Tag

#North Korea

20 stories taggedNorth Korea.

Illustration: a world map with three nations highlighted on the wall behind it
Threat Intelligence

North Korea's Fake-Employee Scheme Now Recruits Workers From Iran and Lebanon

What began as a North Korean operation to sneak remote workers into U.S. tech companies has grown into a multinational scheme, with recruits now drawn from Iran and Lebanon.

3 min read
A hospital hiring portal and sales department recruitment webpage showing legitimate-looking job applications and video interview screens, subtle indicators of
Threat Intelligence

North Korea's Fake Worker Scheme Now Reaches Into Hospitals and Sales Teams

The DPRK-linked hiring fraud that dogged tech firms is turning up in healthcare and sales roles, widening the insider risk for employers who thought they weren't a target.

3 min read
A corporate hiring office or HR workspace with employment applications and background check documents displayed, with suspicious red flags and warning indicator
Threat Intelligence

North Korean Spies Are Getting Hired as IT Workers. Here Is How to Spot Them.

Security firm Huntress investigated three separate cases in 2026 where North Korean government operatives had successfully applied for, and been hired into, real jobs at Western companies. The red flags they left behind are now a playbook for anyone doing the hiring.

5 min read
A corporate HR office setup with an employee onboarding desk displaying new hire forms and identity verification documents, with a computer screen showing a pas
Identity & Access

Attackers Are Skipping the Login and Going After the Hiring Desk

Criminals have figured out that faking a new hire or a password reset is easier than cracking a password. Identity verification is now the soft spot.

4 min read
A developer's workspace with multiple monitors showing code repositories and package manager windows, with one screen displaying a compromised file alert overla
Vulnerabilities

Rust developers hit by supply-chain attack on arrayref crate

Attackers hijacked a maintainer account and slipped credential-stealing malware into three popular Rust libraries during a 1.5-hour window on August 20.

3 min read
Federal agency office building exterior at dusk with security perimeter visible, simultaneous image inset showing Boeing 737 cockpit avionics systems and separa
Threat Intelligence

North Korean IT Worker Infiltrated a Federal Agency, Boeing 737 Security Flaws Explored, and Refrigeration Systems Found Vulnerable

A North Korean operative got hired at a US government agency, researchers found exploitable weaknesses in Boeing 737 onboard systems, and serious flaws turned up in industrial refrigeration controllers. Here's what each finding means in practice.

3 min read
An HR onboarding workflow diagram displayed on a corporate system, showing gaps between background check completion, laptop shipment, and account activation sta
Identity & Access

The fake new hire problem: how criminals slip in through remote onboarding

Gaps between background checks, laptop delivery and account setup are letting impostors join companies as staff. Here's how the trick works, and what stops it.

4 min read
A recruiter's email inbox displayed on screen with fake job offer messages crafted with professional design, alongside Windows system dialogs showing exploitati
Threat Intelligence

North Korea's Lazarus Group Used a Secret Windows Flaw to Break Into Defence Companies

Hackers posing as recruiters sent fake job offers to aerospace and aviation workers in Europe and India, then used a previously unknown Windows vulnerability to seize full control of their computers.

4 min read
A laptop keyboard being used by a hidden operator with keystroke logging indicators visible, cryptocurrency company branding in background, and North Korean con
Threat Intelligence

Researchers Set Up a Fake Crypto Company and Hired Three Suspected North Korean IT Workers

The sting recorded every keystroke on the laptops the fake employer issued, exposing the paper trail of a scheme US officials say funnels wages back to Pyongyang.

3 min read
A server room with rows of industrial-grade computer hardware, circuit boards glowing softly in the darkness, network cables running precisely along cable trays
Threat Intelligence

Kimsuky Goes Offline: North Korean Spies Build Their Own Private AI Toolkit

South Korean researchers say the Kimsuky group has stopped relying on public chatbots and is now running AI on its own servers to sharpen phishing and speed up malware writing.

4 min read
A criminal operation workspace visualization showing multiple screens with AI chatbot interfaces open, malicious code being generated and refined, with cloud ac
AI Security

Criminals Are Using AI Like a Work Tool. Researchers Have the Receipts.

Two major studies show hackers using AI assistants to write malicious code, dodge safety filters, and compress attacks from weeks into hours. Cloud activity tied to this shift jumped 171 percent in the first half of 2026.

4 min read
Illustration: A split-screen
Breaches

OnTrac Hacked, UK Schools Lose 607,000 Records, and AWS Points to North Korea

A parcel delivery company breached, more than half a million children's records exposed, and Amazon's cloud division naming state-backed hackers. Stories that almost slipped past.

3 min read
A web browser showing a legitimate South Korean website, with invisible malware injection code being executed in the background, bypassing security through a ba
Vulnerabilities

North Korea-Linked Hackers Booby-Trap Korean Websites to Push Backdoors via AnySign4PC Flaw

A state-sponsored crew hijacked trusted South Korean sites and abused a weakness in a widely installed banking security tool to plant SIGNBT and COPPERHEDGE malware, no click required.

3 min read
An npm package repository screen showing the hijacked 'Debug' and 'Chalk' packages with suspicious version uploads and download statistics, with attribution mar
Threat Intelligence

Amazon Traces September npm Hijack of Debug and Chalk to North Korean Hackers

What looked like a wallet-draining crypto heist ten months ago now points to Pyongyang, according to fresh analysis from Amazon.

3 min read
Cyber-attack command center aesthetic with multiple monitors displaying fake Zoom and Microsoft Teams landing pages, cryptocurrency wallet monitoring tools, and
Threat Intelligence

North Korean Hackers Run Fake Zoom and Teams Sites to Rob Crypto Wallets

BlueNoroff's phishing kit screens visitors' crypto wallets before deciding who gets the malware, researchers say.

4 min read
© 2026 Threat Vectr