ZCyberNews
中文

#north-korea

11 articles

Across cryptocurrency, technology, financial services, software development, and finance, 11 articles published between 13 April and 8 October 2026 examine North Korea-linked activity affecting Global, Asia, Europe, North America, and China. Lazarus Group, Alluring Pisces, and APT37 each appear among the tracked threat actors. The severity mix comprises nine high and one critical item, reflecting sustained targeting of digital-asset and financial infrastructure alongside software supply chains. Coverage spans intrusions, campaigns, and sector-specific incidents attributed to these distinct groups, with cryptocurrency and financial services recurring most often across the reporting period.

Diagram of a software supply chain attack path from a poisoned package to a cloud management console, with a smart contract acting as command-and-control.
Malware

Web3 C2 Powers Cloud Supply Chain Attacks, Unit 42 Finds

Unit 42: ChainDrop npm worm hit 400+ packages and PolinRider spans npm, Go, Packagist, using smart-contract C2 to steal cloud IAM keys and CI/CD tokens.

4 min readAlluring Pisces
APT37 Targets Ethnic Koreans in China With Android BirdCall MalwareHIGH
Malware

APT37 Targets Ethnic Koreans in China With Android BirdCall Malware

ESET says APT37 compromised Sqgame card game platform to deliver BirdCall backdoor to Android devices, stealing SMS, call logs, and private keys from ethnic Koreans in Yanbian.

4 min readAPT37
North Korea Laundered 76% of All Stolen Crypto in 2026CRITICAL
Threat Intel

North Korea Laundered 76% of All Stolen Crypto in 2026

North Korean hackers laundered 76% of all stolen cryptocurrency in 2026 — $2.3 billion — per Chainalysis.

3 min readLazarus Group
BlueNoroff Fakes Zoom Calls to Lure Crypto ExecsHIGH
Threat Intel

BlueNoroff Fakes Zoom Calls to Lure Crypto Execs

BlueNoroff uses stolen video, AI avatars, and fake Zoom invites to turn crypto executives into attack lures.

3 min readBlueNoroff
Lazarus Hijacks macOS via ClickFix to Target ExecutivesHIGH
Threat Intel

Lazarus Hijacks macOS via ClickFix to Target Executives

Lazarus APT uses ClickFix social engineering to deliver macOS malware — fake browser update prompts trick executives into running AppleScript payloads that steal credentials and…

2 min readLazarus Group
North Korean Hackers Steal $12 Million in Crypto via TrojanizedHIGH
Malware

North Korean Hackers Steal $12 Million in Crypto via Trojanized

North Korean hackers siphoned over $12 million from crypto users in Q1 2026 using trojanized trading apps like CoinStats and TradingView AI Agent to steal recovery phrases and…

2 min readLazarus Group
North Korean Fake Job Scams Spread Malware via 'Contagious Interview'HIGH
Threat Intel

North Korean Fake Job Scams Spread Malware via 'Contagious Interview'

North Korean operatives use a 'contagious interview' tactic, where a compromised developer's GitHub repo spreads RATs to other job seekers.

3 min readLazarus Group
North Korean Operatives Use AI and Fake Identities to Infiltrate Companies viaHIGH
Threat Intel

North Korean Operatives Use AI and Fake Identities to Infiltrate Companies via

North Korean operatives are using AI tools and forged documents to pass remote job interviews, according to Flare research. The tactic aims to place threat actors inside target companies for long-term espionage and network access.

3 min readNorth Korean operatives
UNC1069 Targets Crypto Professionals with Fake Zoom and Teams MeetingsHIGH
Threat Intel

UNC1069 Targets Crypto Professionals with Fake Zoom and Teams Meetings

North Korean threat actor UNC1069 lures Web3 professionals with fake Zoom and Microsoft Teams meetings to deploy malware that steals cryptocurrency, according to new research.

3 min readUNC1069
Sapphire Sleet Targets macOS Users with Fake Zoom SDK UpdateHIGH
Threat Intel

Sapphire Sleet Targets macOS Users with Fake Zoom SDK Update

North Korean threat actor Sapphire Sleet is distributing a new macOS malware via a fake Zoom SDK installer, stealing passwords, crypto wallets, and personal data through a multi-stage social engineering campaign.

4 min readSapphire Sleet
APT37 Targets Individuals via Facebook to Deploy RokRAT MalwareHIGH
Threat Intel

APT37 Targets Individuals via Facebook to Deploy RokRAT Malware

North Korea's APT37 group is conducting a social engineering campaign on Facebook, using fake profiles to build trust and deliver the RokRAT remote access trojan to targeted individuals.

4 min readAPT37 (ScarCruft, InkySquid)

Stay Updated

Get the latest cybersecurity news delivered to your inbox.