Cybersecurity articles tagged #North Korea on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/north-korean-job-fraud-expands-beyond-it-new-sectors-targetedhttps://runtimerebel.com/blog/north-korean-job-fraud-expands-beyond-it-new-sectors-targetedDPRK-linked threat actors are expanding job fraud beyond IT into healthcare, sales, and finance, leveraging AI and fake identities to fund illicit programs.Tue, 01 Sep 2026 02:38:21 GMTDPRKNorth KoreaInsider ThreatAIJob Fraudhttps://runtimerebel.com/blog/north-korea-s-sapphire-sleet-targets-rust-supply-chain-via-arrayref-cratehttps://runtimerebel.com/blog/north-korea-s-sapphire-sleet-targets-rust-supply-chain-via-arrayref-crateNorth Korean actor Sapphire Sleet compromised a Rust maintainer's account to publish malicious `arrayref` crate versions, targeting the Rust supply chain.Sun, 23 Aug 2026 16:16:30 GMTNorth KoreaRustSupply Chain AttackCrates IoSapphire Sleethttps://runtimerebel.com/blog/purpledelta-north-korean-it-workers-exploit-remote-hiringhttps://runtimerebel.com/blog/purpledelta-north-korean-it-workers-exploit-remote-hiringRecorded Future exposes PurpleDelta, North Korean IT workers using sophisticated fraudulent employment, AI, and extensive vetting evasion to fund DPRK military programs.Tue, 18 Aug 2026 16:25:57 GMTNorth KoreaState SponsoredSupply Chain RiskPurpleDeltaFraudulent Employmenthttps://runtimerebel.com/blog/north-korea-attribution-data-breaches-impact-ontrac-uk-educationhttps://runtimerebel.com/blog/north-korea-attribution-data-breaches-impact-ontrac-uk-educationAWS attributes recent hacks to North Korea. OnTrac and the UK Department for Education report significant data breaches, impacting over 600,000 records.Fri, 31 Jul 2026 17:43:11 GMTNorth KoreaAPTData BreachOntracUK Department for EducationAWShttps://runtimerebel.com/blog/polinrider-north-korean-hackers-push-108-malicious-packageshttps://runtimerebel.com/blog/polinrider-north-korean-hackers-push-108-malicious-packagesAnalysis of the PolinRider campaign where North Korean actors published 108 malicious packages and extensions across npm, Go, and Chrome ecosystems.Sat, 04 Jul 2026 13:37:02 GMTPolinRiderLazarus GroupNPMChrome Web StoreSupply Chain AttackNorth Koreahttps://runtimerebel.com/blog/scarcruft-deploys-narwhalrat-via-fake-microsoft-security-alertshttps://runtimerebel.com/blog/scarcruft-deploys-narwhalrat-via-fake-microsoft-security-alertsNorth Korean threat actor ScarCruft (APT37) is deploying NarwhalRAT via spear-phishing emails that mimic official Microsoft Account security notifications.Tue, 16 Jun 2026 09:53:53 GMTScarCruftAPT37NarwhalRATNorth KoreaPhishinghttps://runtimerebel.com/blog/north-korean-apt-targets-developers-via-malicious-toolinghttps://runtimerebel.com/blog/north-korean-apt-targets-developers-via-malicious-toolingNorth Korean threat cluster Contagious Interview exploits developer recruitment and code review phishing to deliver malware via tainted dev tools.Tue, 16 Jun 2026 01:12:25 GMTContagious InterviewFamous ChollimaNorth KoreaAPTPhishingDeveloper ToolsSupply Chainhttps://runtimerebel.com/blog/north-korea-dominates-crypto-heists-76-of-stolen-funds-by-2026https://runtimerebel.com/blog/north-korea-dominates-crypto-heists-76-of-stolen-funds-by-2026North Korean threat actors are projected to be responsible for 76% of all cryptocurrency stolen by 2026, utilizing sophisticated methods for large-scale heists.Sat, 02 May 2026 00:49:12 GMTNorth KoreaCryptocurrency TheftLazarus GroupCybercrimeFinancial CrimeNation State APThttps://runtimerebel.com/blog/kelpdao-290-million-heist-linked-to-north-koreas-lazarus-grouphttps://runtimerebel.com/blog/kelpdao-290-million-heist-linked-to-north-koreas-lazarus-groupKelpDAO suffers a $290 million crypto-heist attributed to the North Korean Lazarus Group, highlighting ongoing threats to DeFi liquid restaking protocols.Tue, 21 Apr 2026 00:44:39 GMTLazarus GroupKelpDAODeFiNorth KoreaCrypto Heisthttps://runtimerebel.com/blog/sapphire-sleet-s-clickfix-north-korea-targets-macos-usershttps://runtimerebel.com/blog/sapphire-sleet-s-clickfix-north-korea-targets-macos-usersNorth Korea-backed Sapphire Sleet is deploying ClickFix malware via fake job offers and phony Zoom updates to steal macOS user credentials and data.Thu, 16 Apr 2026 20:22:49 GMTSapphire SleetClickFixmacOSNorth KoreaPhishingData TheftAPThttps://runtimerebel.com/blog/apt37-social-engineering-via-facebook-delivers-rokrat-malwarehttps://runtimerebel.com/blog/apt37-social-engineering-via-facebook-delivers-rokrat-malwareNorth Korean threat actor APT37 leverages Facebook friend requests and trust-building to deploy the RokRAT trojan against high-value targets.Mon, 13 Apr 2026 12:31:54 GMTAPT37RokratSocial EngineeringScarCruftNorth Koreahttps://runtimerebel.com/blog/north-korean-social-engineering-targets-node-js-maintainershttps://runtimerebel.com/blog/north-korean-social-engineering-targets-node-js-maintainersNorth Korean threat actors use social engineering and malicious npm packages to target high-profile Node.js maintainers in a sophisticated supply chain campaign.Mon, 06 Apr 2026 12:24:38 GMTLazarus GroupNPMSocial EngineeringNode JsNorth Koreahttps://runtimerebel.com/blog/unc1069-social-engineering-leads-to-axios-npm-supply-chain-compromisehttps://runtimerebel.com/blog/unc1069-social-engineering-leads-to-axios-npm-supply-chain-compromiseRuntime Rebel details how North Korean threat actor UNC1069 leveraged targeted social engineering against an Axios npm package maintainer, leading to a critical supply…Fri, 03 Apr 2026 16:16:04 GMTUNC1069AxiosNPMSupply Chain AttackSocial EngineeringNorth Koreahttps://runtimerebel.com/blog/axios-npm-supply-chain-attack-bypasses-github-actions-ci-cdhttps://runtimerebel.com/blog/axios-npm-supply-chain-attack-bypasses-github-actions-ci-cdA sophisticated supply chain attack targeted the Axios NPM package, leveraging a compromised token to bypass GitHub Actions CI/CD and deploy malicious versions.Wed, 01 Apr 2026 12:28:22 GMTAxiosNPMSupply Chain AttackNorth KoreaGitHub ActionsCI CDhttps://runtimerebel.com/blog/axios-npm-supply-chain-attack-attributed-to-north-korea-s-unc1069https://runtimerebel.com/blog/axios-npm-supply-chain-attack-attributed-to-north-korea-s-unc1069Google Threat Intelligence attributes a major Axios npm supply chain attack to North Korean group UNC1069, emphasizing risks to developer environments.Wed, 01 Apr 2026 08:34:33 GMTUNC1069NPMAxiosNorth KoreaSupply Chain Securityhttps://runtimerebel.com/blog/unc1069-leverages-axios-npm-supply-chain-to-deploy-waveshaper-v2https://runtimerebel.com/blog/unc1069-leverages-axios-npm-supply-chain-to-deploy-waveshaper-v2North Korea-nexus UNC1069 compromised widely used Axios NPM package (v1.14.1, 0.30.4) by injecting plain-crypto-js to deploy WAVESHAPER.V2 backdoor across multiple OS.Wed, 01 Apr 2026 00:45:35 GMTUNC1069WAVESHAPER V2AxiosNPMSupply Chain AttackPlain Crypto JsSILKBELLNorth Koreahttps://runtimerebel.com/blog/waterplum-abuses-vs-code-tasks-to-deploy-stoatwaffle-malwarehttps://runtimerebel.com/blog/waterplum-abuses-vs-code-tasks-to-deploy-stoatwaffle-malwareNorth Korean threat actor WaterPlum leverages VS Code tasks.json to automate StoatWaffle malware deployment during fraudulent developer recruitment campaigns.Mon, 23 Mar 2026 20:17:05 GMTStoatwaffleWaterplumVisual Studio CodeNorth KoreaLazarus Grouphttps://runtimerebel.com/blog/bitrefill-attributes-cyberattack-to-north-korean-lazarus-grouphttps://runtimerebel.com/blog/bitrefill-attributes-cyberattack-to-north-korean-lazarus-groupBitrefill identifies North Korean Lazarus Group as the perpetrator of a recent cyberattack, underscoring the persistent threat to crypto-focused businesses.Thu, 19 Mar 2026 20:16:23 GMTLazarus GroupBlueNoroffBitrefillCryptocurrencyAPTNorth Koreahttps://runtimerebel.com/blog/unc4899-exploits-airdrop-for-crypto-firm-breach-analysishttps://runtimerebel.com/blog/unc4899-exploits-airdrop-for-crypto-firm-breach-analysisUNC4899 breached a crypto firm using AirDrop to bypass network security. This analysis explores the TTPs of North Korean threat actors in 2025.Mon, 09 Mar 2026 16:30:09 GMTUNC4899Jade SleetmacOS SecurityAirDropNorth KoreaCryptocurrencyhttps://runtimerebel.com/blog/north-korean-apt-bridges-air-gaps-with-new-malware-suitehttps://runtimerebel.com/blog/north-korean-apt-bridges-air-gaps-with-new-malware-suiteNorth Korean threat actors utilize malicious LNK files and specialized USB propagation tools to compromise air-gapped networks. Analysis and defense guide.Mon, 02 Mar 2026 12:18:34 GMTLazarus GroupAir GappedLNK MalwareNorth KoreaUSB Propagationhttps://runtimerebel.com/blog/apt37-deploys-shroudedvue-malware-to-target-air-gapped-networkshttps://runtimerebel.com/blog/apt37-deploys-shroudedvue-malware-to-target-air-gapped-networksNorth Korean threat actor APT37 utilizes new malware families like SHROUDEDVUE and WASHSYNC to infiltrate air-gapped systems via removable USB drives.Fri, 27 Feb 2026 20:12:14 GMTAPT37ScarCruftSHROUDEDVUEAir GapNorth KoreaWASHSYNChttps://runtimerebel.com/blog/scarcruft-ruby-jumper-campaign-targets-air-gapped-networkshttps://runtimerebel.com/blog/scarcruft-ruby-jumper-campaign-targets-air-gapped-networksNorth Korean threat actor ScarCruft (APT37) deploys Ruby Jumper campaign using Zoho WorkDrive for C2 and USB malware to target air-gapped environments.Fri, 27 Feb 2026 16:15:18 GMTScarCruftAPT37Ruby JumperZoho WorkDriveAir GappedZscalerNorth Koreahttps://runtimerebel.com/blog/fake-recruiters-deploy-malware-via-malicious-coding-challengeshttps://runtimerebel.com/blog/fake-recruiters-deploy-malware-via-malicious-coding-challengesNorth Korean threat actors are targeting software developers with fake job offers and malicious coding tests to deploy malware on developer workstations.Fri, 27 Feb 2026 12:18:39 GMTLazarus GroupNorth KoreaSocial EngineeringMalicious Coding ChallengesCryptocurrencyTrojanized Softwarehttps://runtimerebel.com/blog/next-js-supply-chain-attacks-north-korean-actors-target-developershttps://runtimerebel.com/blog/next-js-supply-chain-attacks-north-korean-actors-target-developersNorth Korean state-sponsored actors leverage malicious Next.js repositories and fake job interviews to compromise developers' systems for persistent access and espionage.Wed, 25 Feb 2026 20:16:34 GMTNext JsSoftware Supply Chain AttackNorth KoreaLazarus GroupDevelopersFake Job ScamsPersistent AccessMalwarehttps://runtimerebel.com/blog/lazarus-group-shifts-to-medusa-ransomware-multi-tool-attackshttps://runtimerebel.com/blog/lazarus-group-shifts-to-medusa-ransomware-multi-tool-attacksNorth Korea's Lazarus Group now employs Medusa ransomware, Comebacker backdoor, Blindingcan RAT, and Infohook info stealer in recent attacks, signaling an evolving…Wed, 25 Feb 2026 04:43:37 GMTLazarus GroupMedusa RansomwareComebackerBlindingcan RATInfohookNorth KoreaRansomwareAPThttps://runtimerebel.com/blog/lazarus-group-deploys-medusa-ransomware-in-global-healthcare-attackshttps://runtimerebel.com/blog/lazarus-group-deploys-medusa-ransomware-in-global-healthcare-attacksLazarus Group (Diamond Sleet) targets Middle Eastern entities and U.S. healthcare with Medusa ransomware, according to Symantec and Carbon Black reports.Tue, 24 Feb 2026 12:21:18 GMTLazarus GroupMedusa RansomwareDiamond SleetPompilusHealthcare SecurityNorth Korea