EtherHiding: Blockchain-Based C2 Technique
EtherHiding is a covert technique that embeds malicious code within smart contracts on public blockchains like BNB Smart Chain or Ethereum. It…
Tag: North Korea
Google Threat Intelligence Group: Attribution of Axios Compromise
Google Threat Intelligence Group attributed the axios npm compromise to MIDNIGHT NEPTUNE, a North Korean actor. Their analysis contributed to understanding the…
DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware
Threat actors with ties to North Korea have been attributed to a sophisticated macOS malvertising campaign that involves redirecting users to fake…
UNC5342 (Contagious Interview) Threat Group
UNC5342, also known as Contagious Interview, is a North Korean-linked threat actor cluster that traditionally uses fake job interviews to deliver malware.…
Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet
Amazon Threat Intelligence has attributed the September 2025 hijack of the popular npm packages debug and chalk to North Korea's Sapphire Sleet…
STARDUST CHOLLIMA: North Korean Hacking Group
STARDUST CHOLLIMA is another alias for the North Korean threat group also known as Sapphire Sleet and UNC1069, involved in cryptocurrency theft…
Alluring Pisces: North Korean Threat Actor
Alluring Pisces is a North Korean threat actor known for social engineering and supply chain attacks, linked to the Sapphire Sleet cluster.
CageyChameleon: North Korean Cyber Group
CageyChameleon is a North Korean cyber group associated with cryptocurrency theft and malware campaigns, overlapping with Sapphire Sleet.
CryptoCore: North Korean Hacking Group
CryptoCore is a North Korean threat actor focused on cryptocurrency theft, also known as BlueNoroff and Sapphire Sleet.
North Korean Threat Actors Linked to Rust Crate Attacks
Evidence suggests infrastructure overlaps between the Rust crate supply chain attacks and prior attacks targeting Mastra and Axios, both linked to North…