky, #LNK, #GitHub https://hauri.co.kr/security/security_view.html?intSeq=89
"Operation Capsule Vault: RokRAT Attack Chain Analysis Using EMBED_PAYLOAD_v2" published by Genians. #APT37, #RokRAT, #T1566002, #T1055, #CapsuleVault https://www.genians.co.kr/en/blog/threat_intelligence/rokrat_capsule_vault
"Amazon identifies North Korean hacker group behind open-source supply chain attacks" published by Amazon. #SupplyChain, #NPM, #SapphireSleet, #Axios https://aws.amazon.com/blogs/security/amazon-identifies-north-korean-hacker-group-behind-open-source-supply-chain-attacks
"Joyfill npm Packages Compromised with Blockchain C2 Loader" published by SafeDep. #SupplyChain, #NPM, #PolinRider, #Joyfill https://safedep.io/joyfill-npm-blockchain-c2-supply-chain
"PolinRider Jumps the Fence" published by OpenSourceMalware. #SupplyChain, #NPM, #PyPI, #VSCode, #PolinRider https://opensourcemalware.com/blog/polinrider-jumps-the-fence
"How DPRK’s Contagious Interview Campaign Targets Developers" published by KudelskiSecurity. #Cryptocurrency, #GitHub, #NPM, #ContagiousInterview, #VSCode, #T1041, #T1071001, #T1059007 https://kudelskisecurity.com/research/how-dprks-contagious-interview-campaign-targets-developers
"From Payroll to Pyongyang: The DPRK IT Worker Money Trail" published by Dtex. #Sanctions, #ITWorker, #MoneyLaundering https://www.dtex.ai/blog/dprk-it-worker-money-trail
"국가배후 해킹조직의 우리 국민·기업 해킹 공격 주의 권고" published by KRCERT. #Phishing, #Wateringhole https://krcert.or.kr/kr/bbs/view.do?bbsId=B0000133&pageIndex=1&nttId=72144&menuNo=205020
"Detailed Analysis of BirdCall Malware: Masquerading as Zangi Messenger" published by S2W. #Scarcruft, #BirdCall https://s2w.medium.com/detailed-analysis-of-birdcall-malware-marsqurading-as-zangi-messenger-b80db8f5c320
"게임 업계 대상 MoonPeak 감염 사례 분석" published by Hauri. #LNK, #XenoRAT, #MoonPeak https://hauri.co.kr/security/security_view.html?intSeq=90
"North Korea busts elite hacking ring inside its own banks" published by DailyNK. #News https://www.dailynk.com/english/north-korea-elite-bank-hacking-ring-arrested/
"신종 Gomir Family를 이용한 Kimsuky의 국내 그룹웨어 개발사 공격 분석" published by ENKI. #Kimsuky, #Phishing, #SupplyChain, #Gomir, #HttpTroy https://www.enki.co.kr/media-center/blog/analysis-of-kimsuky-s-attack-on-a-south-korean-groupware-vendor-using-a-new-gomir-family-variant
"2026 Mid-year Blockchain Security and AML Report" published by Slowmist. #Trend, #MoneyLaundering, #Lazarus https://slowmist.medium.com/slowmist-2026-mid-year-blockchain-security-and-aml-report-75e0862179ef
"North Korean IT Workers: How DPRK infiltrates remote hiring" published by Opsek. #Cryptocurrency, #ITWorker https://blog.opsek.io/north-korean-it-workers-remote-hiring/