Cybersecurity articles tagged #DPRK on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/north-korean-job-fraud-expands-beyond-it-new-sectors-targetedhttps://runtimerebel.com/blog/north-korean-job-fraud-expands-beyond-it-new-sectors-targetedDPRK-linked threat actors are expanding job fraud beyond IT into healthcare, sales, and finance, leveraging AI and fake identities to fund illicit programs.Tue, 01 Sep 2026 02:38:21 GMTDPRKNorth KoreaInsider ThreatAIJob Fraudhttps://runtimerebel.com/blog/critical-rust-arrayref-crate-poisoned-with-infostealer-malwarehttps://runtimerebel.com/blog/critical-rust-arrayref-crate-poisoned-with-infostealer-malwareHackers compromised `arrayref`, `append-only-vec`, and `internment` Rust crates to inject infostealer malware, impacting developers and downstream projects.Fri, 21 Aug 2026 00:43:46 GMTRustSupply Chain AttackInfostealerDPRKCrates Iohttps://runtimerebel.com/blog/dprk-linked-macos-malvertising-uses-fake-updates-for-crypto-thefthttps://runtimerebel.com/blog/dprk-linked-macos-malvertising-uses-fake-updates-for-crypto-theftNorth Korean threat actors are using deceptive full-screen macOS update pages to distribute crypto-stealing malware in a new Contagious Interview campaign.Thu, 30 Jul 2026 21:11:51 GMTmacOSLazarus GroupMalvertisingCryptocurrencyDPRKhttps://runtimerebel.com/blog/ai-generated-npm-supply-chain-attack-dprk-exploits-claude-opushttps://runtimerebel.com/blog/ai-generated-npm-supply-chain-attack-dprk-exploits-claude-opusNorth Korean actors leverage LLMs like Claude Opus to insert malicious npm packages into developer workflows, leading to RCE and data theft via @validate-sdk/v2.Wed, 29 Apr 2026 16:38:11 GMTDPRKLazarus GroupNPMMalwareClaude Opushttps://runtimerebel.com/blog/lazarus-group-s-2b-crypto-theft-defending-against-supply-chain-attackshttps://runtimerebel.com/blog/lazarus-group-s-2b-crypto-theft-defending-against-supply-chain-attacksAn analysis of Lazarus Group's persistent and financially motivated cyber operations, highlighting over $2B in crypto theft and critical supply chain attack risks.Tue, 28 Apr 2026 16:47:53 GMTLazarus GroupDPRKCryptocurrency TheftSupply Chain AttackFinancial CybercrimeAPThttps://runtimerebel.com/blog/dprk-s-contagious-interview-spreads-rats-via-dev-repositorieshttps://runtimerebel.com/blog/dprk-s-contagious-interview-spreads-rats-via-dev-repositoriesDPRK threat actors are employing a 'contagious interview' scam, weaponizing compromised developer repositories to propagate RATs and malware across the software supply…Wed, 22 Apr 2026 20:27:05 GMTDPRKLazarus GroupFake Job ScamRATSoftware Supply ChainSocial EngineeringDeveloper Compromisehttps://runtimerebel.com/blog/dprk-it-worker-laptop-farms-u-s-nationals-sentenced-for-fraudhttps://runtimerebel.com/blog/dprk-it-worker-laptop-farms-u-s-nationals-sentenced-for-fraudTwo U.S. residents sentenced for operating laptop farms that enabled North Korean IT workers to defraud Fortune 500 companies using stolen identities.Thu, 16 Apr 2026 08:40:47 GMTDPRKLaptop FarmInsider ThreatIdentity TheftLazarus Grouphttps://runtimerebel.com/blog/dprk-hackers-abuse-github-infrastructure-for-c2-in-south-koreahttps://runtimerebel.com/blog/dprk-hackers-abuse-github-infrastructure-for-c2-in-south-koreaNorth Korean state-sponsored actors are leveraging GitHub as a command-and-control platform in complex multi-stage attacks targeting South Korean organizations.Mon, 06 Apr 2026 20:17:41 GMTDPRKLazarus GroupGitHub C2South KoreaLNKPowerShellhttps://runtimerebel.com/blog/dprk-social-engineering-behind-285-million-drift-hack-analysishttps://runtimerebel.com/blog/dprk-social-engineering-behind-285-million-drift-hack-analysisA deep dive into the six-month DPRK social engineering operation targeting Drift protocol, resulting in a $285 million Solana-based cryptocurrency theft.Sun, 05 Apr 2026 20:11:07 GMTDPRKLazarus GroupDrift ProtocolSocial EngineeringSolanaCryptocurrency Thefthttps://runtimerebel.com/blog/teampcp-supply-chain-cert-eu-confirms-cloud-breach-1000-saas-environments-affectedhttps://runtimerebel.com/blog/teampcp-supply-chain-cert-eu-confirms-cloud-breach-1000-saas-environments-affectedCERT-EU confirms European Commission cloud breach via TeamPCP supply chain campaign. Mandiant identifies over 1,000 compromised SaaS environments.Fri, 03 Apr 2026 16:19:26 GMTTeamPCPSupply Chain AttackCloud SecuritySaaSEuropean CommissionDPRKhttps://runtimerebel.com/blog/drift-protocol-hacked-for-285m-via-durable-nonce-attackhttps://runtimerebel.com/blog/drift-protocol-hacked-for-285m-via-durable-nonce-attackSolana-based DEX Drift Protocol lost $285 million due to a social engineering and durable nonce attack, leading to Security Council takeover.Fri, 03 Apr 2026 12:21:37 GMTDrift ProtocolSolanaDurable NonceSocial EngineeringDPRKCryptocurrencyDeFihttps://runtimerebel.com/blog/ofac-sanctions-dprk-it-worker-network-funding-wmd-programshttps://runtimerebel.com/blog/ofac-sanctions-dprk-it-worker-network-funding-wmd-programsUS Treasury sanctions North Korea's IT worker network used to fund WMD programs. Learn how these actors use fake identities and how to secure remote hiring.Wed, 18 Mar 2026 20:15:49 GMTDPRKOFACLazarus GroupSanctionsIT Worker Schemehttps://runtimerebel.com/blog/sentenced-ukrainian-national-facilitated-dprk-it-worker-infrastructurehttps://runtimerebel.com/blog/sentenced-ukrainian-national-facilitated-dprk-it-worker-infrastructureOleksandr Didenko sentenced to five years for orchestrating an identity laundering scheme that enabled North Korean operatives to infiltrate Western corporate networks.Mon, 23 Feb 2026 16:26:29 GMTDPRKIdentity TheftRemote Work FraudInsider ThreatLazarus Group