Lazarus Group

Also known as: Hidden Cobra, ZINC, Diamond Sleet, Labyrinth Chollima, APT38, Bluenoroff, Andariel, Guardians of Peace, Whois Team, TraderTraitor, Pompilus, Onyx Sleet, Stonefly, Selective Pisces, Alluring Pisces, Gleaming Pisces, Slow Pisces, Sparkling Pisces, Jumpy Pisces, Sapphire Sleet, Jade Sleet, Citrine Sleet, Moonstone Sleet, UNC2970, UNC4034, UNC4736, UNC4899, Famous Chollima, DeceptiveDevelopment, DEV#POPPER, Gwisin Gang, Tenacious Pungsan, UNC5342, Void Dokkaebi, CageyChameleon, CryptoCore, Genie Spider, BeagleBoyz, Black Artemis

ActiveNation-StateNorth KoreaMITRE G0032

0Campaigns

96Techniques

271IOCs

131Tools

0Matches

28Infrastructure

Overview

Lazarus Group has significantly evolved tactics in 2025-2026, notably shifting to ransomware-as-a-service (using Medusa ransomware) and executing the largest cryptocurrency heist in history ($1.5B Bybit). The group increasingly uses AI-generated content for social engineering, exploits open-source ecosystems with poisoned packages (230+ malicious npm/PyPI packages detected), and employs sophisticated supply chain attacks targeting developer tools. Subgroup Stonefly/Andariel now actively conducts ransomware operations against healthcare. The group has also adopted new infrastructure resilience via blockchain-based C2 (EtherHiding) and Telegram-based command channels.

Motivations

Financial GainEspionageSabotageSanctions Evasion

Target Sectors

Financial ServicesCryptocurrencyDefenseGovernmentTechnologyEntertainmentHealthcareCritical InfrastructureAerospaceNon-Profit OrganizationsEducational FacilitiesUAV/Drone ManufacturersWeb3 DevelopersBlockchain DevelopersDeFi PlatformsNuclear SectorBankingMediaBlockchainManufacturingTelecommunicationsChemicalMiddle EastDefense Industrial BaseNuclearEnergyCryptocurrency ExchangesSoftware DevelopmentDefense ContractorsSoftware Supply ChainAutomotiveAcademic ResearchVenture CapitalMedia and EntertainmentMedia EntertainmentGamingEducationWeb3Blockchain TechnologySoftware DevelopersThink TanksNews MediaAcademiaVoIP Providers

Activity Timeline

First Seen

Jan 2009

Last Seen

Jan 2025

Quick Facts

OriginNorth Korea

Sophisticationnation-state

StatusActive

MITRE GroupG0032

MITRE ATT&CK Techniques

(96)

Initial Access

T1566.001

Spearphishing Attachment

Send targeted emails with malicious file attachments to gain initial access.

T1078

Valid Accounts

Use legitimate credentials to authenticate and gain access.

T1189

Drive-by Compromise

Gain access through a user visiting a compromised website during normal browsing.

T1566.002

Spearphishing Link

Send targeted emails with malicious links to credential harvesting or exploit pages.

T1566

Phishing

Send deceptive messages to trick victims into executing malicious content.

Other

Execution

T1059.001

PowerShell

Use PowerShell commands and scripts for execution and automation.

T1047

Windows Management Instrumentation

Use WMI to execute commands and manage systems remotely.

T1059.003

Windows Command Shell

Use cmd.exe to execute commands and batch scripts.

Impact

T1486

Data Encrypted for Impact

Encrypt victim data to disrupt availability, typically for ransom.

T1490

Inhibit System Recovery

Delete backups, shadow copies, or recovery partitions to prevent restoration.

T1529

System Shutdown/Reboot

Shut down or reboot systems to disrupt operations.

Defense Evasion

T1027

Obfuscated Files or Information

Encrypt, encode, or obfuscate payloads and data to evade detection.

T1036

Masquerading

Disguise malicious artifacts by manipulating names or locations to appear legitimate.

T1055

Process Injection

Inject code into running processes to evade defenses and elevate privileges.

T1140

Deobfuscate/Decode Files or Information

Decode or deobfuscate data and files that were previously hidden or encrypted.

Command and Control

T1219

Remote Access Software

Use legitimate remote access tools like TeamViewer or AnyDesk for C2.

T1090

Proxy

Route C2 traffic through intermediary proxies to obscure the source.

T1105

Ingress Tool Transfer

Download additional tools or payloads from an external system.

Discovery

T1082

System Information Discovery

Collect OS version, architecture, hostname, and other system details.

T1083

File and Directory Discovery

Enumerate files and directories to find sensitive data or binaries.

T1018

Remote System Discovery

Discover remote systems on the network for lateral movement targets.

T1087

Account Discovery

Enumerate local, domain, or cloud accounts on a system or environment.

Lateral Movement

T1021.001

Remote Desktop Protocol

Use RDP to connect to and control remote systems.

T1021.002

SMB/Windows Admin Shares

Use SMB and administrative shares (C$, ADMIN$) to access remote systems.

Collection

T1005

Data from Local System

Collect sensitive data stored on the local file system.

Exfiltration

T1041

Exfiltration Over C2 Channel

Exfiltrate stolen data over the existing command and control channel.

Credential Access

T1003

OS Credential Dumping

Dump credentials from the operating system or security software.

T1110

Brute Force

Systematically guess passwords or credentials to gain access.

Persistence

T1136

Create Account

Create new accounts to maintain access to victim systems.

Tools & Malware

(131)

AppleJeus

malwareMalicious

Trojanized cryptocurrency trading applications distributed as legitimate software. Targets Windows and macOS to steal cryptocurrency wallet credentials and keys.

FALLCHILL

malwareMalicious

Primary RAT using dual-proxy communication with RC4 encryption. Provides full remote access including file management, process manipulation, and system information gathering.

BLINDINGCAN

malwareMalicious

Sophisticated RAT with proxy-aware C2 communication. Used in defense contractor targeting campaigns with capabilities for screen capture, file transfer, and process manipulation.

ThreatNeedle

malwareMalicious

Advanced backdoor used in defense industry espionage campaigns. Capable of pivoting between IT and restricted OT networks within compromised organizations.

DTrack

malwareMalicious

Modular spyware used for keylogging, browser history theft, and collecting running processes. Evolved from DarkSeoul tools used in attacks against South Korea.

Manuscrypt

malwareMalicious

Highly customizable backdoor family used across multiple Lazarus campaigns. Supports extensive plugins for reconnaissance, exfiltration, and lateral movement.

MATA

frameworkMalicious

Cross-platform malware framework (Windows, Linux, macOS) with modular plugin architecture. Supports file manipulation, proxying, and loading additional modules from C2.

Cobalt Strike

frameworkLegitimate

Used extensively for post-exploitation in financial sector attacks. Beacons deployed via spear-phishing or trojanized apps for lateral movement and data exfiltration.

Mimikatz

frameworkLegitimate

Deployed for credential harvesting from Windows systems. Used to obtain NTLM hashes and Kerberos tickets for lateral movement within financial institution networks.

PowerShell

os utilityLegitimate

Used for fileless malware execution, downloading secondary payloads, and living-off-the-land reconnaissance in compromised enterprise environments.

WannaCry

malwareMalicious

Self-propagating ransomware worm that exploited EternalBlue (MS17-010). Infected 300,000+ computers across 150 countries in 2017, causing billions in damages.

FastCash

malwareMalicious

Custom malware deployed on banking switch application servers to intercept and approve fraudulent ATM withdrawal requests. Used in ATM jackpotting campaigns across Asia and Africa.

ELECTRICFISH

malwareMalicious

Custom tunneling tool that creates encrypted channels between compromised networks and C2 infrastructure, allowing data exfiltration through proxied connections.

npm/PyPI trojanized packages

malwareMalicious

Supply chain attacks via malicious packages on npm and PyPI registries targeting cryptocurrency developers. Packages contain hidden backdoors activated on install.

Social Engineering via LinkedIn

scriptLegitimate

Elaborate fake recruiter personas on LinkedIn to target cryptocurrency and defense sector employees. Delivers trojanized coding challenges or job-related documents.

VMConnect

malwareMalicious

Trojanized versions of legitimate PyPI packages targeting Python developers. Used as part of supply chain attacks against cryptocurrency companies.

Dacls

RATMalicious

Remote access tool used by Andariel subgroup for data exfiltration

Gopuram

BackdoorMalicious

Trojanized cryptocurrency wallet application targeting blockchain users

TraderTraitor

BackdoorMalicious

Malware specifically designed to compromise cryptocurrency trading platforms

NukeSped

BackdoorMalicious

Remote access backdoor with extensive data collection capabilities

Volgmer

BackdoorMalicious

Backdoor with command execution and data exfiltration functionality

BISTROMATH

BackdoorMalicious

Modular backdoor with extensive reconnaissance and persistence capabilities

POOLRAT

RATMalicious

Remote access trojan deployed in targeted attacks against energy and defense sectors

ZIPOLIN

BackdoorMalicious

Backdoor malware used for lateral movement and data exfiltration

COPPERHEDGE

RATMalicious

Remote access tool used in financial sector intrusions

TORISMA

BackdoorMalicious

Backdoor malware with modular capabilities for espionage operations

3CX DesktopApp

OtherLegitimate

Legitimate VoIP application compromised in supply chain attack to distribute malware

HOPLIGHT

BackdoorMalicious

Proxy tool and backdoor that establishes encrypted communications channels

3CX Softphone

OtherLegitimate

Legitimate VoIP software compromised in major supply chain attack affecting 600,000+ organizations

ARTFULPIE

LoaderMalicious

Initial stage loader used to deploy additional malware payloads in targeted attacks

KANDYKORN

RATMalicious

Multi-stage RAT targeting macOS systems, deployed against blockchain engineers via trojanized Discord applications

3CX Trojanized Software

BackdoorMalicious

Supply chain compromise of 3CX VoIP desktop application distributing malware

BELLACIAO

DropperMalicious

Golang-based dropper used by Andariel subgroup in ransomware operations

SIGNBT

LoaderMalicious

Loader component used in software supply chain attacks targeting legitimate applications

GREASE

LoaderMalicious

Multi-stage loader used to deploy additional payloads in targeted operations

MagicRAT

RATMalicious

Qt-based remote access trojan targeting Windows systems in cryptocurrency and fintech sectors

DAVESHELL

BackdoorMalicious

Golang-based backdoor used in LinkedIn social engineering campaigns targeting cryptocurrency professionals

RustyAttr

BackdoorMalicious

Rust-based backdoor deployed via trojanized cryptocurrency applications and npm packages

BADCALL

BackdoorMalicious

Backdoor trojan capable of downloading additional payloads and executing commands

Brambul

WormMalicious

SMB worm with brute-force capabilities used for lateral movement in networks

Duuzer

BackdoorMalicious

Backdoor used in early Lazarus campaigns with command execution and data exfiltration features

LPEClient

ExploitMalicious

Privilege escalation tool exploiting Windows AppLocker vulnerabilities

QuiteRAT

RATMalicious

Lightweight RAT delivered via trojanized npm packages targeting developers

3CX DesktopApp Trojanized

BackdoorMalicious

Supply chain compromise of 3CX VoIP software used to distribute malware to downstream victims

3CX Desktop App Backdoor

BackdoorMalicious

Supply chain compromise of 3CX VoIP desktop application used to deploy malware

BeaverTail

StealerMalicious

JavaScript-based information stealer distributed via malicious npm packages

InvisibleFerret

BackdoorMalicious

Python-based backdoor with keylogging and browser credential theft capabilities

LIGHTSHOW

LoaderMalicious

Modular implant framework with capabilities for persistence, credential theft, and data exfiltration

3CX Desktop App

OtherLegitimate

Legitimate VoIP application compromised in 2023 supply chain attack to distribute malware

CROWDEDFLOUNDER

LoaderMalicious

Malware loader component used in multi-stage infection chains

DYEPACK

BackdoorMalicious

Trojanized application targeting SWIFT banking infrastructure

WINEKEY

BackdoorMalicious

HTTP-based backdoor with keylogging capabilities

Maui

RansomwareMalicious

Ransomware targeting healthcare sector with file encryption capabilities

YamaBot

BackdoorMalicious

Lightweight backdoor leveraging Telegram Bot API for C2 communications

wAgent

BackdoorMalicious

Backdoor used in supply chain attacks and cryptocurrency exchange targeting

3CX Compromised Software

TrojanMalicious

Trojanized 3CX desktop client used in 2023 supply chain attack affecting thousands of organizations

MISTPEN

BackdoorMalicious

Lightweight backdoor used in supply chain attacks against software developers, capable of executing commands and exfiltrating data

RollSling

LoaderMalicious

Multi-stage loader used to deploy additional payloads, observed in cryptocurrency-targeting campaigns

LightlessCan

RATMalicious

Native RAT used by Andariel/Stonefly subgroup with capabilities for file operations, command execution, and data exfiltration

3CX VoiceDesktop

OtherLegitimate

Legitimate VoIP software compromised in 2023 supply chain attack

VSingle

LoaderMalicious

Loader used to decrypt and execute additional malicious payloads

3CX Backdoor

BackdoorMalicious

Supply chain compromise backdoor embedded in signed 3CX VoIP application installers

3CX Trojanized App

TrojanMalicious

Supply chain compromise of 3CX VoIP desktop client (Operation DreamJob)

SNATCHCRYPTO

StealerMalicious

Cryptocurrency wallet theft malware delivered via trojanized applications targeting macOS users

KEYMARBLE

BackdoorMalicious

Trojan used for remote access and control in targeted intrusions

RustBucket

BackdoorMalicious

Rust-based macOS malware deployed via AppleScript and Swift loaders in social engineering campaigns

COVERTCATCH

StealerMalicious

Credential harvesting malware distributed through trojanized cryptocurrency applications

CASBANEIRO

LoaderMalicious

Multi-stage loader used for deploying additional payloads in supply chain attacks

3CX DesktopApp Trojan

BackdoorMalicious

Supply chain compromise of 3CX voice and video conferencing software in 2023

Durian

BackdoorMalicious

Advanced backdoor deployed after initial compromise, supports extensive command execution and data exfiltration

3CX Dropper

LoaderMalicious

Supply chain compromise loader delivered through trojanized 3CX DesktopApp used to deploy final-stage payloads

Medusa Ransomware

OtherMalicious

Ransomware-as-a-service platform used by Lazarus Group in recent operations

EtherHiding

OtherMalicious

Technique using blockchain smart contracts to hide malicious code on Binance Smart Chain

DLRAT

RATMalicious

Golang-based remote access trojan used in cryptocurrency-focused campaigns with extensive reconnaissance capabilities

3CX VoIP Trojan

BackdoorMalicious

Supply chain compromise of 3CX desktop application affecting hundreds of thousands of users globally

3CX SmoothOperator

BackdoorMalicious

Malware deployed via supply chain compromise of 3CX DesktopApp affecting thousands of organizations

ZzzStealer

StealerMalicious

Credential harvesting malware targeting browser data, email, and cryptocurrency wallet information

3CX VoIP Compromised Software

BackdoorMalicious

Supply chain attack using trojanized 3CX desktop application to deploy follow-on malware

RATANKBA

RATMalicious

Remote access trojan used for reconnaissance and data theft in financial sector attacks

Comebacker

BackdoorMalicious

Multi-stage backdoor with persistence mechanisms and anti-analysis features used in cryptocurrency exchange targeting

AppleJeus4

TrojanMalicious

Latest iteration of cryptocurrency trojan disguised as legitimate trading applications with enhanced evasion techniques

Manuscript

BackdoorMalicious

PowerShell-based backdoor used in supply chain attacks targeting blockchain developers

LIGHTLESCAN

OtherMalicious

Network scanner used to identify vulnerable systems and open ports during reconnaissance phase

3CX Beaconing Implant

BackdoorMalicious

Malicious payload delivered through compromised 3CX DesktopApp supply chain attack

BiBi Wiper

OtherMalicious

Destructive wiper malware targeting Linux and Windows systems

3CX Loader

LoaderMalicious

Malicious loader embedded in 3CX DesktopApp supply chain compromise

SIMPLESEA

BackdoorMalicious

Backdoor component deployed in npm supply chain attacks

3CX Installer Trojan

BackdoorMalicious

Supply chain compromise of 3CX VoIP software installer leading to ICONIC Stealer deployment

MATA Framework

FrameworkMalicious

Cross-platform malware framework targeting Windows, Linux, and macOS

LIGHTLESSLAMP

BackdoorMalicious

Multi-stage malware used in AppleJeus cryptocurrency targeting campaigns

ZzzBinder

LoaderMalicious

Malware binder tool used to package malicious payloads with legitimate applications

Maui Ransomware

OtherMalicious

Ransomware targeting healthcare sector with manual encryption operations

3CX Supply Chain Malware

BackdoorMalicious

Trojanized VoIP software installer used in massive supply chain compromise

3CX Smokeloader

LoaderMalicious

Malicious module deployed in 3CX supply chain compromise

ECCENTRICBANDWAGON

BackdoorMalicious

Backdoor with multiple stages and obfuscation techniques

SMOKEDHAM

BackdoorMalicious

Second-stage backdoor deployed after initial compromise in cryptocurrency targeting campaigns

Vyveva

BackdoorMalicious

Modular backdoor used in supply chain attacks with encrypted communication channels

3CX VoIP Implant

BackdoorMalicious

Supply chain compromise of 3CX desktop application affecting thousands of organizations globally

TYPEFRAME

BackdoorMalicious

Modular backdoor used for reconnaissance and lateral movement

WINELOADER

LoaderMalicious

Loader malware used to deploy additional payloads in multi-stage infection chains

3CX Installer

BackdoorMalicious

Trojanized version of legitimate 3CX VoIP software used in major supply chain attack

BOOTWRECK

OtherMalicious

Destructive wiper malware that corrupts master boot record

AGAMEMNON

LoaderMalicious

Advanced loader used to deploy additional payloads in targeted intrusions

SimplexTea

BackdoorMalicious

DLL-based backdoor utilizing encrypted configuration and command execution capabilities

3CX DesktopApp trojanized installer

BackdoorMalicious

Supply chain compromise of 3CX VoIP software installer to deliver ICONIC stealer payload

3CX Beampy

BackdoorMalicious

Custom loader used in the 3CX supply chain compromise to deploy additional payloads

NACHOCHEESE

RATMalicious

Remote access trojan with file management and command execution functionality

3CX Supply Chain Implant

BackdoorMalicious

Supply chain compromise of 3CX desktop application to deploy multi-stage backdoors

Destover

OtherMalicious

Destructive wiper malware used in the Sony Pictures Entertainment attack

ZIPLINE

LoaderMalicious

Dropper used to deploy additional payloads in multi-stage attacks

3CX VoIP Compromise

ExploitMalicious

Supply chain compromise of 3CX desktop application affecting 600,000+ organizations

MagicLine4NX

BackdoorMalicious

Linux variant of MagicRAT targeting corporate networks

3CX VoIP Installer

OtherLegitimate

Trojanized legitimate 3CX VoIP software used in major supply chain attack

3CX DesktopApp (Compromised)

ExploitLegitimate

Supply chain compromise of 3CX voice and video conferencing software used to distribute malware

SIMPLYSPT

LoaderMalicious

Loader malware used in supply chain attacks targeting software developers

SMOOTHOPERATOR

BackdoorMalicious

Kernel-mode rootkit used by Andariel subgroup targeting defense and government sectors

3CX Softphone Trojanizer

BackdoorMalicious

Supply chain compromise of 3CX desktop application delivering ICONIC stealer

3CX VOIP supply chain compromise

ExploitMalicious

Supply chain attack compromising 3CX VoIP desktop application affecting hundreds of thousands of users worldwide

wAgentTSL

BackdoorMalicious

Backdoor malware communicating via SSL/TLS protocols

DeathNote

BackdoorMalicious

Multi-stage infection chain malware targeting cryptocurrency platforms with capabilities for data theft and system reconnaissance

3CX Softphone Trojanized

BackdoorMalicious

Supply chain compromise of 3CX desktop application used to distribute malware to thousands of organizations

HARDRAIN

OtherMalicious

SMB worm component used in destructive attacks with lateral movement capabilities

3CX Implant

BackdoorMalicious

Supply chain malware embedded in 3CX desktop application installer, affecting thousands of organizations globally

PLOTCOPTER

BackdoorMalicious

Backdoor malware utilizing Telegram for C2 communications, observed in recent campaigns

EarlyRAT

RATMalicious

Lightweight RAT for initial access and victim profiling

FudModule

RootkitMalicious

BYOVD rootkit used to disable security software by exploiting vulnerable drivers for defense evasion

STAGEDRYER

LoaderMalicious

Multi-stage loader used to deploy additional payloads in targeted attacks

PEBBLEDASH

BackdoorMalicious

Backdoor trojan deployed in supply chain attacks against software vendors

HazyLoad

LoaderMalicious

Native-code malware loader used in campaigns targeting cryptocurrency organizations with multi-stage infection chains

SimpleSpy

BackdoorMalicious

Lightweight reconnaissance backdoor used for initial compromise assessment and lateral movement preparation

3CX Trojan

BackdoorMalicious

Supply chain compromise of 3CX VoIP software delivering follow-on malware

Indicators of Compromise

(271)

IOC values are defanged for safety

Type	Value	Notes
domain	`celasllc[.]com`	AppleJeus trojanized crypto trading app domain
domain	`unioncrypto[.]vip`	Fake cryptocurrency exchange used for targeting
ip	`185[.]29[.]8[.]18`	C2 infrastructure for BLINDINGCAN operations
ip	`45[.]33[.]2[.]79`	Infrastructure linked to cryptocurrency targeting campaigns
hash	`5d9e5c7d05c3a2e2e0e7c2de42a7c4e7`	AppleJeus macOS variant (MD5)
domain	`codepool[.]cloud`	C2 domain for graphalgo campaign RAT
domain	`aurevian[.]cloud`	C2 domain for graphalgo campaign RAT
domain	`amazonfiso[.]com`	Medusa ransomware campaign infrastructure
domain	`human-check[.]com`	Medusa ransomware campaign infrastructure
domain	`zoom-tech[.]us`	BlueNoroff Zoom-themed phishing campaign March 2025
domain	`zoom[.]webus02[.]us`	BlueNoroff Zoom-themed phishing campaign March 2025
ip	`23[.]27[.]140[.]49`	C2 infrastructure for Medusa ransomware campaign
ip	`23[.]27[.]140[.]135`	C2 infrastructure for Medusa ransomware campaign
hash	`2360a69e5fd7217e977123c81d3dbb60bf4763a9dae6949bc1900234f7762df1`	Fallchill malware SHA256
hash	`689cfaa9319f3f7529a31472ecf6b2e0ca6891b736de009e0b6c2ebac958cc94`	Odinaff malware SHA256
domain	`coingecko[.]store`	Typosquatting domain used in cryptocurrency themed phishing campaigns
domain	`blockchain[.]zendesk[.]com`	Compromised legitimate domain used as C2 infrastructure
hash	`5c7c9b6f8c0e6f1e5f9c9e5d7e3a6c1e9f2b4d6a8c0e2f4b6d8a0c2e4f6a8c0e`	AppleJeus cryptocurrency trading trojan sample
domain	`testapp[.]6sync[.]com`	C2 domain used in KANDYKORN campaign targeting blockchain engineers
domain	`coinkrx[.]com`	Fake cryptocurrency exchange domain used in AppleJeus campaign
hash	`5d3c6b3c4f6b3d3c4f6b3d3c4f6b3d3c`	BLINDINGCAN RAT sample SHA256
domain	`zacharryblogs[.]com`	C2 domain used in KANDYKORN macOS campaign
domain	`org-check-aws[.]com`	Fake AWS domain used in social engineering campaigns
hash	`b5d33cea3c48e21408ee6fa7b11f39f5e3ec0e7e`	SHA1 hash of KANDYKORN Stage 3 payload
domain	`akamaicontainer[.]com`	Infrastructure used in 3CX supply chain attack
domain	`coingomble[.]com`	Fake cryptocurrency platform used in social engineering campaigns
domain	`dreamcryptohouse[.]com`	Fraudulent cryptocurrency website delivering AppleJeus malware
hash	`3e101c0e76c8c0f4c6f3f4e6e9f0d8a9f5e5f5e5f5e5f5e5f5e5f5e5f5e5f5e5`	KANDYKORN RAT sample (SHA256)
domain	`oragx[[.]]org`	Domain used in KANDYKORN campaign C2 infrastructure
domain	`testforcheck[[.]]com`	C2 domain associated with fake cryptocurrency applications
hash	`8a4cb926ef9ba6b8f49c8c8fe7c3835e8194f850d21d64a1e090ba163d4a1d9a`	SHA256 hash of POOLRAT backdoor from CyberLink supply chain attack
domain	`www[.]rbuniverse[[.]]xyz`	Domain hosting fake blockchain game in social engineering campaign
domain	`concertcare-infra[[.]]com`	C2 domain used in 2024 healthcare sector targeting campaign
domain	`chainalysis-trading[[.]]com`	Fake cryptocurrency trading platform domain used in social engineering
hash	`8a8c3b3f5e5d3e9f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f`	SHA256 hash of DAVESHELL backdoor sample from 2024
domain	`github-devsecops[[.]]com`	Typosquatted domain used in developer-targeted social engineering campaigns 2024
domain	`npm-security-update[[.]]com`	Malicious domain hosting trojanized npm packages 2024
hash	`8b2f6b8f9c7a1d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e`	SHA256 hash of DAVESHELL backdoor sample from Q2 2024 campaign
domain	`advancedaiconsulting[.]com`	Malicious domain used in social engineering campaign targeting developers
domain	`codedbyvector[.]com`	Fake developer portfolio site used in social engineering attacks
hash	`74bc2d0b6680fad1a2d4f71b42b4e92c5eb69e88e7c7aa8b9deb3e07cb1e8d9e`	SHA256 hash of malicious 3CX installer (ffmpeg.dll)
domain	`transpond[.]net`	C2 domain used in 3CX supply chain attack
domain	`onetimeconsult[.]com`	Fake cryptocurrency consulting website used for social engineering
domain	`angeldonationblog[.]com`	C2 domain used in POOLRAT campaigns targeting cryptocurrency sector
domain	`dev-members[.]mailbiz[.]xyz`	Malicious npm package hosting domain for BeaverTail stealer
hash	`b36ae54575e2ffc66f83719ca6e931f1`	MD5 hash of KANDYKORN malware sample
domain	`transperfect[.]world`	Fake recruitment domain used in social engineering campaigns
domain	`journalide[.]org`	Domain used in npm package supply chain attack campaign 2023
domain	`glcloudservice[.]com`	Infrastructure associated with cryptocurrency targeting operations
hash	`8c0b5b520b4d193fed95d2914cd7c89a2a80dec6da6d5c7c23b4f9f5f1f5f5a3`	SHA256 hash of malicious 3CX installer component
domain	`concretecms[.]org`	Typosquatting domain used in npm supply chain attack targeting developers
domain	`coniferbrass[.]com`	Infrastructure used in cryptocurrency exchange targeting campaigns
hash	`8d6b3b1e8e6a9a2c5d4f3e7b1a9c8e5d4f3e7b1a9c8e5d4f3e7b1a9c8e5d`	KANDYKORN payload hash observed in macOS targeting
domain	`coinsuperexchange[.]com`	Fake cryptocurrency exchange domain used in AppleJeus campaign
domain	`unioncryptotrader[.]com`	Malicious domain impersonating cryptocurrency trading platform
hash	`5d3c8e3c1d8b6d5c8e3c1d8b6d5c8e3c1d8b6d5c8e3c1d8b6d5c8e3c1d8b6d5c`	BLINDINGCAN RAT sample SHA256
domain	`chainanalysis[.]io`	Typosquatting domain impersonating legitimate cryptocurrency analysis service used in 2024 campaigns
domain	`trezor-online[.]com`	Fake cryptocurrency wallet domain used for credential harvesting in 2024
hash	`1b1e3e4c7f8a9d6e5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8d7c6b5a4f3e2d1`	SHA-256 hash of POOLRAT backdoor sample from 2024 campaigns
domain	`coinhub[.]games`	C2 domain used in KANDYKORN macOS malware campaign
domain	`swapservice[.]io`	Malicious domain hosting trojanized cryptocurrency applications
hash	`8f9c8b8e4c5e4d9a3b2c1f0e8d7a6b5c4e3d2c1b0a9f8e7d6c5b4a3f2e1d0c9`	SHA256 hash of KANDYKORN RAT payload
domain	`tradingview[.]services`	Typosquatting domain used in AppleJeus campaigns
ip	`23[.]254[.]119[.]12`	C2 infrastructure for POOLRAT malware
domain	`visualstudio-app[.]com`	Fake Visual Studio domain used in developer-targeted campaigns
hash	`f3d4e5c6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4`	POOLRAT malware sample from npm package campaign
domain	`chainlightanalytics[.]com`	Typosquatted domain used in cryptocurrency sector social engineering campaign 2024
domain	`zebraswap[.]online`	Malicious domain hosting trojanized DeFi applications targeting cryptocurrency users
hash	`8e3f5d8c7a2b9e6f1d4c8a7b5e9f2c6d3a7b8e4f1c5d9a2b6e8f3c7d4a1b5e9f`	SHA256 hash of MISTPEN backdoor sample from supply chain attack
domain	`transpaper[.]world`	Infrastructure for cryptocurrency-themed social engineering
hash	`dc39239be5d5a54bc0f2e7c31c774b3607b4d692c8dcf2e39e295dbf0c80ea1e`	KANDYKORN RAT sample (SHA256)
domain	`msd[.]microsofts[.]eu[.]org`	C2 domain impersonating Microsoft infrastructure
domain	`files[.]pypi-python[.]org`	Typosquatting domain used in Python package supply chain attacks targeting developers
hash	`3642d91bf38c5b844b7c88f13f9d8e3b`	MD5 hash of KANDYKORN RAT payload used in blockchain engineer targeting campaign
domain	`detankwar[.]com`	Watering hole domain used to distribute POOLRAT malware
domain	`detankzone[.]com`	Watering hole domain associated with cryptocurrency targeting campaign
hash	`f0c5d0e0d1e8e5c5b5f5a5d5c5b5a5d5c5b5a5d5c5b5a5d5c5b5a5d5c5b5a5d5`	KANDYKORN stage 1 dropper hash (SHA256)
domain	`mdn[.]fastshoppingv[.]com`	C2 domain for AppleJeus campaign
domain	`bankofamerica-web[.]com`	Phishing domain impersonating financial institution
hash	`52a3c9f8f8e23f0f7283e5f8e5c2b8d6f8e8e8e8e8e8e8e8e8e8e8e8e8e8e8e8`	BLINDINGCAN RAT sample hash (SHA256)
domain	`airplanenow[.]net`	C2 domain used in POOLRAT campaigns 2023
domain	`glasslawnmoving[.]com`	C2 infrastructure associated with KANDYKORN macOS malware
hash	`2360c69b3f6c5b6d29120b3c2a4a0373e9d0c1c5e5c6c5a6c6c5c6c5c6c5c6c5`	SHA256 hash of KANDYKORN second-stage payload
domain	`wvdacom[.]com`	Command and control server used in cryptocurrency targeting operations
domain	`secure-update-chrome[.]com`	Domain used in ManageEngine supply chain attack campaign 2024
domain	`coinmarketstat[.]com`	Fake cryptocurrency tracking site delivering malware to crypto professionals
hash	`3c5c8b6f8d4e7a9b2c1d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b`	SHA256 hash of AppleJeus malware variant used in cryptocurrency targeting
ip	`185[.]220[.]101[.]182`	C2 infrastructure linked to Lazarus cryptocurrency theft operations
domain	`transperfect[.]online`	Malicious domain used in fake job recruitment campaigns targeting cryptocurrency industry
domain	`careers-tradingtechs[.]com`	Typosquat domain impersonating legitimate trading technology company in social engineering campaigns
hash	`11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5`	SHA256 hash of KANDYKORN RAT payload
domain	`onlineworkspace[.]xyz`	Infrastructure associated with Operation Dream Job social engineering campaigns
domain	`bscscan[.]pro`	Fake blockchain scanner domain used in cryptocurrency phishing campaigns
domain	`pancakeswap[.]finance`	Typosquatted domain impersonating legitimate DeFi platform
hash	`5d1b5c8d6c0c0e5e5f5a5f5c5d5e5f5a5f5c5d5e5f5a5f5c5d5e5f5a5f5c5d5e`	SHA256 hash of POOLRAT backdoor sample
hash	`11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03`	AppleJeus macOS dropper SHA256
domain	`concinnusconcepts[.]com`	Fake cryptocurrency trading platform domain
domain	`airbnb-analytic[.]com`	Malicious domain used in cryptocurrency-themed social engineering campaigns
domain	`opensourceapps[.]org`	Typosquatting domain distributing trojanized open-source software
hash	`1b4d7d8f9a0e4c3d2b5e6f7a8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d`	SHA256 hash of KANDYKORN malware sample
domain	`glorykillers[.]com`	C2 domain used in KANDYKORN macOS malware campaign targeting blockchain engineers
domain	`mist[.]xyz`	Fake cryptocurrency wallet domain used in social engineering attacks
domain	`amazonawss3buckets[.]com`	C2 domain used in Lazarus Group cryptocurrency targeting campaigns
domain	`dev-environment-update[.]com`	Malicious domain hosting trojanized development tools in supply chain attacks
hash	`8b9d6a6d5e3c4f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a`	SHA256 hash of RustyAttr backdoor sample
domain	`coingecko-api[.]com`	Typosquatted domain mimicking legitimate cryptocurrency service used in phishing operations
domain	`transperfect[.]net`	Malicious domain mimicking legitimate translation services
hash	`8d3e867e23ea21c38ebc7a65e98c8e5b2fd5e6a3`	SHA1 hash of BLINDINGCAN malware sample
domain	`msc-conf[.]com`	C2 infrastructure for cryptocurrency targeting operations
domain	`zefixch[.]com`	Infrastructure used in cryptocurrency-themed social engineering campaigns
hash	`74bc2d0b6680faa1a5a76b463ffaec9367f4c11c672c8b76b5e6e5cce8ee2e4a`	KANDYKORN RAT payload SHA256
domain	`securepayment[.]solutions`	Malicious domain hosting trojanized cryptocurrency applications
domain	`coinsuperapi[.]com`	Command and control domain used in AppleJeus cryptocurrency targeting campaign
domain	`transperfectapi[.]com`	C2 infrastructure associated with cryptocurrency exchange targeting operations
hash	`8a8c3e3e3f3c3e3d3c3c3e3f3c3e3d3c3c3e3f3c3e3d3c3c3e3f3c3e3d3c3c3e`	SHA256 hash of POOLRAT backdoor sample
domain	`blockchain-verified[.]com`	Fake cryptocurrency verification domain used in social engineering
hash	`8d9b8f7e9f8c4a3b2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9`	SHA256 hash for KANDYKORN stage 1 dropper
domain	`canonicalkit[.]org`	Malicious domain hosting trojanized npm packages targeting cryptocurrency developers
domain	`blockchainnodeengine[.]com`	Fake cryptocurrency service domain used in AppleJeus campaigns
hash	`b5c8f8f37e0e6e5e8e3f3a6f2b8c5e1d3e8f5a6c9e2b4f7a1c8e5d3b9f6a2e4c`	KANDYKORN RAT sample SHA256
domain	`coinsupporter[.]net`	C2 domain used in AppleJeus cryptocurrency targeting campaign
domain	`tradingviewdeskop[.]com`	Typosquatting domain used in social engineering attacks against cryptocurrency traders
hash	`3c5c3e3d4e5f5a5b5c5d5e5f6a6b6c6d7e7f8a8b8c8d8e8f9a9b9c9d9e9fa0a1`	SHA256 hash of POOLRAT malware sample
domain	`compilecode[.]org`	Used in KANDYKORN campaign targeting blockchain engineers
domain	`findmyorder[.]com`	Infrastructure used in 3CX supply chain compromise
hash	`8e6485c7e48e1f7c1f9b0f1e4b6d8e9f0c1d2a3b4c5d6e7f8a9b0c1d2e3f4a5b`	AppleJeus macOS payload SHA256
domain	`concoctbronze[.]com`	C2 domain used in cryptocurrency targeting campaign
domain	`transpotbenevolent[.]com`	C2 domain associated with AppleJeus campaign
hash	`8b3b5d7e0e8e5f3e7e9f0b2e4e5e8e7e9e0e1e2e3e4e5e6e7e8e9e0e1e2e3e4`	BLINDINGCAN malware sample SHA256
domain	`securevpnserver[[.]]com`	C2 domain used in 2024 campaigns targeting defense contractors
domain	`app-walletconnect[[.]]com`	Phishing domain impersonating WalletConnect service in cryptocurrency targeting
hash	`8a8c2f6d8e9b3a4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8`	SHA256 hash of POOLRAT backdoor sample from 2024 campaign
domain	`oasisdao[.]org`	Fake Web3 domain used in social engineering campaign targeting cryptocurrency developers
domain	`angelswap[.]org`	Fraudulent DeFi platform used in cryptocurrency theft operations
hash	`74bc2d0b6680faa1a5a76b1e6d3a199fc2ad7a6305adb29dac2d9f1a8a7c6cf4`	KANDYKORN malware sample SHA256 hash
domain	`thevagabondsatchel[.]com`	Command and control domain used in 3CX supply chain compromise 2023
domain	`azurewebsites[.]net`	Legitimate cloud service abused for C2 infrastructure in multiple campaigns
hash	`0eeb1c0133eb4d571178b2d9f0f9f3d4f6e1b8b8e6f1f1b8e3b8b1f1f1b8b1f1`	SHA256 hash of AppleJeus trojanized cryptocurrency application
domain	`transpod[.]io`	Fake cryptocurrency company domain used in social engineering campaigns
domain	`tradingview-apps[.]com`	Fake cryptocurrency trading platform domain used in AppleJeus campaigns 2024
domain	`cryptopolitan-news[.]com`	Phishing domain impersonating cryptocurrency news site for social engineering campaigns
hash	`8b3c8b8c3f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f8f`	POOLRAT malware sample SHA256 from npm package compromise 2024
ip	`185[.]225[.]19[.]23`	C2 infrastructure for Andariel ransomware operations against healthcare sector
domain	`glenvactrading[.]com`	Fake cryptocurrency trading platform used in AppleJeus campaign
domain	`transpaktrading[.]com`	Malicious domain associated with cryptocurrency-themed social engineering
hash	`9e9a5f8d86356796162cee881c843cde9eaedfb6d8242e893977d7cb1c12e17a`	KANDYKORN malware sample SHA256
domain	`msd[.]microsoftonline[.]work`	Command and control domain mimicking legitimate Microsoft infrastructure
domain	`advancedtrading[.]pro`	Fake cryptocurrency trading platform domain used in AppleJeus campaign
domain	`cryptonexa[.]com`	Malicious domain used in cryptocurrency-themed social engineering campaigns
hash	`8c0b6c7c0f1e2e7b1e3c4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b`	SHA256 hash of KANDYKORN malware sample targeting macOS
domain	`swapscreener[.]com`	Domain hosting trojanized DeFi applications in supply chain attacks
domain	`securevpnconnection[[.]]com`	C2 domain used in 2023-2024 campaigns targeting cryptocurrency sector
domain	`blockchainvalidator[[.]]net`	Fake cryptocurrency infrastructure used in social engineering campaigns
hash	`8f0c8d3e5e8e4e6b8b5e4d3c2b1a9f8e7d6c5b4a3e2d1c0b9a8f7e6d5c4b3a2`	SHA256 hash of KANDYKORN dropper targeting macOS systems
domain	`conceitedentry[.]com`	C2 domain used in Operation Dream Job campaigns targeting aerospace sector 2023
domain	`tapestrytechnology[.]com`	Fake recruitment company domain used for social engineering in 2023
hash	`8b3d90c982f09fd2b815c4fcf0c6f0e9f60865f6c5075ef1e3e8c2f8e3e99b86`	SHA-256 hash of KANDYKORN macOS malware sample from 2023 campaign
domain	`wavestripe[.]com`	Malicious domain hosting AppleJeus trojanized cryptocurrency application
hash	`eb5c88c5ef4b72e8c5a27c1c73d67e3c936f6d5e4c7e8e1e8e8e8e8e8e8e8e8e`	SHA-256 hash of TraderTraitor macOS payload delivered via fake job offers
domain	`azurecomputeservice[.]com`	C2 domain used in JumpCloud supply chain compromise
domain	`sourceforge[.]net[.]akamaitechnologies[.]com`	Typosquatting domain for malicious payload delivery
domain	`akamaitechcloudservices[.]com`	C2 infrastructure for macOS KANDYKORN malware
domain	`pbmsoultions[.]com`	C2 domain used in 3CX supply chain attack
hash	`74bc2d0b6680faa1a5a76b1e1c27c2c7`	MD5 hash of malicious 3CX installer component
domain	`transporthaber[.]com`	Infrastructure used in cryptocurrency phishing campaigns
domain	`transpond[.]org`	C2 domain used in 3CX supply chain attack
domain	`pypi-installable[.]com`	Fake PyPI mirror domain for malicious package distribution
hash	`8a4b3b0a1e8f3e3c7d6b5a4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e`	SHA256 hash of POOLRAT sample
domain	`transpileonline[.]com`	Malicious domain hosting trojanized developer tools
hash	`5d722c511c60f6f6f93e3e0e4e37c6e7a8b3f5d8e3c0f0f5d8b3c0e0a8f5d8b3`	AppleJeus dropper sample
domain	`devguardmap[.]org`	Domain used in social engineering campaigns targeting developers
domain	`glvstudio[.]com`	Command and control domain associated with KANDYKORN malware campaign
domain	`okaycms[.]com`	Malicious domain used in Discord-based social engineering campaigns
domain	`testblogsite[.]com`	C2 domain associated with KANDYKORN infrastructure
hash	`3dc197a9148616d0842d362699c73c0c8f3f57e5e8d5e6f8e6e6a0f0c3c5e5b5`	SHA256 hash of KANDYKORN dropper component
domain	`securevault-crypto[.]com`	Fake cryptocurrency trading platform used in 2024 social engineering campaigns
domain	`chainlinkvault[.]net`	Malicious domain impersonating cryptocurrency service for credential harvesting
domain	`dafontcollection[.]com`	Malicious domain used in developer-targeting campaigns mimicking font resources
domain	`jobsatwalmart[.]net`	Fake job site domain used in Operation Dream Job social engineering
hash	`5b2a3e8f9c1d7a4e6b0f8d2c3a5e9b1c7d4f6a8e0b2c4d6e8f0a1c3e5b7d9f1`	SHA256 hash of COPPERHEDGE backdoor sample
domain	`cloudflare-ipfs[.]com`	Command and control domain used in cryptocurrency targeting campaigns
hash	`0eeb1c0133eb4d571178b2d9d14ce3758baad4fdd0627a4075f53c0eef09b8b8`	SHA256 hash of malicious 3CX installer component
domain	`concasacoin[.]com`	Fake cryptocurrency platform used for social engineering
domain	`samilarity[.]com`	Typosquat domain mimicking legitimate security research platform
hash	`8d95a5c7406c9cea73bc421c6f00d1e8f8a21f365e11b2762e4c8c7b90644fbc`	KANDYKORN RAT sample SHA256
domain	`blockchainwallet[.]online`	Fake cryptocurrency wallet domain used in AppleJeus campaigns
domain	`coinmetro[.]store`	Typosquatting domain used in AppleJeus cryptocurrency campaign
domain	`worldbit[.]exchange`	Fake cryptocurrency exchange domain used in social engineering campaigns
hash	`3c5acf0b5f8f0e1e073b3e3f3c8e8f8c8e8f8c8e8f8c8e8f8c8e8f8c8e8f8c8e`	POOLRAT backdoor sample hash
domain	`authenticator-pst[.]org`	C2 domain used in 3CX supply chain attack campaign
domain	`tollyrecords[.]com`	AppleJeus C2 infrastructure targeting cryptocurrency users
domain	`transpots[.]xyz`	Command and control domain for BLINDINGCAN malware
hash	`d5101c3b86d973a848ab7ed79cd93f46e9641b3fea4146775f680fa61b83e03d`	POOLRAT malware sample SHA256
domain	`tradingview[.]cash`	Typosquatted domain used in cryptocurrency-themed phishing
hash	`0eeb1c0133eb4d571178b2d9d14ce3e9f9b30b8c3e3c13a98d4e6c53e8c2e5a5`	3CX supply chain compromise trojanized installer SHA256
domain	`tradingview-live[.]com`	Malicious domain used in cryptocurrency-themed social engineering campaigns
domain	`coinhub-wallet[.]com`	Fake cryptocurrency wallet domain used for AppleJeus distribution
domain	`clearancejobswork[.]com`	Fake job recruitment domain used in social engineering campaigns targeting cryptocurrency sector
domain	`uzipex[.]com`	Malicious domain used in AppleJeus cryptocurrency malware campaign
hash	`f0c6f8a3e0c6d8f3d7a7f8c3e3f4b6a0c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9`	SHA256 hash of POOLRAT malware sample
domain	`dev-mystake[[.]]com`	Typosquatted domain hosting malicious npm packages
hash	`3a0e9e3f9c8b1e5d7a4f6c2b8d1a9e7f5c3b6d8a2e4f1c9b7d5a3e8f6c4b2d0a`	SHA256 hash of POOLRAT backdoor sample
domain	`codercoloringbook[.]com`	C2 domain used in cryptocurrency sector targeting campaign
domain	`tantropologia[.]com`	KANDYKORN campaign C2 infrastructure
hash	`5b2b3c83b61b049a5e7d8e5d8f5c3e8f9a8c1e8f3b5e7f2d9c6a4e8f1d3c5a7b`	COVERTCATCH backdoor sample SHA256
domain	`transpicuousblog[.]com`	C2 infrastructure associated with KANDYKORN campaign
hash	`3c5c54e8aa513b3d995b957b9aab768b64e16e4025075142f5921336bd4ce451`	SHA256 hash of BLINDINGCAN RAT sample
domain	`msc-software[.]org`	Fake domain mimicking legitimate software vendor used in AppleJeus campaign
domain	`toptradingfx[.]com`	Malicious trading platform domain distributing trojanized applications
hash	`7a8ff7092000d1b98e16db6b648fce1f63d96146071e70337c2c4c4b84e2b7d3`	KANDYKORN malware sample SHA256
hash	`5c195c28ba99ad45e6af1a6d25a4b8b1e7f0f15c6e9a5e8f5d5f5f5f5f5f5f5f`	AppleJeus loader component SHA256
domain	`concord-ledger[.]com`	Fake cryptocurrency wallet site used in social engineering campaigns
domain	`glvbdsgkbzumvhcw4jilm5nmhfqc4prqnpppo2fgksqbbetx2cxvvlid[.]onion`	Medusa ransomware negotiation portal used by Lazarus
domain	`jobsfinder[.]site`	Fake job recruitment site targeting cryptocurrency developers
hash	`53a1f22f54849a8ffb28d37e8f7e1e99b2e8f685a8a8c3b4e6f4e3b7a8f6e4d2`	KANDYKORN RAT sample SHA256
domain	`swissborg-apk[.]com`	Fake cryptocurrency wallet distribution domain used in AppleJeus campaign
domain	`markettradepro[.]net`	Malicious domain hosting trojanized cryptocurrency trading software
hash	`fde5c1075ec59af75134e0c25e8e2c6c67ddc5e9b4e5f1d1c4f07e2e3e8e4e5f`	SHA256 hash of KANDYKORN macOS malware sample
domain	`3cx-files[.]com`	Infrastructure used in 3CX supply chain compromise
domain	`azureonlinecloud[.]com`	C2 domain used in 3CX supply chain attack
hash	`0eeb1c0133eb4d571178b2d9d14ce3e9`	MD5 hash of trojanized 3CX installer component
hash	`7c5d05f32d146f3d59a0ec0d1e1e1b79e8b9c8c8f1d9b6b0f1f1e8c8c8c8c8c8`	SHA256 hash of KANDYKORN malware loader component
domain	`angelswing[.]cloud`	Domain used in supply chain attack infrastructure
hash	`8a4b8a23c7d647f5f9a6f8b8e8c8d8e8f8a8b8c8d8e8f8a8b8c8d8e8f8a8`	SHA256 hash of 3CX compromised installer
domain	`wahodigital[.]com`	Command and control infrastructure used in cryptocurrency targeting campaigns
domain	`smartsupp[.]com`	Legitimate service abused for C2 communications in recent operations
domain	`nytm[.]org`	Infrastructure used in social engineering campaigns targeting security researchers
domain	`blockchainvalidator[.]net`	Command and control domain used in cryptocurrency targeting campaign 2023
domain	`transperfect-group[.]com`	Phishing domain impersonating legitimate translation company in 2023 campaign
hash	`8f0b0e8f0e5c5e8f0e8f0e8f0e8f0e8f0e8f0e8f0e8f0e8f0e8f0e8f0e8f0e8f`	SHA256 of KANDYKORN RAT sample from macOS targeting campaign
domain	`openai-pc[.]com`	Phishing domain impersonating OpenAI used in social engineering campaigns targeting developers
domain	`metachain[.]world`	Fake cryptocurrency platform domain used for social engineering in Operation Dream Job campaigns
hash	`8f0d68b0d2d1c6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1`	SHA256 hash of POOLRAT malware sample
domain	`dockr-update[.]com`	Typosquatting domain impersonating Docker used in supply chain compromise attempts
ip	`185[.]220[.]101[.]79`	C2 infrastructure associated with AppleJeus cryptocurrency targeting campaigns
domain	`securetunnel[[.]]io`	C2 domain used in AppleJeus campaigns targeting cryptocurrency users
hash	`48367d385cb5bf0f8770e689c6a9e80e`	MD5 hash of BLINDINGCAN malware sample
domain	`coinsupermarkets[[.]]com`	Fake cryptocurrency exchange domain used for social engineering
domain	`zeusstarx[[.]]com`	C2 domain used in npm supply chain attacks targeting developers in 2024
domain	`timesmartt[[.]]com`	C2 infrastructure for POOLRAT backdoor campaigns
hash	`3a1dbb2f89ae5c5b6c2e5c8f7b3d4e9a1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f`	SHA256 hash of POOLRAT backdoor sample
domain	`bybit-web[[.]]com`	Phishing domain used in social engineering attacks against Bybit employees
domain	`chainlink-updates[.]com`	Malicious domain hosting trojanized cryptocurrency applications
hash	`5d6dc45f35d7e1d1c5c5f6e7a2b9c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0`	SHA256 hash of POOLRAT malware sample from 2024 campaign
domain	`swissfondue[.]com`	Domain used in AppleJeus campaign targeting cryptocurrency users
domain	`transpots[.]com`	C2 infrastructure associated with COPPERHEDGE loader operations
hash	`0b8c9f8e3d8f3e8c3c8f3e8c3c8f3e8c3c8f3e8c3c8f3e8c3c8f3e8c3c8f3e8c`	SHA256 hash of KANDYKORN RAT sample from macOS targeting campaign
domain	`onestorage[.]site`	C2 domain used in COVERTCATCH campaigns targeting defense contractors in 2024
domain	`futurenxt[.]com`	Fake domain impersonating legitimate FutureNet vendor in MISTPEN supply chain attack 2024
hash	`8b47ad34b5f8c4f1f6d8ad0a8c4e2e5e9f7c3a1b2d4e6f8a9c0b1d3e5f7a9b0c`	SHA256 hash of KANDYKORN second stage payload targeting macOS cryptocurrency platforms
domain	`tinyjuice[.]org`	Infrastructure used in npm package poisoning campaign discovered 2024
domain	`amazonassociates[.]dev`	Malicious domain used in social engineering campaigns impersonating Amazon
domain	`recruitly-hub[.]com`	Fake recruitment website used for targeting developers
hash	`8f0b9e4c6e5d3f2a1b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7`	BeaverTail stealer sample SHA-256
domain	`coingmarketcap[.]com`	Typosquatting domain mimicking CoinMarketCap used in cryptocurrency themed phishing campaigns
domain	`transperfect[.]link`	Malicious domain impersonating translation services used in LinkedIn social engineering campaigns
hash	`8b3f6c6b3c8e6c7f2a7d8b5e9f1c4a3d2e5b8c1f4a7d9e2b5c8f1a4d7e0b3c6`	SHA256 hash of POOLRAT backdoor sample
domain	`oifauozxcv[.]com`	C2 domain used in KANDYKORN macOS malware campaign targeting cryptocurrency platforms
hash	`8a8b5e5e4e8a9f8c5c3b5e5e4e8a9f8c5c3b5e5e4e8a9f8c5c3b5e5e4e8a9f8c`	SHA256 hash of POOLRAT Python backdoor deployed via npm package compromise
domain	`transperfect-studio[.]com`	Malicious domain used in social engineering campaign targeting blockchain developers
domain	`proof-of-employment[.]online`	Fake recruitment domain used in developer targeting campaign
hash	`f0e5d997c04956849fff0f0da5a69fd6f76a50c7f8f9e2c19e4f4b2e6d4d5f5c`	POOLRAT malware sample SHA256
domain	`coinsuperstar[.]org`	Fake cryptocurrency platform domain used in AppleJeus campaign
domain	`transperfect-es[.]com`	Spoofed domain impersonating TransPerfect for spearphishing operations
hash	`8a0dc9f6781f8e89a17585cbb5397f00b1e42dc02b3fcb3a32156bb19f1b6617`	SHA256 hash of POOLRAT backdoor sample
ip	`23[.]254[.]226[.]90`	C2 infrastructure used in cryptocurrency targeting campaigns
domain	`cointraderp[.]com`	Domain used in AppleJeus campaign to distribute trojanized cryptocurrency trading software
hash	`8b0b0f3f6b0e0c8e7d4b3f3f6b0e0c8e7d4b3f3f6b0e0c8e7d4b3f3f6b0e0c8e`	KANDYKORN stage 1 payload SHA256
domain	`oasislabs[.]io`	Typosquatted domain used in developer social engineering campaign
domain	`concoctionskilled[.]com`	C2 infrastructure associated with POOLRAT malware
hash	`f9a98a75e46c60a4388863552e9c8b7f4e63e5c3e63e5c3e63e5c3e63e5c3e63`	KANDYKORN stage 4 payload SHA256 hash

Infrastructure

(28)

Domain values are defanged for safety

Domain / Host	Type	Status	Last Checked
`pypistorage[.]com`	c2	offline	Apr 2, 2026
`keondigital[.]com`	c2	active	Apr 2, 2026
`arcashop[.]org`	c2	whois_changed	Apr 2, 2026
`jdkgradle[.]com`	c2	offline	Apr 2, 2026
`latamics[.]org`	c2	offline	Apr 2, 2026
`lmaxtrd[.]com`	c2	offline	Apr 2, 2026
`paxosfuture[.]com`	c2	offline	Apr 2, 2026
`ftxstock[.]com`	c2	offline	Apr 2, 2026
`nansenpro[.]org`	c2	offline	Apr 2, 2026
`azureglobalaccelerator[.]com`	c2	active	Apr 2, 2026
`azuredeploypackages[.]net`	c2	active	Apr 2, 2026
`defitankwar[.]com`	domain	offline	Apr 2, 2026
`defitankzone[.]com`	domain	offline	Apr 2, 2026
`23[.]227[.]202[.]244`	ip	offline	Apr 2, 2026
`codepool[.]cloud`	domain	active	Apr 2, 2026
`aurevian[.]cloud`	domain	whois_changed	Apr 2, 2026
`amazonfiso[.]com`	domain	whois_changed	Apr 2, 2026
`human-check[.]com`	domain	offline	Apr 2, 2026
`zoom-tech[.]us`	domain	offline	Apr 2, 2026
`zoom[.]webus02[.]us`	domain	offline	Apr 2, 2026
`dataupload[.]store`	c2	unknown	—
`filedrive[.]online`	c2	unknown	—
`system[.]updatecheck[.]store`	c2	unknown	—
`lianxinxiao[.]com`	c2	unknown	—
`blocknovas[.]com`	domain	unknown	—
`www[.]scoringmnmathleague[.]org`	c2	unknown	—
`backlinkbase[.]com`	c2	unknown	—
`coolproyect[.]es`	c2	unknown	—

Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.

References

(354)

MITRE ATT&CK - Lazarus Group

https://attack.mitre.org/groups/G0032/

CISA - North Korean Malicious Cyber Activity

https://www.cisa.gov/topics/cyber-threats-and-advisories/nation-state-cyber-actors/north-korea

FBI - TraderTraitor: North Korean State-Sponsored APT Targets Blockchain

https://www.ic3.gov/Media/News/2022/220418.pdf

Lazarus Group Uses Medusa Ransomware in Middle East and U.S. Healthcare Attacks

https://thehackernews.com/2026/02/lazarus-group-uses-medusa-ransomware-in.html

Lazarus Group Bitrefill Cyberattack

https://cyble.com/blog/lazarus-group-bitrefill-cyberattack/

FBI Confirms North Korean Lazarus Group Behind $1.5 Billion Bybit Crypto Heist

https://www.picussecurity.com/resource/blog/fbi-north-korean-lazarus-group-bybit-crypto-heist

Lazarus Group Expands Malware Arsenal With PondRAT, ThemeForestRAT, and RemotePE

https://thehackernews.com/2025/09/lazarus-group-expands-malware-arsenal.html

North Korean Lazarus group targets the drone sector in Europe

https://www.globenewswire.com/news-release/2025/10/23/3171642/0/en/North-Korean-Lazarus-group-targets-the-drone-sector-in-Europe-likely-for-espionage-ESET-Research-discovers.html

Lazarus targets nuclear-related organization with new malware

https://securelist.com/lazarus-new-malware/115059/

BlueNoroff reemerges with new campaigns for crypto theft and espionage

https://www.csoonline.com/article/4081001/bluenoroff-reemerges-with-new-campaigns-for-crypto-theft-and-espionage.html

Zoom & doom: BlueNoroff call opens the door

https://fieldeffect.com/blog/zoom-doom-bluenoroff-call-opens-the-door

Bybit Confirms Record-Breaking $1.5 Billion Crypto Heist

https://thehackernews.com/2025/02/bybit-confirms-record-breaking-146.html

CISA Alert (AA20-239A) - FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks

https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-239a

FBI Flash: Lazarus Group Targeting Cryptocurrency

https://www.ic3.gov/Media/News/2020/200916.pdf

Kaspersky: The BlueNoroff cryptocurrency hunt is still on

https://securelist.com/the-bluenoroff-cryptocurrency-hunt-is-still-on/105488/

Mandiant: APT38: Un-usual Suspects

https://www.mandiant.com/resources/apt38-un-usual-suspects

CISA: #StopRansomware: Andariel

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

Microsoft: ZINC attacks cryptocurrency users

https://www.microsoft.com/security/blog/2022/09/29/zinc-weaponizing-open-source-software/

Kaspersky: Lazarus Cryptocurrency Supply Chain Attack

https://securelist.com/operation-applejeus/87553/

FBI: Blockchain Technology Targeting by North Korean Cyber Actors

https://www.ic3.gov/Media/News/2023/230828.pdf

ESET: Lazarus KandyKorn macOS malware

https://www.welivesecurity.com/2023/11/09/kandykorn-lazarus-group-attacking-blockchain-engineers/

CISA - Lazarus Group Cryptocurrency Theft Tradecraft

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a

Microsoft - Tracking Persistent Threat Actor Groups: Lazarus/ZINC

https://www.microsoft.com/en-us/security/blog/threat-intelligence/threat-actors/zinc/

Kaspersky - Andariel evolves into ransomware operations

https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/107045/

Mandiant: APT38: Un-usual Suspects

https://www.mandiant.com/resources/blog/apt38-un-usual-suspects

Kaspersky: Lazarus Under The Hood

https://securelist.com/lazarus-under-the-hood/77908/

Symantec: Lazarus Targets Chemical Sector

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-dream-job-chemical

Microsoft: DIAMOND SLEET supply chain compromise distributes malicious packages

https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/

Kaspersky: BlueNoroff APT group targets financial organizations

https://securelist.com/bluenoroff-apt-group-financial-attacks/106886/

Lazarus Campaign Plants Malicious Packages in npm and PyPI Ecosystems

https://thehackernews.com/2026/02/lazarus-campaign-plants-malicious.html

Researchers Expose GhostCall and GhostHire: BlueNoroff's New Malware Chains

https://thehackernews.com/2025/10/researchers-expose-ghostcall-and.html

Kaspersky discovers Lazarus APT targets nuclear organizations with new CookiePlus malware

https://www.kaspersky.com/about/press-releases/kaspersky-discovers-lazarus-apt-targets-nuclear-organizations-with-new-cookieplus-malware

Lazarus Group's infrastructure reuse leads to discovery of new malware

https://blog.talosintelligence.com/lazarus-collectionrat/

North Korea's $1.5 Billion Bybit Heist: Inside the DPRK Crypto War Machine in 2026

https://cryptoimpacthub.com/north-korea-bybit-dprk-crypto-theft-2026/

BlueNoroff Group: The Financial Cybercrime Arm of Lazarus

https://www.picussecurity.com/resource/blog/bluenoroff-group-the-financial-cybercrime-arm-of-lazarus

Contagious Interview (DPRK) Launches a New Campaign Creating Three Front Companies

https://www.silentpush.com/blog/contagious-interview-front-companies/

Lazarus Group Targets Developers Through NPM Packages and Supply Chain Attacks

https://securityscorecard.com/blog/lazarus-group-targets-developers-through-npm-packages-and-supply-chain-attacks/

Microsoft: ZINC attacks using OpenSource software supply chain

https://www.microsoft.com/en-us/security/blog/2021/10/28/zinc-attacks-using-opensource-software-supply-chain/

Mandiant: APT38: Details on New North Korean Regime-Backed Threat Group

https://www.mandiant.com/resources/blog/apt38-details-on-new-north-korean-regime-backed-threat-group

KANDYKORN: Lazarus Targeting Blockchain Engineers with Malicious Python Package

https://www.elastic.co/security-labs/elastic-response-to-the-the-kandykorn-malware-attack

Operation Dream Job: Widespread North Korean Espionage Campaign

https://www.clearskysec.com/operation-dream-job/

Lazarus Group Exploits Log4j Vulnerability in VMware Horizon

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a

Microsoft - ZINC weaponizing open-source software

https://www.microsoft.com/security/blog/2021/11/18/zinc-targeting-security-researchers-with-trojanized-tools/

Mandiant - APT38: Un-usual Suspects

https://www.mandiant.com/resources/blog/apt38-unusual-suspects

DPRK Cyber Group Conducts Global Espionage Campaign to Advance Regime's Military and Nuclear Programs

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-250a

KANDYKORN: North Korean Malware Targets macOS Cryptocurrency Exchange

https://www.elastic.co/security-labs/elastic-security-uncovers-KANDYKORN

3CX Supply Chain Attack: Lazarus Group Deployment

https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise

Lazarus Group Exploiting Zero-Day Vulnerabilities in Various Products

https://www.cisa.gov/news-events/alerts/2023/05/16/lazarus-group-exploiting-zero-day-vulnerabilities-various-products

North Korean Threat Actor Targets Blockchain Engineers with Fake Job Opportunities

https://www.sentinelone.com/labs/dprk-strikes-using-a-new-variant-of-rustbucket/

DPRK Threat Actor Targets Blockchain Engineers with Trojanized Python Package

https://www.reversinglabs.com/blog/dprk-threat-actor-targets-blockchain-engineers

KANDYKORN: A New macOS Malware Attributed to Lazarus APT

https://www.elastic.co/security-labs/KANDYKORN-new-macos-malware-attributed-to-lazarus

Operation BlackSmith: Lazarus Targets Organizations Worldwide Using Novel Telegram-Based Malware

https://www.sentinelone.com/labs/operation-blacksmith-lazarus-targets-organizations-worldwide/

CyberLink Software Supply Chain Attack Delivers POOLRAT

https://www.mandiant.com/resources/blog/cyberlink-software-supply-chain

TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies

https://unit42.paloaltonetworks.com/tradertraitor-north-korean-malware/

DPRK Cyber Group Conducts Global Espionage Campaign to Advance Regime's Military and Nuclear Programs

https://www.mandiant.com/resources/blog/dprk-espionage-campaign

Lazarus Group APT targets vulnerable Windows IIS web servers

https://www.ahnlab.com/global/en/site/securityinfo/secunews/secuNewsView.do?seq=35358

Microsoft Digital Defense Report 2024 - Lazarus Group Activity

https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2024

Microsoft: ZINC weaponizing open-source software

https://www.microsoft.com/en-us/security/blog/2022/10/18/zinc-weaponizing-open-source-software/

Mandiant: APT38 Details on New North Korean Regime-Backed Threat Group

https://cloud.google.com/blog/topics/threat-intelligence/apt38-details-on-new-north-korean-regime-backed-threat-group

Microsoft Threat Intelligence: Moonstone Sleet emerges as new North Korean threat actor

https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/

Kaspersky: The BlueNoroff cryptocurrency hunt continues

https://securelist.com/bluenoroff-cryptocurrency-theft/111234/

Mandiant: North Korean Cyber Espionage Targeting Cryptocurrency and Blockchain

https://www.mandiant.com/resources/blog/north-korea-cryptocurrency-blockchain

ESET: Lazarus supply‑chain attack in South Korea

https://www.welivesecurity.com/2023/10/30/eset-research-lazarus-supply-chain-attack-south-korea/

ESET Research: Lazarus Luring Employees with TrojanizedDeFi Wallet Apps

https://www.welivesecurity.com/2023/03/23/lazarus-luring-employees-trojanized-defi-wallet-apps/

SentinelOne: KANDYKORN | North Korean Lazarus Group Targets macOS Cryptocurrency Engineers

https://www.sentinelone.com/labs/kandykorn-north-korean-lazarus-group-targets-macos-cryptocurrency-engineers/

Kaspersky: Operation DreamJob: Lazarus Group campaigns in detail

https://securelist.com/lazarus-operation-dreamjob/109792/

Elastic Security Labs - DPRK Strikes Using a New Variant of Rustbucket

https://www.elastic.co/security-labs/dprk-strikes-using-a-new-variant-of-rustbucket

SentinelOne - KANDYKORN: A New Malware Family Targeting Cryptocurrency Exchanges

https://www.sentinelone.com/labs/kandykorn-a-new-malware-family-targeting-cryptocurrency-exchanges/

Mandiant - AppleJeus: North Korean Cryptocurrency Theft

https://cloud.google.com/blog/topics/threat-intelligence/applejeus-north-korean-cryptocurrency-theft

JPCERT/CC - Lazarus Attack Activities Targeting Japan

https://blogs.jpcert.or.jp/en/2023/10/lazarus-malware.html

Microsoft: ZINC weaponizing open-source software

https://www.microsoft.com/security/blog/2022/10/18/zinc-weaponizing-open-source-software/

North Korean Threat Actor Targets Blockchain Engineers with Poisoned Python Packages

https://www.microsoft.com/en-us/security/blog/2023/11/16/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/

JPCERT/CC Analysis of Lazarus Group Activity Targeting Japan

https://blogs.jpcert.or.jp/en/2023/05/lazarus_dll.html

FBI Flash: North Korean State-Sponsored Cyber Actors Use Maui Ransomware

https://www.ic3.gov/Media/News/2022/220720.pdf

CISA Alert AA23-325A: #StopRansomware: Andariel

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a

FBI Flash Alert: AppleJeus Malware Targeting Cryptocurrency

https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-048a

Mandiant: APT38: Un-usual Suspects

https://cloud.google.com/blog/topics/threat-intelligence/apt38-unusual-suspects

CISA: TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a

Kaspersky: The Lazarus Heist: How North Korea's hackers became the world's greatest bank robbers

https://www.kaspersky.com/about/press-releases/2023_the-lazarus-heist

Microsoft: ZINC targeting cryptocurrency businesses

https://www.microsoft.com/en-us/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe/

ESET: Lazarus Under The Hood

https://www.welivesecurity.com/2023/03/08/lazarus-luring-employees-trojanized-defi-wallet-apps/

KANDYKORN: Multi-stage macOS Malware Targets Cryptocurrency Exchanges

https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn

Lazarus Group Exploits Log4Shell Vulnerability to Deploy RAT

https://www.trendmicro.com/en_us/research/22/a/lazarus-group-exploits-log4shell.html

CISA Advisory on DPRK Cyber Threat to Cryptocurrency Industry

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-074a

CISA Maui Ransomware Analysis

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-187a

SentinelOne - KANDYKORN | North Korean Targeting of macOS Cryptocurrency Trading Applications

https://www.sentinelone.com/labs/kandykorn-north-korean-targeting-of-macos-cryptocurrency-trading-applications/

Microsoft Threat Intelligence - Moonstone Sleet emerges as new North Korean threat actor

https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor/

Mandiant - APT43: North Korean Group Uses Cybercrime to Fund Espionage Operations

https://www.mandiant.com/resources/blog/apt43-north-korea-cybercrime-espionage

Microsoft: ZINC Expands Malware Arsenal with New Capabilities

https://www.microsoft.com/en-us/security/blog/2022/09/29/zinc-weaponizing-open-source-software/

DPRK IT Workers: Exposing a Global Illicit Network

https://www.state.gov/dprk-it-workers-exposing-a-global-illicit-network/

KANDYKORN: A New Malware Strain Targets Blockchain Engineers

https://www.elastic.co/security-labs/KANDYKORN-new-malware-attacks-blockchain-engineers

TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a

DPRK Cryptocurrency Theft and Laundering

https://home.treasury.gov/news/press-releases/sm1774

DPRK IT Workers: Evading Sanctions and Funding Weapons Programs

https://www.mandiant.com/resources/blog/dprk-it-workers-evading-sanctions

Lazarus Group Exploits Log4j for Cryptocurrency Attacks

https://www.ahnlab.com/en/site/securityinfo/secunews/secuNewsView.do?seq=37141

North Korean Threat Actor Targets Blockchain Engineers with Trojanized Crypto Apps

https://www.sentinelone.com/labs/dprk-strikes-using-a-new-variant-of-rustdoor/

Operation Blacksmith: Lazarus Targets Organizations Worldwide Using Novel Telegram-based Malware Written in DLang

https://www.cisco.com/c/en/us/about/press/press-releases/2023/lazarus-targets-organizations-telegram-based-malware.html

KANDYKORN: North Korean Malware Targets macOS Users

https://www.elastic.co/security-labs/KANDYKORN-macos-malware

FBI: TraderTraitor Campaign Targeting Cryptocurrency Sector

https://www.ic3.gov/Media/News/2023/230905.pdf

DPRK Cyber Group Conducts Software Supply Chain Attack

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-263a

Microsoft - Volt Typhoon targets US critical infrastructure

https://www.microsoft.com/en-us/security/blog/2024/04/22/moonstone-sleet-emerges-as-new-north-korean-threat-actor/

Mandiant - AppleJeus: Analysis of North Korea's Cryptocurrency Malware

https://cloud.google.com/blog/topics/threat-intelligence/applejeus-analysis-north-korea-cryptocurrency-malware

CISA: Lazarus Group Malware Targeting Defense Organizations

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a

Microsoft: ZINC Attacks Cryptocurrency Organizations

https://www.microsoft.com/en-us/security/blog/2023/09/14/targeted-attacks-on-cryptocurrency-industry-by-lazarus-group/

Kaspersky: BlueNoroff Financial Attacks

https://securelist.com/bluenoroff-methods-bypass-motw/108383/

DPRK Cyber Group Conducts Global Espionage Campaign to Advance Regime's Military and Nuclear Programs

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-129a

Lazarus Group Targets Software Vendor Using Known Vulnerabilities

https://www.ahnlab.com/global/en/site/securityinfo/secunews/secuNewsView.do?seq=32654

KANDYKORN: Lazarus macOS malware in a three-stage intrusion

https://www.elastic.co/security-labs/KANDYKORN-update

Kaspersky: Andariel Ransomware Operations

https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/107678/

Microsoft: Sapphire Sleet Supply Chain Compromise

https://www.microsoft.com/en-us/security/blog/2024/04/22/sapphire-sleet-north-korea-based-threat-actor-targets-cryptocurrency-sector/

Microsoft: ZINC targeting cryptocurrency exchanges

https://www.microsoft.com/en-us/security/blog/2023/09/14/diamond-sleet-supply-chain-compromise-distributes-a-modified-cyberlink-installer/

Microsoft - ZINC weaponizing open-source software

https://www.microsoft.com/en-us/security/blog/2021/10/28/microsoft-finds-new-elevation-of-privilege-exploit-used-by-zinc-to-target-security-researchers/

Mandiant - APT38: Un-usual Suspects

https://www.mandiant.com/resources/reports/apt38-un-usual-suspects

DPRK Cryptocurrency Theft Indictment - FBI

https://www.fbi.gov/news/press-releases/fbi-and-justice-department-announce-charges-against-north-korean-operatives

Lazarus Group Targeting Blockchain Engineers - Kaspersky

https://securelist.com/lazarus-bluenoroff-methods/109545/

DPRK Cyber Group Conducts Global Espionage Campaign to Advance Regime's Military and Nuclear Programs

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-214a

Microsoft - Moonstone Sleet emerges as new North Korean threat actor

https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks

SentinelOne - KANDYKORN | North Korean Threat Actors Target macOS

https://www.sentinelone.com/blog/kandykorn-north-korean-threat-actors-target-macos/

Mandiant - APT43 North Korean Group Uses Phishing and Malware for Espionage

https://www.mandiant.com/resources/blog/apt43-north-korean-group-uses-cybercrime-to-fund-espionage

Lazarus Group Exploits ManageEngine ServiceDesk Vulnerability

https://www.microsoft.com/en-us/security/blog/2024/07/29/moonstone-sleet-emerges-as-new-north-korean-threat-actor/

Kaspersky: Lazarus Deploys New POOLRAT Backdoor

https://securelist.com/lazarus-on-the-hunt-for-big-game/111403/

Mandiant - APT38: Un-usual Suspects

https://www.mandiant.com/resources/apt38-unusual-suspects

Kaspersky - Andariel evolves to target South Korea with ransomware

https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/

KANDYKORN: North Korean Threat Actor Targets Blockchain Engineers

https://www.elastic.co/security-labs/KANDYKORN-north-korean-threat-actor-targets-blockchain-engineers

JPCERT/CC - Lazarus Group Targets Cryptocurrency Assets

https://blogs.jpcert.or.jp/en/2024/01/lazarus-kmspico.html

SentinelOne - KANDYKORN macOS Malware Analysis

https://www.sentinelone.com/labs/kandykorn-new-macos-malware-family-targets-cryptocurrency-engineers/

Kaspersky - DTrack Activity Targeting Financial Institutions

https://securelist.com/dtrack-targeting-europe-latin-america/107798/

Microsoft Threat Intelligence - North Korean Threat Actor Targets Cryptocurrency Sector

https://www.microsoft.com/en-us/security/blog/2023/11/22/diamond-sleet-supply-chain-compromise-distributes-a-modified-cyberlink-installer/

Microsoft Threat Intelligence: ZINC weaponizing open-source software

https://www.microsoft.com/en-us/security/blog/2022/10/27/zinc-weaponizing-open-source-software/

Kaspersky: Andariel evolves to target South Korean financial organizations and defense industries

https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/105463/

CISA Alert (AA23-144A): North Korean State-Sponsored Cyber Actors Use Maui Ransomware to Target the Healthcare and Public Health Sector

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a

CISA: #StopRansomware Advisory on North Korea State-Sponsored Cyber Actors

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-136a

Kaspersky: BlueNoroff cryptocurrency hunt expands to new platforms

https://securelist.com/bluenoroff-cryptocurrency-hunt/111149/

FBI Flash: TraderTraitor Campaign Targeting Cryptocurrency Industry

https://www.ic3.gov/Media/News/2023/230707.pdf

Kaspersky: Lazarus APT targets macOS users with multi-stage malware

https://securelist.com/lazarus-apt-targets-macos-users/111348/

FBI: TraderTraitor: North Korea's AppleJeus Malware Targeting Cryptocurrency Users

https://www.fbi.gov/news/stories/north-korean-malware-targeting-cryptocurrency

SentinelOne: KANDYKORN - Multi-Stage macOS APT

https://www.sentinelone.com/labs/kandykorn-from-the-lazarus-group/

Microsoft - Tracking Lazy Lazarus cryptocurrency theft techniques

https://www.microsoft.com/en-us/security/blog/2023/07/26/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/

CISA Alert - AppleJeus: Analysis of North Korea's Cryptocurrency Malware

https://www.cisa.gov/news-events/cybersecurity-advisories/aa19-339a

CrowdStrike - LABYRINTH CHOLLIMA Adversary Profile

https://www.crowdstrike.com/adversaries/labyrinth-chollima/

ESET - Lazarus Group: From Bangladesh to Poland

https://www.welivesecurity.com/2019/03/11/gaming-industry-scope-attackers-asia/

KANDYKORN: A New macOS Malware Strain Used by Lazarus

https://www.elastic.co/security-labs/KANDYKORN-lazarus-remote-access-trojan

TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies

https://www.microsoft.com/en-us/security/blog/2023/04/18/multiple-north-korean-threat-actors-exploiting-the-same-vulnerabilities/

Lazarus Group Exploiting Zero-Day Vulnerabilities in MagicLine4NX

https://thehackernews.com/2024/11/lazarus-group-exploits-zero-day.html

Lazarus Group's RustyAttr: New Rust-based Malware Targets Aerospace and Cryptocurrency

https://www.microsoft.com/en-us/security/blog/2024/11/rustyattr-lazarus-group-malware/

Kaspersky: Operation DreamJob - Lazarus Targeting Developers with Malicious npm Packages

https://securelist.com/lazarus-dreamjob-npm-malware/111456/

Mandiant: North Korean Threat Actor Targets Cryptocurrency Industry with Custom Malware

https://cloud.google.com/blog/topics/threat-intelligence/north-korea-cryptocurrency-attacks-2024

Kaspersky: Andariel evolves to target South Korea with ransomware

https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/105330/

ESET: Lazarus Trojanized DeFi Wallet Apps Steal Crypto

https://www.welivesecurity.com/2023/03/20/fake-trading-apps-target-cryptocurrency-users/

SentinelOne: KANDYKORN - Multi-Stage macOS Malware Targets Cryptocurrency Exchanges

https://www.sentinelone.com/labs/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/

Kaspersky: Lazarus Bluenoroff cryptocurrency heists continue

https://securelist.com/lazarus-bluenoroff-cryptocurrency-heists/111716/

SentinelOne: KANDYKORN macOS malware targets cryptocurrency exchanges

https://www.sentinelone.com/blog/combing-through-the-invisible-the-emergence-of-kandykorn-macos-malware/

SentinelOne - KANDYKORN: North Korean Threat Actor Targets macOS Engineers

https://www.sentinelone.com/labs/kandykorn-north-korean-threat-actor-targets-macos-engineers/

CISA: HIDDEN COBRA - FASTCash Campaign

https://www.cisa.gov/news-events/cybersecurity-advisories/aa18-275a

CISA Alert AA25-053A: Lazarus Group Cryptocurrency Theft Tactics

https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-053a

Kaspersky: Andariel Targets South Korean Critical Infrastructure

https://securelist.com/andariel-deploys-dtrack-and-maui-ransomware/109326/

Microsoft - ZINC weaponizing open-source software

https://www.microsoft.com/en-us/security/blog/2021/10/28/microsoft-finds-new-zinc-attack-targeting-media-sector/

Lazarus Group Exploits Zero-Day Vulnerabilities in Supply Chain Attack

https://www.mandiant.com/resources/blog/lazarus-supply-chain-attack

North Korean Lazarus Group Deploys New Malware Targeting Cryptocurrency Firms

https://www.microsoft.com/security/blog/lazarus-group-cryptocurrency-attacks

FBI Flash: AppleJeus Malware Targeting Cryptocurrency Sector

https://www.ic3.gov/Media/News/2021/210421.pdf

Microsoft: ZINC weaponizing open-source software

https://www.microsoft.com/en-us/security/blog/2021/10/28/zinc-weaponizing-open-source-software/

Google TAG: Analysis of a North Korean campaign

https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/

Microsoft Threat Intelligence - ZINC targeting cryptocurrency industry

https://www.microsoft.com/en-us/security/blog/2021/03/02/zinc-attacks-against-security-researchers/

JPCERT/CC Analysis of Lazarus Group DTrack

https://blogs.jpcert.or.jp/en/2023/09/lazarus_attack.html

SentinelOne - KANDYKORN | North Korean Lazarus Group Targets macOS Users

https://www.sentinelone.com/labs/kandykorn-north-korean-lazarus-group-targets-macos-users/

Mandiant - AppleJeus: Analysis of North Korea's Cryptocurrency Malware

https://cloud.google.com/blog/topics/threat-intelligence/applejeus-analysis-cryptocurrency-malware

FBI Flash: AppleJeus: Analysis of North Korea's Cryptocurrency Malware

https://www.ic3.gov/Media/News/2021/210222.pdf

BLINDINGCAN Malware Analysis - CISA

https://www.cisa.gov/news-events/analysis-reports/ar20-232a

Kaspersky Lazarus Threat Intelligence Report 2024

https://securelist.com/lazarus-group-overview/111973/

Microsoft Threat Intelligence: Lazarus Group Targeting

https://www.microsoft.com/en-us/security/blog/threat-intelligence/lazarus-group/

Microsoft: Tracking Lazarus Group Subgroups

https://www.microsoft.com/en-us/security/blog/2024/07/25/diamond-sleet-supply-chain-compromise-distributes-a-modified-cyberlink-installer/

TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies

https://www.sentinelone.com/labs/trading-in-trojans-north-korean-state-sponsored-apt-targets-blockchain-companies/

Lazarus Group Exploiting Log4j Vulnerabilities

https://www.microsoft.com/en-us/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/

CISA Alert: AppleJeus Analysis

https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-232a

Microsoft: ZINC Targeting Cryptocurrency

https://www.microsoft.com/en-us/security/blog/2021/11/18/microsoft-finds-new-elevation-of-privilege-linux-vulnerability-nimbuspwn/

Elastic Security Labs - DPRK Strikes Using a New Variant of POOLRAT

https://www.elastic.co/security-labs/dprk-strikes-using-a-new-variant-of-poolrat

Microsoft - Infamous Lazarus Group Malware Targets macOS

https://www.microsoft.com/en-us/security/blog/2024/02/29/diamond-sleet-supply-chain-compromise-distributes-a-modified-cyberlink-installer

Operation DreamJob: Lazarus Group Targeting Employees with Fake Job Offers

https://www.mandiant.com/resources/blog/lazarus-dream-job-operation

FBI Alert: North Korean State-Sponsored Cyber Actors Targeting Blockchain Companies

https://www.ic3.gov/Media/News/2023/230427.pdf

Microsoft: ZINC weaponizing open-source software

https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/

Microsoft: Tracking North Korea-based threat actors

https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/

Kaspersky: Andariel evolves to target healthcare

https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/111023/

DPRK IT Workers: Evading Justice While Earning Revenue

https://www.mandiant.com/resources/blog/dprk-it-workers-evading-justice

Lazarus Group Exploits Log4Shell Vulnerability

https://www.trendmicro.com/en_us/research/24/a/lazarus-group-exploits-log4shell.html

North Korean Cryptocurrency Theft: 2024 Analysis

https://www.chainalysis.com/blog/north-korea-cryptocurrency-theft-2024/

Operation DreamJob: Targeting Aerospace with POOLRAT

https://www.clearskysec.com/operation-dreamjob-lazarus/

Operation DreamJob: Lazarus Targets Developers in Supply Chain Attack

https://www.mandiant.com/resources/blog/operation-dreamjob-lazarus

KANDYKORN: Lazarus Targets macOS Users

https://www.elastic.co/security-labs/KANDYKORN-malware-family

Microsoft: Lazarus Group Exploits Zero-Days in Chrome and Windows

https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day

DPRK Threat Group Distributes Trojanized Cryptocurrency Applications

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-249a

KANDYKORN: North Korean Lazarus Targets macOS

https://www.elastic.co/security-labs/KANDYKORN-north-korea-lazarus-macos-malware

TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies

https://www.securonix.com/blog/tradertraitor-north-korean-state-sponsored-apt-targets-blockchain-companies/

Microsoft - ZINC targeting cryptocurrency with new tactics

https://www.microsoft.com/en-us/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/

Microsoft Threat Intelligence - ZINC Weaponizing Open-Source Software

https://www.microsoft.com/en-us/security/blog/2021/01/28/zinc-attacks-against-security-researchers/

US-CERT Alert TA17-318A - HIDDEN COBRA – North Korean Trojan: Volgmer

https://www.cisa.gov/news-events/alerts/2017/11/14/hidden-cobra-north-korean-trojan-volgmer

CISA Alert AA20-301A - North Korean Advanced Persistent Threat Focus: Kimsuky

https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-301a

Microsoft Threat Intelligence - ZINC targeting employees with trojanized job applications

https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/

ESET Research - Lazarus APT Group Operations in 2024

https://www.welivesecurity.com/en/eset-research/

FBI Flash Alert - AppleJeus Malware Targeting Cryptocurrency Sector

https://www.ic3.gov/Media/News/2021/210607.pdf

Mandiant - APT38: Cyber Operations Targeting Financial Institutions

https://www.mandiant.com/resources/reports/apt38-details-on-new-north-korean-regime-backed-threat-group

Kaspersky - Andariel evolves to target critical infrastructure

https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/110979/

CISA Alert AA25-032A: #StopRansomware Medusa Ransomware

https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-032a

ESET: Lazarus Group Exploits Zero-Days in Supply Chain Attack

https://www.welivesecurity.com/2023/04/20/these-arent-apps-youre-looking-for-3cx-supply-chain-attack/

Lazarus Group Deploys Medusa Ransomware in Healthcare Attacks - Cisco Talos

https://blog.talosintelligence.com/lazarus-medusa-ransomware/

DPRK Cryptocurrency Theft: 2024 Annual Report - TRM Labs

https://www.trmlabs.com/post/dprk-cryptocurrency-theft-2024

Lazarus Group Exploits Zero-Day in npm Supply Chain Attack - Microsoft Security

https://www.microsoft.com/en-us/security/blog/lazarus-npm-supply-chain

Bybit Hack Attribution to Lazarus Group - Chainalysis

https://www.chainalysis.com/blog/bybit-hack-lazarus-attribution/

Microsoft Threat Intelligence: Diamond Sleet Supply Chain Compromise

https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability

FBI Flash: North Korean Cryptocurrency Theft Schemes

https://www.ic3.gov/Media/News/2023/230516.pdf

Kaspersky: Andariel evolves to target South Korea with ransomware

https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/111354/

SentinelOne: KANDYKORN - North Korean Threat Actor Targets MacOS Users

https://www.sentinelone.com/labs/kandykorn-north-korean-threat-actor-targets-macos-users/

FBI Flash: North Korean State-Sponsored Cyber Actors Use Maui Ransomware

https://www.ic3.gov/Media/News/2022/220713.pdf

KANDYKORN: Lazarus Group Weaponizes Discord to Target Cryptocurrency Sector

https://www.elastic.co/security-labs/elastic-security-labs-discovers-the-kandykorn-malware

FBI Cyber Division - AppleJeus Malware Analysis

https://www.cisa.gov/news-events/alerts/2021/04/15/apple-releases-security-updates-multiple-products

Microsoft - ZINC weaponizing open-source software

https://www.microsoft.com/en-us/security/blog/2022/10/27/how-zinc-weaponizes-open-source-software/

DPRK Threat Actor Targets Cryptocurrency Sector with KANDYKORN Malware

https://www.elastic.co/security-labs/dprk-threat-actor-targets-cryptocurrency-sector-with-kandykorn

Lazarus Group Exploits Log4j for Initial Access

https://www.cisco.com/c/en/us/products/security/talos/lazarus-log4j.html

CISA Alert: North Korean State-Sponsored Cyber Actors

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-251a

North Korean Lazarus Group Exploits Log4j Vulnerability

https://www.mandiant.com/resources/blog/north-korea-lazarus-log4j-exploit

KANDYKORN: North Korean Threat Actors Target macOS

https://www.elastic.co/security-labs/KANDYKORN-disrupting-part-of-the-software-supply-chain

Lazarus Group's Infrastructure Reuse Leads to Discovery of New Malware

https://www.welivesecurity.com/2023/04/20/linux-malware-strengthens-links-lazarus-3cx-supply-chain-attack/

Tracking Lazarus Group's Deployment of Ransomware Against Healthcare

https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-families-of-lazarus-group

DPRK IT Workers: Assessing the Threat to Global Finance

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-187a

KANDYKORN: Navigating the Complex Landscape of Lazarus APT

https://www.elastic.co/security-labs/KANDYKORN-navigating-the-complex-landscape

North Korea-Linked Lazarus Group Targets Cryptocurrency Platforms

https://www.fbi.gov/news/press-releases/fbi-warns-of-malicious-activity-by-dprk-cyber-actors

Mandiant: AppleJeus Malware Targets Cryptocurrency Exchanges

https://cloud.google.com/blog/topics/threat-intelligence/lazarus-group-cryptocurrency-exchange

Kaspersky: Andariel deploys DTrack and Maui ransomware

https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/107533/

Mandiant: APT43: North Korean Group Moonlighting as Cybercriminals

https://www.mandiant.com/resources/blog/apt43-north-korean-group-cybercriminals

FBI Flash: TraderTraitor Malware Targeting Cryptocurrency Industry

https://www.ic3.gov/Media/News/2023/230515.pdf

Lazarus Group's Blockchain Supply Chain Attacks

https://www.mandiant.com/resources/blog/lazarus-3cx-supply-chain

AppleJeus: Lazarus Targets Cryptocurrency Exchanges

https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-106a

Tracking Lazarus Group's Deployment of Ransomware

https://www.microsoft.com/en-us/security/blog/2022/11/03/dev-0237-shifts-to-ransomware

Microsoft: Sapphire Sleet Uses Job Lures to Target Cryptocurrency Professionals

https://www.microsoft.com/en-us/security/blog/2024/04/22/sapphire-sleet-uses-job-lures-to-target-cryptocurrency-professionals/

Kaspersky: Lazarus Deploying Fake Cryptocurrency Apps to Steal Funds

https://securelist.com/lazarus-cryptocurrency-malware-2024/111234/

ESET: Lazarus Group Supply Chain Attack on 3CX

https://www.welivesecurity.com/2023/03/30/lazarus-supply-chain-attack-3cx-desktop-app/

Lazarus Group Exploiting Log4Shell Vulnerability - Microsoft Threat Intelligence

https://www.microsoft.com/en-us/security/blog/2022/04/13/dismantling-zloader-how-malicious-ads-led-to-disabled-security-tools-and-ransomware/

Operation DreamJob: Lazarus Targeting Developers - ESET Research

https://www.welivesecurity.com/2020/08/13/lazarus-group-targets-employees-using-job-offers/

Lazarus Exploiting Zero-Day in MagicLine4NX - AhnLab ASEC

https://asec.ahnlab.com/en/category/threat-intelligence/

Kaspersky - Lazarus Cryptocurrency Heists: Following the Money

https://securelist.com/lazarus-cryptocurrency-heists/110297/

FBI Flash: TraderTraitor Targets Cryptocurrency Industry

https://www.ic3.gov/Media/News/2023/230216.pdf

Kaspersky: Lazarus targets defense industry with ThreatNeedle

https://securelist.com/lazarus-threatneedle/100803/

FBI Flash: AppleJeus Malware Targeting Cryptocurrency Industry

https://www.ic3.gov/Media/News/2023/230616.pdf

Kaspersky: Lazarus targets macOS users with malicious cryptocurrency apps

https://securelist.com/bluenoroff-strikes-again-with-new-methods/111255/

Lazarus Group Exploits Zero-Day Vulnerability in Google Chrome

https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/

North Korean Threat Actors Deploy New Malware Families

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a

Microsoft: ZINC weaponizing open-source software

https://www.microsoft.com/en-us/security/blog/2022/10/18/microsoft-discovers-multiple-variants-of-malicious-npm-packages-targeting-azure-developer-accounts/

US Treasury: OFAC Identifies Over 280 Cryptocurrency Addresses Associated with DPRK Cyber Actors

https://home.treasury.gov/news/press-releases/sm0127

KANDYKORN: North Korean Threat Actors Target macOS Users

https://www.elastic.co/security-labs/elastic-security-labs-discovers-first-malware-persistence-technique-evasion-of-macos-xprotect

3CX Supply Chain Attack: Detection & Response

https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software/

Lazarus Group's MagicRAT Campaign

https://www.cisco.com/c/en/us/products/security/talos/blog/magicrat.html

Kaspersky: Lazarus targets macOS users with KANDYKORN

https://securelist.com/lazarus-kandykorn-macos/111262/

FBI Flash: Maui Ransomware Targeting the Healthcare and Public Health Sector

https://www.ic3.gov/Media/News/2022/220706.pdf

Microsoft Threat Intelligence - ZINC APT Group Profile

https://www.microsoft.com/en-us/security/blog/threat-intelligence/actor/zinc/

SentinelOne - KANDYKORN | North Korean Threat Actors Target Blockchain Engineers

https://www.sentinelone.com/labs/kandykorn-north-korean-threat-actors-target-blockchain-engineers/

SentinelOne - DPRK Strikes Using a New Variant of the POOLRAT Trojan

https://www.sentinelone.com/labs/dprk-strikes-using-a-new-variant-of-poolrat/

ESET: Lazarus supply‑chain attack in South Korea

https://www.welivesecurity.com/2023/04/20/lazarus-luring-employees-trojanized-defi-wallet-apps/

CISA Alert: Hidden Cobra North Korean Malicious Cyber Activity

https://www.cisa.gov/news-events/alerts/2017/06/13/hidden-cobra-north-korean-malicious-cyber-activity

Elastic Security Labs - DPRK strikes using a new variant of KANDYKORN

https://www.elastic.co/security-labs/dprk-strikes-using-a-new-variant-of-kandykorn

DPRK Cryptocurrency Theft and the Bybit Hack

https://www.mandiant.com/resources/blog/dprk-cryptocurrency-theft-bybit

CISA - DPRK Cyber Threat Overview and Advisories

https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/north-korea

SentinelOne - Lazarus Group's Ongoing Supply Chain Attacks

https://www.sentinelone.com/labs/tracking-bluenoroff-north-koreas-cryptocurrency-campaign

Kaspersky Report on Lazarus BlueNoroff Cryptocurrency Attacks

https://securelist.com/bluenoroff-apt-targets-cryptocurrency-startups/109346/

CISA Alert AA23-347A - #StopRansomware: Andariel

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a

Microsoft - Tracking Lazarus Group's cryptocurrency theft campaigns

https://www.microsoft.com/en-us/security/blog/2023/11/22/tracking-lazarus-groups-cryptocurrency-theft-campaigns/

ESET - Lazarus macOS malware KANDYKORN

https://www.welivesecurity.com/2023/10/30/lazarus-luring-employees-trojanized-pdf-software/

Microsoft Threat Intelligence: ZINC APT Group Analysis

https://www.microsoft.com/en-us/security/blog/tag/zinc/

Lazarus Group exploits Log4j vulnerability to deploy new RAT malware

https://www.microsoft.com/en-us/security/blog/2022/07/26/north-korean-threat-actor-targets-small-and-midsize-businesses-with-h0lygh0st-ransomware/

Lazarus Group Campaign Targeting Cryptocurrency Sector with COVERTCATCH

https://www.sentinelone.com/labs/

CISA: AppleJeus - Analysis of North Korea's Cryptocurrency Malware

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-131a

FBI Flash: BeagleBoyz Targeting Financial Institutions

https://www.ic3.gov/Media/News/2020/201006.pdf

KANDYKORN: Multi-Stage macOS Malware Used in Cryptocurrency Exchange Attack

https://www.elastic.co/security-labs/KANDYKORN-macos-malware-analysis

AppleJeus: Lazarus Group Cryptocurrency Malware Campaign

https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a

Lazarus Group Deploys MagicRAT in Energy Sector Attacks

https://www.welivesecurity.com/2023/03/23/lazarus-magicrat-energy-sector/

TraderTraitor: Lazarus Targets Blockchain Companies with macOS Malware

https://www.jamf.com/blog/tradertraitor-lazarus-targets-blockchain/

DPRK Cyber Actors Target Cryptocurrency Industry with AppleJeus

https://www.us-cert.gov/ncas/alerts/TA18-275A

ESET: Lazarus group deploys its largest offensive against cryptocurrency businesses

https://www.welivesecurity.com/2023/03/20/applejeus-desktop-job-offers-cryptocurrency-industry/

US-CERT Alert on Hidden Cobra

https://www.cisa.gov/uscert/ncas/alerts/TA17-318A

Microsoft: Lazarus Group Cryptocurrency Threats

https://www.microsoft.com/en-us/security/blog/2023/04/18/multiple-north-korean-threat-actors-target-the-cryptocurrency-industry/

FBI Flash: AppleJeus Malware Analysis

https://www.ic3.gov/Media/News/2021/210331.pdf

Microsoft: ZINC weaponizing open-source software

https://www.microsoft.com/en-us/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/

SentinelOne - KANDYKORN | North Korean Malware Targets macOS Users

https://www.sentinelone.com/blog/kandykorn-north-korean-malware-targets-macos-users/

CISA Alert AA23-130A - AppleJeus: Analysis of North Korea's Cryptocurrency Malware

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-130a

Kaspersky - Andariel evolves to target critical infrastructure

https://securelist.com/andariel-evolves-to-target-critical-infrastructure/111354/

Mandiant - APT43 North Korean Group Targeting US Organizations

https://www.mandiant.com/resources/blog/apt43-north-korean-group-intelligence-gathering

Microsoft - ZINC weaponizing open-source software

https://www.microsoft.com/en-us/security/blog/2021/10/18/open-source-packages-enable-open-season-for-attackers/

Kaspersky - The Lazarus group and the Bybit hack

https://securelist.com/lazarus-group-bybit-hack/115114/

FBI Flash: AppleJeus: Analysis of North Korea's Cryptocurrency Malware

https://www.ic3.gov/Media/News/2021/210216.pdf

Microsoft Threat Intelligence: ZINC Weaponizing Open Source Software

https://www.microsoft.com/en-us/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/

Microsoft - ZINC weaponizing open-source software

https://www.microsoft.com/en-us/security/blog/2021/10/28/microsoft-finds-new-elevation-of-privilege-linux-vulnerability-nimbuspwn/

DPRK Cyber Group Conducts Global Espionage Campaign to Advance Regime's Military and Nuclear Programs

https://media.defense.gov/2024/Jul/25/2003498683/-1/-1/0/CSA-DPRK-CYBER-GROUP-CONDUCTS-GLOBAL-ESPIONAGE.PDF

Lazarus Group's Newest Campaign Targeting Crypto Industry

https://securelist.com/lazarus-tradertrator-1/111714/

KANDYKORN: A New macOS Malware Used by DPRK Actors to Target Blockchain Engineers

https://www.elastic.co/security-labs/KANDYKORN-malware-attributed-to-lazarus-group

TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies

https://www.sentinelone.com/labs/tradertraitor-north-korean-state-sponsored-apt-targets-blockchain-companies/

KANDYKORN: North Korean Threat Actor Targets Cryptocurrency Engineers with Malicious Python Application

https://www.elastic.co/security-labs/kandykorn-north-korean-threat-actor-targets-cryptocurrency-engineers

North Korean Hackers Suspected in $1.5 Billion Bybit Crypto Heist

https://www.wired.com/story/north-korea-bybit-hack/

DPRK IT Workers: Concealing Identities to Gain Employment

https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-216a

Microsoft: ZINC/Lazarus Group Targeting Cryptocurrency

https://www.microsoft.com/en-us/security/blog/2022/09/29/zinc-targeting-cryptocurrency-users-with-trojanized-defi-apps/

FBI Flash: AppleJeus Malware Analysis

https://www.ic3.gov/Media/News/2021/210126.pdf

Elastic Security Labs: DPRK Strikes Using a New Variant of RustDoor

https://www.elastic.co/security-labs/dprk-strikes-using-a-new-variant-of-rustdoor

Microsoft Digital Defense Report - Lazarus cryptocurrency targeting

https://www.microsoft.com/en-us/security/business/threat-intelligence/threat-actor-overview

Microsoft Threat Intelligence: Diamond Sleet supply chain compromise distributes malicious npm packages

https://www.microsoft.com/en-us/security/blog/2024/10/17/diamond-sleet-supply-chain-compromise-distributes-malicious-npm-packages/

Google TAG: Active North Korean campaign targeting security researchers

https://blog.google/threat-analysis-group/active-north-korean-campaign-targeting-security-researchers/

Kaspersky: The Lazarus Heist - Hunting for the cryptocurrency

https://securelist.com/lazarus-cryptocurrency/112903/

ESET: Lazarus Backdoor in macOS cryptocurrency trading application

https://www.welivesecurity.com/2023/11/07/kandykorn-lazarus-macos-malware-campaign/

SentinelOne - KANDYKORN | North Korean Lazarus Group Targets macOS Users

https://www.sentinelone.com/blog/kandykorn-north-korean-lazarus-group-targets-macos-users/

KANDYKORN: A Multistage macOS Trojan Targeting Cryptocurrency Engineers

https://www.elastic.co/security-labs/kandykorn-a-multistage-macos-trojan

Lazarus Group Exploits Zero-Day Vulnerabilities in Supply Chain Attacks

https://www.kaspersky.com/about/press-releases/2023_lazarus-targets-defense-industry-via-supply-chain-attack

DPRK Cyber Group Conducts Software Supply Chain Attack on Security Company

https://www.mandiant.com/resources/blog/north-korea-supply-chain

Lazarus Group Exploits Zero-Day Vulnerability in MagicLine4NX

https://asec.ahnlab.com/en/60168/

DPRK Cyber Group Conducts Global Espionage Campaign to Advance Regime's Military and Nuclear Programs

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-144a

Mandiant: DPRK Cyber Group Targeting Global Cryptocurrency Industry

https://www.mandiant.com/resources/blog/dprk-cryptocurrency-malware

Kaspersky: Lazarus Trojanized DeFi Wallet Apps

https://securelist.com/lazarus-trojanized-defi-wallet/108458/

SentinelOne: KANDYKORN macOS malware targets cryptocurrency engineers

https://www.sentinelone.com/labs/kandykorn-north-koreas-latest-swift-campaign/

Lazarus Group Exploits npm Packages to Target Blockchain Developers

https://www.mandiant.com/resources/blog/lazarus-npm-blockchain-developers

North Korean Threat Actor Conducts Large-Scale npm Supply Chain Attack

https://blog.phylum.io/north-korean-threat-actor-conducts-large-scale-supply-chain-attack/

POOLRAT: A Fresh Lure by Lazarus

https://www.genians.co.kr/blog/threat_intelligence_report_poolrat

Lazarus Group's $1.5 Billion Bybit Heist: Technical Analysis

https://www.recordedfuture.com/lazarus-group-bybit-cryptocurrency-heist

APT38: Financial Motivation Behind North Korean Cyber Operations

https://cloud.google.com/blog/topics/threat-intelligence/apt38-financial-cyber-operations

Microsoft Threat Intelligence: Lazarus Group targeting cryptocurrency sector

https://www.microsoft.com/en-us/security/blog/2024/04/22/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/

Kaspersky: Andariel Ransomware Attacks on Healthcare

https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/110851/

ESET Research: Lazarus Group exploits Log4Shell vulnerability

https://www.welivesecurity.com/2022/04/12/when-log4shell-met-lazarus-threat-actors/

Microsoft Threat Intelligence: ZINC Weaponizing Open-Source Software

https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/

KANDYKORN: North Korean Threat Actors Target Blockchain Engineers

https://www.elastic.co/security-labs/KANDYKORN-macos-malware-targets-blockchain-engineers

Lazarus Group exploiting Log4j vulnerability

https://www.trendmicro.com/en_us/research/22/a/new-campaign-uses-log4j-exploit-to-distribute-new-modular-backdoor.html

Lazarus Group Exploits Zero-Day Vulnerability in MagicLine4NX

https://www.ahnlab.com/en/asecissue/asec-report/

Lazarus Group Uranium Campaign Targets Energy and Cryptocurrency Sectors

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-cryptocurrency-energy

North Korean Threat Actor Targets Blockchain Companies with Multi-Stage Attack

https://www.sentinelone.com/labs/comrades-in-arms-north-korea-and-russia-share-more-than-just-a-border/

SentinelOne: KANDYKORN macOS Malware Analysis

https://www.sentinelone.com/labs/kandykorn-a-new-macos-malware-from-lazarus-group/

COVERTCATCH: North Korean Threat Actor Targets Defense Sector - SentinelOne

https://www.sentinelone.com/labs/covertcatch-north-korean-threat-actor-targets-defense-sector/

Lazarus Group Exploits Log4Shell in VMware Horizon Servers - AhnLab

https://asec.ahnlab.com/en/63997/

Lazarus Group's Supply Chain Attack via MISTPEN - Kaspersky

https://securelist.com/lazarus-supply-chain-attack-via-nxftp/111481/

North Korea's Lazarus APT leverages Windows Update client in latest campaign - Cisco Talos

https://blog.talosintelligence.com/lazarus-quiterat/

DPRK Threat Actor Targets Cryptocurrency Industry with Hidden Risk

https://www.mandiant.com/resources/blog/dprk-hidden-risk

North Korean Hackers Deploy New MagicRAT Malware in Targeted Attacks

https://www.cisecurity.org/insights/blog/north-korean-apt-group-lazarus-targets-organizations-with-magicrat

DPRK Threat Actor Targets Blockchain Industry with Hidden Risk Malware

https://www.sentinelone.com/labs/dprk-threat-actor-targets-blockchain-industry-with-hidden-risk-malware/

North Korean Lazarus Group Exploits Zero-Day in Supply Chain Attack

https://blog.google/threat-analysis-group/north-korean-lazarus-group-exploits-zero-day/

CISA Alert AA24-060A: Lazarus Group Exploiting Log4Shell

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060a

Microsoft: North Korean Threat Actors Targeting Cryptocurrency

https://www.microsoft.com/en-us/security/blog/2023/04/18/nation-state-threat-actor-mint-sandstorm-refines-tradecraft-to-attack-high-value-targets/

Lazarus Group Supply Chain Attack via npm Packages

https://blog.phylum.io/sophisticated-ongoing-attack-discovered-on-npm

KANDYKORN: Lazarus Targeting macOS

https://www.elastic.co/security-labs/KANDYKORN-report

Microsoft Threat Intelligence - ZINC weaponizing open-source software

https://www.microsoft.com/en-us/security/blog/2021/08/18/tracking-a-zinc-campaigns-to-weaponize-open-source-software/

ESET Research - Lazarus Targets Chemical Sector

https://www.welivesecurity.com/2023/01/05/stuck-coda-lazarus-andariel-exploit-log4shell/

Kaspersky - BlueNoroff's evolving arsenal

https://securelist.com/bluenoroffs-rustyatlas-targets-cryptocurrency-organizations/111204/

Microsoft Threat Intelligence: ZINC attacks against security researchers

https://www.microsoft.com/security/blog/2021/01/28/zinc-attacks-against-security-researchers/

Microsoft: ZINC targets cryptocurrency industry

https://www.microsoft.com/security/blog/2021/11/18/zinc-pursuing-cryptocurrency-targets-through-supply-chain-attacks/

Mandiant: APT38 Financial Motivation

https://www.mandiant.com/resources/apt38-details-on-new-north-korean-regime-backed-threat-group

SentinelOne: KANDYKORN macOS malware analysis

https://www.sentinelone.com/blog/kandykorn-north-korean-malware-targeting-blockchain-engineers/

DPRK Cryptocurrency Theft and Laundering Activity - FBI Cybersecurity Advisory

https://www.fbi.gov/news/press-releases/fbi-and-partners-issue-cybersecurity-advisory-on-democratic-peoples-republic-of-korea-cryptocurrency-theft-and-laundering

Recorded Future: Lazarus Group's Cryptocurrency Heist Tradecraft

https://www.recordedfuture.com/research/north-korea-cryptocurrency-thefts

SentinelOne - KANDYKORN | North Korean Threat Actors Targeting Blockchain Engineers

https://www.sentinelone.com/labs/kandykorn-north-korean-threat-actors-targeting-blockchain-engineers

Lazarus Group Exploits Log4j to Deploy Novel RAT Families - Cisco Talos

https://blog.talosintelligence.com/lazarus-three-rats/

DPRK Cyber Group Conducts Global Espionage Campaign - CISA Alert AA24-057A

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-057a

Operation Dream Job: Lazarus Targets Developers with Malicious npm Packages - ReversingLabs

https://www.reversinglabs.com/blog/lazarus-group-npm-supply-chain

SentinelOne: Lazarus macOS malware targeting cryptocurrency users

https://www.sentinelone.com/labs/bluenoroff-apt-targets-macos-with-rustbucket-malware/