Cybersecurity articles tagged #Lazarus Group on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/microsoft-august-2026-patch-tuesday-398-flaws-and-zero-dayhttps://runtimerebel.com/blog/microsoft-august-2026-patch-tuesday-398-flaws-and-zero-dayMicrosoft patches 398 flaws in August 2026, including an actively exploited Windows kernel driver zero-day and four critical RCE vulnerabilities.Wed, 12 Aug 2026 01:05:21 GMTWindowsSharePointZero-DayLazarus GroupCVE-2026-68820https://runtimerebel.com/blog/dprk-linked-macos-malvertising-uses-fake-updates-for-crypto-thefthttps://runtimerebel.com/blog/dprk-linked-macos-malvertising-uses-fake-updates-for-crypto-theftNorth Korean threat actors are using deceptive full-screen macOS update pages to distribute crypto-stealing malware in a new Contagious Interview campaign.Thu, 30 Jul 2026 21:11:51 GMTmacOSLazarus GroupMalvertisingCryptocurrencyDPRKhttps://runtimerebel.com/blog/bluenoroff-zoom-phishing-kit-targets-crypto-walletshttps://runtimerebel.com/blog/bluenoroff-zoom-phishing-kit-targets-crypto-walletsBlueNoroff uses a custom phishing kit to profile crypto wallets before delivering malware through impersonated Zoom and Microsoft Teams platforms.Fri, 24 Jul 2026 17:39:06 GMTBlueNoroffLazarus GroupCryptocurrency TheftClickFixPhishinghttps://runtimerebel.com/blog/north-korean-actors-use-svg-steganography-to-deliver-ottercookiehttps://runtimerebel.com/blog/north-korean-actors-use-svg-steganography-to-deliver-ottercookieNorth Korean threat actors are hiding OtterCookie malware in SVG flag images within fake coding tests to target developers and steal cryptocurrency.Fri, 17 Jul 2026 17:13:52 GMTLazarus GroupOtterCookieContagious InterviewSteganographyNode JsInfostealerhttps://runtimerebel.com/blog/polinrider-north-korean-hackers-push-108-malicious-packageshttps://runtimerebel.com/blog/polinrider-north-korean-hackers-push-108-malicious-packagesAnalysis of the PolinRider campaign where North Korean actors published 108 malicious packages and extensions across npm, Go, and Chrome ecosystems.Sat, 04 Jul 2026 13:37:02 GMTPolinRiderLazarus GroupNPMChrome Web StoreSupply Chain AttackNorth Koreahttps://runtimerebel.com/blog/north-korean-sapphire-sleet-compromises-140-mastra-ai-npm-packageshttps://runtimerebel.com/blog/north-korean-sapphire-sleet-compromises-140-mastra-ai-npm-packagesMicrosoft attributes the Mastra AI supply chain attack to Sapphire Sleet (BlueNoroff), involving 140+ malicious npm packages targeting AI developers.Sat, 20 Jun 2026 16:38:13 GMTSapphire SleetBlueNoroffMastra AINPMSupply Chain AttackLazarus Grouphttps://runtimerebel.com/blog/chinese-and-north-korean-apt-activity-surges-across-apac-marketshttps://runtimerebel.com/blog/chinese-and-north-korean-apt-activity-surges-across-apac-marketsChinese and North Korean threat groups are intensifying operations in Asia-Pacific, impacting regional economies and targeting financial institutions for profit.Thu, 11 Jun 2026 09:41:37 GMTLazarus GroupAsia PacificCyber EspionageFinancial CrimeAPThttps://runtimerebel.com/blog/cve-2024-21338-microsoft-defender-zero-day-exploited-by-lazarushttps://runtimerebel.com/blog/cve-2024-21338-microsoft-defender-zero-day-exploited-by-lazarusMicrosoft patches two zero-day vulnerabilities in Defender and SmartScreen exploited by Lazarus Group for privilege escalation and malware delivery.Thu, 21 May 2026 09:15:26 GMTCVE-2024-21338CVE-2024-21412Lazarus GroupMicrosoft DefenderZero-Dayhttps://runtimerebel.com/blog/north-korea-dominates-crypto-heists-76-of-stolen-funds-by-2026https://runtimerebel.com/blog/north-korea-dominates-crypto-heists-76-of-stolen-funds-by-2026North Korean threat actors are projected to be responsible for 76% of all cryptocurrency stolen by 2026, utilizing sophisticated methods for large-scale heists.Sat, 02 May 2026 00:49:12 GMTNorth KoreaCryptocurrency TheftLazarus GroupCybercrimeFinancial CrimeNation State APThttps://runtimerebel.com/blog/redtail-malware-exploiting-cve-2024-3400-technical-analysishttps://runtimerebel.com/blog/redtail-malware-exploiting-cve-2024-3400-technical-analysisAnalysis of the Libredtail variant exploiting Palo Alto Networks CVE-2024-3400 to deploy crypto-miners and establish rootkit persistence.Thu, 30 Apr 2026 08:53:37 GMTCVE-2024-3400RedtailGlobalProtectCryptominerLazarus Grouphttps://runtimerebel.com/blog/ai-generated-npm-supply-chain-attack-dprk-exploits-claude-opushttps://runtimerebel.com/blog/ai-generated-npm-supply-chain-attack-dprk-exploits-claude-opusNorth Korean actors leverage LLMs like Claude Opus to insert malicious npm packages into developer workflows, leading to RCE and data theft via @validate-sdk/v2.Wed, 29 Apr 2026 16:38:11 GMTDPRKLazarus GroupNPMMalwareClaude Opushttps://runtimerebel.com/blog/windows-kernel-lpe-cve-2024-21338-lazarus-group-exploits-zero-dayhttps://runtimerebel.com/blog/windows-kernel-lpe-cve-2024-21338-lazarus-group-exploits-zero-dayCISA adds CVE-2024-21338 to KEV catalog after Lazarus Group exploited the Windows Kernel vulnerability to deploy rootkits and bypass security controls.Wed, 29 Apr 2026 12:41:40 GMTCVE-2024-21338Lazarus GroupWindows KernelCISA KEVRootkitPrivilege Escalationhttps://runtimerebel.com/blog/bluenoroff-exploits-fake-zoom-meetings-to-deploy-macos-malwarehttps://runtimerebel.com/blog/bluenoroff-exploits-fake-zoom-meetings-to-deploy-macos-malwareBlueNoroff leverages AI avatars and stolen video to compromise crypto executives via fake Zoom calls and the Hidden Risk macOS malware family.Wed, 29 Apr 2026 08:53:57 GMTBlueNoroffLazarus GroupHidden RiskmacOS MalwareCryptocurrencyhttps://runtimerebel.com/blog/lazarus-group-s-2b-crypto-theft-defending-against-supply-chain-attackshttps://runtimerebel.com/blog/lazarus-group-s-2b-crypto-theft-defending-against-supply-chain-attacksAn analysis of Lazarus Group's persistent and financially motivated cyber operations, highlighting over $2B in crypto theft and critical supply chain attack risks.Tue, 28 Apr 2026 16:47:53 GMTLazarus GroupDPRKCryptocurrency TheftSupply Chain AttackFinancial CybercrimeAPThttps://runtimerebel.com/blog/dprk-s-contagious-interview-spreads-rats-via-dev-repositorieshttps://runtimerebel.com/blog/dprk-s-contagious-interview-spreads-rats-via-dev-repositoriesDPRK threat actors are employing a 'contagious interview' scam, weaponizing compromised developer repositories to propagate RATs and malware across the software supply…Wed, 22 Apr 2026 20:27:05 GMTDPRKLazarus GroupFake Job ScamRATSoftware Supply ChainSocial EngineeringDeveloper Compromisehttps://runtimerebel.com/blog/kelpdao-290-million-heist-linked-to-north-koreas-lazarus-grouphttps://runtimerebel.com/blog/kelpdao-290-million-heist-linked-to-north-koreas-lazarus-groupKelpDAO suffers a $290 million crypto-heist attributed to the North Korean Lazarus Group, highlighting ongoing threats to DeFi liquid restaking protocols.Tue, 21 Apr 2026 00:44:39 GMTLazarus GroupKelpDAODeFiNorth KoreaCrypto Heisthttps://runtimerebel.com/blog/dprk-it-worker-laptop-farms-u-s-nationals-sentenced-for-fraudhttps://runtimerebel.com/blog/dprk-it-worker-laptop-farms-u-s-nationals-sentenced-for-fraudTwo U.S. residents sentenced for operating laptop farms that enabled North Korean IT workers to defraud Fortune 500 companies using stolen identities.Thu, 16 Apr 2026 08:40:47 GMTDPRKLaptop FarmInsider ThreatIdentity TheftLazarus Grouphttps://runtimerebel.com/blog/north-korean-hackers-distribute-1700-malicious-packages-via-npm-and-pypihttps://runtimerebel.com/blog/north-korean-hackers-distribute-1700-malicious-packages-via-npm-and-pypiNorth Korean threat actors expand the Contagious Interview campaign, deploying 1,700 malicious packages across npm, PyPI, Go, and Rust ecosystems.Wed, 08 Apr 2026 08:32:04 GMTContagious InterviewLazarus GroupSupply Chain AttackNPMPyPIMalwarehttps://runtimerebel.com/blog/dprk-hackers-abuse-github-infrastructure-for-c2-in-south-koreahttps://runtimerebel.com/blog/dprk-hackers-abuse-github-infrastructure-for-c2-in-south-koreaNorth Korean state-sponsored actors are leveraging GitHub as a command-and-control platform in complex multi-stage attacks targeting South Korean organizations.Mon, 06 Apr 2026 20:17:41 GMTDPRKLazarus GroupGitHub C2South KoreaLNKPowerShellhttps://runtimerebel.com/blog/north-korean-social-engineering-targets-node-js-maintainershttps://runtimerebel.com/blog/north-korean-social-engineering-targets-node-js-maintainersNorth Korean threat actors use social engineering and malicious npm packages to target high-profile Node.js maintainers in a sophisticated supply chain campaign.Mon, 06 Apr 2026 12:24:38 GMTLazarus GroupNPMSocial EngineeringNode JsNorth Koreahttps://runtimerebel.com/blog/dprk-social-engineering-behind-285-million-drift-hack-analysishttps://runtimerebel.com/blog/dprk-social-engineering-behind-285-million-drift-hack-analysisA deep dive into the six-month DPRK social engineering operation targeting Drift protocol, resulting in a $285 million Solana-based cryptocurrency theft.Sun, 05 Apr 2026 20:11:07 GMTDPRKLazarus GroupDrift ProtocolSocial EngineeringSolanaCryptocurrency Thefthttps://runtimerebel.com/blog/axios-npm-hijack-attempt-detecting-social-engineering-tacticshttps://runtimerebel.com/blog/axios-npm-hijack-attempt-detecting-social-engineering-tacticsNorth Korean threat actors targeted an Axios maintainer with a fake Microsoft Teams fix, highlighting critical risks to open-source supply chains.Sun, 05 Apr 2026 00:41:54 GMTAxiosNPMLazarus GroupSocial EngineeringSupply Chain Securityhttps://runtimerebel.com/blog/defending-against-rogue-ip-kvms-detection-and-mitigation-strategieshttps://runtimerebel.com/blog/defending-against-rogue-ip-kvms-detection-and-mitigation-strategiesDiscover how threat actors use rogue IP KVMs to bypass EDR and gain persistent remote access, including technical detection and mitigation strategies.Tue, 24 Mar 2026 16:30:53 GMTIP KVMLazarus GroupRemote Access FraudHardware Securityhttps://runtimerebel.com/blog/waterplum-abuses-vs-code-tasks-to-deploy-stoatwaffle-malwarehttps://runtimerebel.com/blog/waterplum-abuses-vs-code-tasks-to-deploy-stoatwaffle-malwareNorth Korean threat actor WaterPlum leverages VS Code tasks.json to automate StoatWaffle malware deployment during fraudulent developer recruitment campaigns.Mon, 23 Mar 2026 20:17:05 GMTStoatwaffleWaterplumVisual Studio CodeNorth KoreaLazarus Grouphttps://runtimerebel.com/blog/bitrefill-attributes-cyberattack-to-north-korean-lazarus-grouphttps://runtimerebel.com/blog/bitrefill-attributes-cyberattack-to-north-korean-lazarus-groupBitrefill identifies North Korean Lazarus Group as the perpetrator of a recent cyberattack, underscoring the persistent threat to crypto-focused businesses.Thu, 19 Mar 2026 20:16:23 GMTLazarus GroupBlueNoroffBitrefillCryptocurrencyAPTNorth Koreahttps://runtimerebel.com/blog/ofac-sanctions-dprk-it-worker-network-funding-wmd-programshttps://runtimerebel.com/blog/ofac-sanctions-dprk-it-worker-network-funding-wmd-programsUS Treasury sanctions North Korea's IT worker network used to fund WMD programs. Learn how these actors use fake identities and how to secure remote hiring.Wed, 18 Mar 2026 20:15:49 GMTDPRKOFACLazarus GroupSanctionsIT Worker Schemehttps://runtimerebel.com/blog/tfl-data-breach-and-avira-security-flaws-weekly-threat-briefinghttps://runtimerebel.com/blog/tfl-data-breach-and-avira-security-flaws-weekly-threat-briefingAnalysis of the Transport for London breach affecting 10 million users, Avira antivirus security flaws, and North Korean cyber actor attribution.Fri, 06 Mar 2026 16:21:41 GMTData BreachAvira AntivirusLazarus GroupTfl BreachAPThttps://runtimerebel.com/blog/north-korean-apt-bridges-air-gaps-with-new-malware-suitehttps://runtimerebel.com/blog/north-korean-apt-bridges-air-gaps-with-new-malware-suiteNorth Korean threat actors utilize malicious LNK files and specialized USB propagation tools to compromise air-gapped networks. Analysis and defense guide.Mon, 02 Mar 2026 12:18:34 GMTLazarus GroupAir GappedLNK MalwareNorth KoreaUSB Propagationhttps://runtimerebel.com/blog/north-korean-malicious-npm-packages-detecting-contagious-interviewhttps://runtimerebel.com/blog/north-korean-malicious-npm-packages-detecting-contagious-interviewNorth Korean actors published 26 malicious npm packages using Pastebin as a C2 dead drop resolver in a new Contagious Interview campaign iteration.Mon, 02 Mar 2026 12:18:05 GMTNPMLazarus GroupContagious InterviewSupply Chain AttackPastebinC2Node Jshttps://runtimerebel.com/blog/fake-recruiters-deploy-malware-via-malicious-coding-challengeshttps://runtimerebel.com/blog/fake-recruiters-deploy-malware-via-malicious-coding-challengesNorth Korean threat actors are targeting software developers with fake job offers and malicious coding tests to deploy malware on developer workstations.Fri, 27 Feb 2026 12:18:39 GMTLazarus GroupNorth KoreaSocial EngineeringMalicious Coding ChallengesCryptocurrencyTrojanized Softwarehttps://runtimerebel.com/blog/next-js-supply-chain-attacks-north-korean-actors-target-developershttps://runtimerebel.com/blog/next-js-supply-chain-attacks-north-korean-actors-target-developersNorth Korean state-sponsored actors leverage malicious Next.js repositories and fake job interviews to compromise developers' systems for persistent access and espionage.Wed, 25 Feb 2026 20:16:34 GMTNext JsSoftware Supply Chain AttackNorth KoreaLazarus GroupDevelopersFake Job ScamsPersistent AccessMalwarehttps://runtimerebel.com/blog/lazarus-group-shifts-to-medusa-ransomware-multi-tool-attackshttps://runtimerebel.com/blog/lazarus-group-shifts-to-medusa-ransomware-multi-tool-attacksNorth Korea's Lazarus Group now employs Medusa ransomware, Comebacker backdoor, Blindingcan RAT, and Infohook info stealer in recent attacks, signaling an evolving…Wed, 25 Feb 2026 04:43:37 GMTLazarus GroupMedusa RansomwareComebackerBlindingcan RATInfohookNorth KoreaRansomwareAPThttps://runtimerebel.com/blog/lazarus-group-targets-u-s-healthcare-with-medusa-ransomwarehttps://runtimerebel.com/blog/lazarus-group-targets-u-s-healthcare-with-medusa-ransomwareNorth Korean Lazarus Group is targeting U.S. healthcare providers with Medusa ransomware, utilizing Dtrack malware for initial access and persistence.Tue, 24 Feb 2026 12:23:39 GMTLazarus GroupMedusa RansomwareDtrackApt38Healthcare Securityhttps://runtimerebel.com/blog/lazarus-group-deploys-medusa-ransomware-in-global-healthcare-attackshttps://runtimerebel.com/blog/lazarus-group-deploys-medusa-ransomware-in-global-healthcare-attacksLazarus Group (Diamond Sleet) targets Middle Eastern entities and U.S. healthcare with Medusa ransomware, according to Symantec and Carbon Black reports.Tue, 24 Feb 2026 12:21:18 GMTLazarus GroupMedusa RansomwareDiamond SleetPompilusHealthcare SecurityNorth Koreahttps://runtimerebel.com/blog/sentenced-ukrainian-national-facilitated-dprk-it-worker-infrastructurehttps://runtimerebel.com/blog/sentenced-ukrainian-national-facilitated-dprk-it-worker-infrastructureOleksandr Didenko sentenced to five years for orchestrating an identity laundering scheme that enabled North Korean operatives to infiltrate Western corporate networks.Mon, 23 Feb 2026 16:26:29 GMTDPRKIdentity TheftRemote Work FraudInsider ThreatLazarus Group