Skip to content
OriginalSign in
Image: Security Affairs

Security AffairsPierluigi Paganini

Lazarus Uses Fileless RemotePE RAT Powered by DPAPI Loader

Part of the Lazarus Group story · since 28 Aug 2025

Quiet for 32 hourslast report 29 Oct60 articles13 outlets
28 Aug · GBHackers first31 Mar12 Jun24 AugNowThis article38th of 60
  • Thu 28 Aug, 14:45 UTC. GBHackers, first report. Lazarus Group Targets Windows 11 with ClickFix Tactics and Fake Job Offers.
  • Mon 1 Sep, 10:39 UTC. SecurityOnline, its first report on the story. Typosquatting & Backdoors: Lazarus’ Latest npm Campaign.
  • Tue 2 Sep, 03:45 UTC. SecurityOnline. Lazarus Subgroup Deploys Three Custom RATs in Targeted Crypto Attacks.
  • Tue 2 Sep, 18:39 UTC. The Hacker News, its first report on the story. Lazarus Group Expands Malware Arsenal With PondRAT, ThemeForestRAT, and RemotePE.
  • Fri 5 Sep, 03:00 UTC. SecurityOnline. SentinelLABS Reveals How North Korean “Contagious Interview” Operators Abuse Threat Intel Platforms.
  • Wed 10 Sep, 01:46 UTC. SecurityOnline. Lazarus Group Is Exploiting CVE-2025-48384 in New Phishing Campaign.
  • Thu 16 Oct, 13:40 UTC. GBHackers. North Korean Hackers Deploy BeaverTail–OtterCookie Combo for Keylogging Attacks.
  • Thu 23 Oct, 04:31 UTC. Dark Reading, its first report on the story. Lazarus Group Hunts European Drone Manufacturing Data.
  • Tue 28 Oct, 03:30 UTC. Securelist, its first report on the story. Crypto wasted: BlueNoroff’s ghost mirage of funding and jobs.
  • Tue 28 Oct, 04:01 UTC. SecurityOnline. Lazarus Group Attacks with DreamLoader Malware, Leveraging DLL Sideloading and Microsoft Graph API for Stealth C2.
  • Tue 28 Oct, 09:47 UTC. GBHackers. BlueNoroff Shifts Tactics: Targets C-Suite and Managers with New Infiltration Methods.
  • Tue 28 Oct, 16:40 UTC. The Hacker News. Researchers Expose GhostCall and GhostHire: BlueNoroff's New Malware Chains.
  • Tue 28 Oct, 17:10 UTC. Dark Reading. North Korea's BlueNoroff Expands Scope of Crypto Heists.
  • Wed 29 Oct, 01:25 UTC. SecurityOnline. BlueNoroff APT Launches AI-Enhanced Espionage on macOS, Using GPT-4o Images in Fake GhostCall Meetings.
  • Fri 31 Oct, 07:31 UTC. GBHackers. Kimsuky and Lazarus Hackers Deploy New Backdoor Tools for Remote Access Attacks.
  • Mon 3 Nov, 01:01 UTC. SecurityOnline. North Korean APTs Upgrade Arsenal: Kimsuky Uses Stealthy HttpTroy, Lazarus Deploys New BLINDINGCAN RAT.
  • Tue 11 Nov, 01:00 UTC. SecurityOnline. Lazarus Group Attacks Aerospace/Defense with New ChaCha20-Encrypted Comebacker Backdoor.
  • Tue 11 Nov, 06:31 UTC. GBHackers. Lazarus Group Deploys Weaponized Documents Against Aerospace & Defense.
  • Tue 18 Nov, 02:45 UTC. SecurityOnline. DOJ Seizes $15M in Crypto from APT38, Unveils Guilty Pleas in North Korean IT Worker Fraud Scheme.
  • Thu 20 Nov, 02:01 UTC. SecurityOnline. Lazarus Group’s New ScoringMathTea RAT Uses Reflective Plugin Loader and Custom Polyalphabetic Crypto for Espionage.
  • Wed 3 Dec, 14:16 UTC. Security Affairs, its first report on the story. Researchers spotted Lazarus’s remote IT workers in action.
  • Mon 22 Dec, 00:41 UTC. SecurityOnline. Shadows of the North: Unmasking the Sprawling Cyber Infrastructure of the DPRK.
  • Tue 3 Feb, 03:15 UTC. SecurityOnline. Hydra Tactics: North Korea’s LABYRINTH CHOLLIMA Splits to Hunt Crypto & Secrets.
  • Thu 5 Feb, 01:55 UTC. SecurityOnline. “Can You Hear Me?” BlueNoroff Hackers Use Fake Audio Glitch to Breach macOS.
  • Fri 13 Feb, 01:15 UTC. SecurityOnline. Dream Job or Nightmare? Lazarus Group Hunts Crypto Devs with “Graphalgo” Malware.
  • Sun 15 Feb, 18:35 UTC. Security Affairs. Malicious npm and PyPI packages linked to Lazarus APT fake recruiter campaign.
  • Tue 24 Feb, 12:11 UTC. The Hacker News. Lazarus adopts Medusa RaaS to extort hospitals and charities.
  • Wed 25 Feb, 08:55 UTC. Security Affairs. Lazarus uses Medusa ransomware to extort Middle East group.
  • Tue 21 Apr, 08:41 UTC. Infosecurity, its first report on the story. Lazarus linked to $293m KelpDAO heist via LayerZero flaw.
  • Tue 21 Apr, 10:21 UTC. SecurityWeek, its first report on the story. North Korea linked hackers steal $290M from Kelp DAO DeFi.
  • Tue 21 Apr, 19:27 UTC. Security Affairs. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit.
  • Fri 24 Apr, 13:17 UTC. Dark Reading. Lazarus Group targets macOS users with ClickFix fake meeting scam.
  • Tue 28 Apr, 08:30 UTC. Infosecurity. North Korean hackers use fake Zoom links to steal crypto wallets.
  • Tue 28 Apr, 22:27 UTC. Dark Reading. North Korea’s BlueNoroff uses fake Zoom to steal crypto exec data.
  • Fri 1 May, 18:41 UTC. dti.domaintools.com, its first report on the story. Lazarus Exploits Fake Interviews to Steal Developer Credentials.
  • Thu 7 May, 23:25 UTC. dti.domaintools.com. Fake Google Authenticator Chrome Extension Hits 260k Users.
  • Mon 25 May, 11:11 UTC. The Hacker News. Lazarus Group Deploys Memory Only RAT Against Crypto and Banks.
  • Tue 26 May, 08:41 UTC. Security Affairs. Lazarus Uses Fileless RemotePE RAT Powered by DPAPI Loader. This article, 38th of 60.
  • Fri 29 May, 08:28 UTC. SecurityOnline. North Korean hackers deploy memory only toolset against banks.
  • Fri 3 Jul, 10:53 UTC. SecurityOnline. Lazarus-Linked npm Malware Masquerades as Rollup Polyfills.
  • Fri 24 Jul, 16:30 UTC. The Hacker News. BlueNoroff Zoom Phishing Kit Hits Crypto Wallets With Profiling.
  • Thu 30 Jul, 07:20 UTC. SecurityOnline. North Korean Hackers Exploit Fake Zoom Calls to Steal Crypto Data.
  • Fri 31 Jul, 13:09 UTC. DataBreaches, its first report on the story. Lazarus shares tools with Gunra ransomware in South Korea attacks.
  • Tue 4 Aug, 09:31 UTC. SecurityOnline. North Korean Hackers Hijack NPM Packages via Social Engineering.
  • Tue 11 Aug, 15:26 UTC. Infosecurity. Lazarus NullReceiver malware uses npm Ethereum queries for C2.
  • Tue 11 Aug, 17:51 UTC. Check Point, its first report on the story. Lazarus hits defence via fake job PDFs, CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:40 UTC. SecurityOnline. Microsoft Patch Tuesday Patches Critical WinSock Exploit. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:41 UTC. SecurityOnline. Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:11 UTC. SecurityWeek. Lazarus uses fake job offers to exploit Windows CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 14:11 UTC. Malwarebytes, its first report on the story. MS Patch Tuesday patches 421 flaws, Lazarus zero day exploited.
  • Wed 12 Aug, 14:11 UTC. Infosecurity. Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 18:18 UTC. The Hacker News. Lazarus Group Exploits Windows Zero Day, Installs Backdoor.
  • Thu 13 Aug, 08:52 UTC. Security Affairs. Lazarus Group exploits CVE‑2026‑68820 via fake job offers. Cites a CVE in CISA KEV.
  • Mon 7 Sep, 11:26 UTC. Infosecurity. Researchers Map Lazarus Into Six North Korean Cyber Units.
  • Wed 21 Oct, 02:31 UTC. Securelist. Lazarus Group abuses South Korean security software in FlashHole campaign.
  • Wed 21 Oct, 11:01 UTC. SecurityOnline. Lazarus Targets South Korean Firms Through Fake CV Websites.
  • Sun 25 Oct, 14:30 UTC. Security Affairs. Security Affairs newsletter rounds up malware and attack reports.
  • Mon 26 Oct, 11:30 UTC. Security Affairs. Cyfirma links PHP flaw scans to a North Korean campaign. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 04:30 UTC. SecurityOnline. CISA adds PHP2Shell flaws to KEV after confirmed attacks. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.

The Lazarus APT group, linked to North Korea, has introduced a sophisticated fileless remote access Trojan (RAT) called RemotePE, designed to avoid detection and forensic analysis. This malware operates entirely in memory, utilizing a three-stage toolchain, starting with a loader (DPAPILoader) that exploits the Windows Data Protection API for encrypted payloads.

The final stage implements RemotePE, a C++ RAT that includes features such as file operations and process management without leaving traces on the filesystem. Researchers at Fox-IT observed that this malware is built for long-term campaigns, allowing the actor to maintain prolonged access before executing significant objectives like financial theft. Recommendations for defense include monitoring host-based indicators, such as suspicious DPAPI-encrypted blobs, and DNS queries to known command-and-control domains.

How the story developed

All 60 articles
Quiet for 32 hourslast report 29 Oct60 articles13 outlets

60 articles from 13 outlets since 28 Aug. Quiet since 29 Oct. This was the 38th report, 271 days after the first.

Now28 Aug262115629252419134272419112First reportGBHackers · 28 Aug, 14:45This article38th of 60 · day 271
  • Thu 28 Aug, 14:45 UTC. GBHackers, first report. Lazarus Group Targets Windows 11 with ClickFix Tactics and Fake Job Offers.
  • Mon 1 Sep, 10:39 UTC. SecurityOnline, its first report on the story. Typosquatting & Backdoors: Lazarus’ Latest npm Campaign.
  • Tue 2 Sep, 03:45 UTC. SecurityOnline. Lazarus Subgroup Deploys Three Custom RATs in Targeted Crypto Attacks.
  • Tue 2 Sep, 18:39 UTC. The Hacker News, its first report on the story. Lazarus Group Expands Malware Arsenal With PondRAT, ThemeForestRAT, and RemotePE.
  • Fri 5 Sep, 03:00 UTC. SecurityOnline. SentinelLABS Reveals How North Korean “Contagious Interview” Operators Abuse Threat Intel Platforms.
  • Wed 10 Sep, 01:46 UTC. SecurityOnline. Lazarus Group Is Exploiting CVE-2025-48384 in New Phishing Campaign.
  • Thu 16 Oct, 13:40 UTC. GBHackers. North Korean Hackers Deploy BeaverTail–OtterCookie Combo for Keylogging Attacks.
  • Thu 23 Oct, 04:31 UTC. Dark Reading, its first report on the story. Lazarus Group Hunts European Drone Manufacturing Data.
  • Tue 28 Oct, 03:30 UTC. Securelist, its first report on the story. Crypto wasted: BlueNoroff’s ghost mirage of funding and jobs.
  • Tue 28 Oct, 04:01 UTC. SecurityOnline. Lazarus Group Attacks with DreamLoader Malware, Leveraging DLL Sideloading and Microsoft Graph API for Stealth C2.
  • Tue 28 Oct, 09:47 UTC. GBHackers. BlueNoroff Shifts Tactics: Targets C-Suite and Managers with New Infiltration Methods.
  • Tue 28 Oct, 16:40 UTC. The Hacker News. Researchers Expose GhostCall and GhostHire: BlueNoroff's New Malware Chains.
  • Tue 28 Oct, 17:10 UTC. Dark Reading. North Korea's BlueNoroff Expands Scope of Crypto Heists.
  • Wed 29 Oct, 01:25 UTC. SecurityOnline. BlueNoroff APT Launches AI-Enhanced Espionage on macOS, Using GPT-4o Images in Fake GhostCall Meetings.
  • Fri 31 Oct, 07:31 UTC. GBHackers. Kimsuky and Lazarus Hackers Deploy New Backdoor Tools for Remote Access Attacks.
  • Mon 3 Nov, 01:01 UTC. SecurityOnline. North Korean APTs Upgrade Arsenal: Kimsuky Uses Stealthy HttpTroy, Lazarus Deploys New BLINDINGCAN RAT.
  • Tue 11 Nov, 01:00 UTC. SecurityOnline. Lazarus Group Attacks Aerospace/Defense with New ChaCha20-Encrypted Comebacker Backdoor.
  • Tue 11 Nov, 06:31 UTC. GBHackers. Lazarus Group Deploys Weaponized Documents Against Aerospace & Defense.
  • Tue 18 Nov, 02:45 UTC. SecurityOnline. DOJ Seizes $15M in Crypto from APT38, Unveils Guilty Pleas in North Korean IT Worker Fraud Scheme.
  • Thu 20 Nov, 02:01 UTC. SecurityOnline. Lazarus Group’s New ScoringMathTea RAT Uses Reflective Plugin Loader and Custom Polyalphabetic Crypto for Espionage.
  • Wed 3 Dec, 14:16 UTC. Security Affairs, its first report on the story. Researchers spotted Lazarus’s remote IT workers in action.
  • Mon 22 Dec, 00:41 UTC. SecurityOnline. Shadows of the North: Unmasking the Sprawling Cyber Infrastructure of the DPRK.
  • Tue 3 Feb, 03:15 UTC. SecurityOnline. Hydra Tactics: North Korea’s LABYRINTH CHOLLIMA Splits to Hunt Crypto & Secrets.
  • Thu 5 Feb, 01:55 UTC. SecurityOnline. “Can You Hear Me?” BlueNoroff Hackers Use Fake Audio Glitch to Breach macOS.
  • Fri 13 Feb, 01:15 UTC. SecurityOnline. Dream Job or Nightmare? Lazarus Group Hunts Crypto Devs with “Graphalgo” Malware.
  • Sun 15 Feb, 18:35 UTC. Security Affairs. Malicious npm and PyPI packages linked to Lazarus APT fake recruiter campaign.
  • Tue 24 Feb, 12:11 UTC. The Hacker News. Lazarus adopts Medusa RaaS to extort hospitals and charities.
  • Wed 25 Feb, 08:55 UTC. Security Affairs. Lazarus uses Medusa ransomware to extort Middle East group.
  • Tue 21 Apr, 08:41 UTC. Infosecurity, its first report on the story. Lazarus linked to $293m KelpDAO heist via LayerZero flaw.
  • Tue 21 Apr, 10:21 UTC. SecurityWeek, its first report on the story. North Korea linked hackers steal $290M from Kelp DAO DeFi.
  • Tue 21 Apr, 19:27 UTC. Security Affairs. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit.
  • Fri 24 Apr, 13:17 UTC. Dark Reading. Lazarus Group targets macOS users with ClickFix fake meeting scam.
  • Tue 28 Apr, 08:30 UTC. Infosecurity. North Korean hackers use fake Zoom links to steal crypto wallets.
  • Tue 28 Apr, 22:27 UTC. Dark Reading. North Korea’s BlueNoroff uses fake Zoom to steal crypto exec data.
  • Fri 1 May, 18:41 UTC. dti.domaintools.com, its first report on the story. Lazarus Exploits Fake Interviews to Steal Developer Credentials.
  • Thu 7 May, 23:25 UTC. dti.domaintools.com. Fake Google Authenticator Chrome Extension Hits 260k Users.
  • Mon 25 May, 11:11 UTC. The Hacker News. Lazarus Group Deploys Memory Only RAT Against Crypto and Banks.
  • Tue 26 May, 08:41 UTC. Security Affairs. Lazarus Uses Fileless RemotePE RAT Powered by DPAPI Loader. This article, 38th of 60.
  • Fri 29 May, 08:28 UTC. SecurityOnline. North Korean hackers deploy memory only toolset against banks.
  • Fri 3 Jul, 10:53 UTC. SecurityOnline. Lazarus-Linked npm Malware Masquerades as Rollup Polyfills.
  • Fri 24 Jul, 16:30 UTC. The Hacker News. BlueNoroff Zoom Phishing Kit Hits Crypto Wallets With Profiling.
  • Thu 30 Jul, 07:20 UTC. SecurityOnline. North Korean Hackers Exploit Fake Zoom Calls to Steal Crypto Data.
  • Fri 31 Jul, 13:09 UTC. DataBreaches, its first report on the story. Lazarus shares tools with Gunra ransomware in South Korea attacks.
  • Tue 4 Aug, 09:31 UTC. SecurityOnline. North Korean Hackers Hijack NPM Packages via Social Engineering.
  • Tue 11 Aug, 15:26 UTC. Infosecurity. Lazarus NullReceiver malware uses npm Ethereum queries for C2.
  • Tue 11 Aug, 17:51 UTC. Check Point, its first report on the story. Lazarus hits defence via fake job PDFs, CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:40 UTC. SecurityOnline. Microsoft Patch Tuesday Patches Critical WinSock Exploit. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 03:41 UTC. SecurityOnline. Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 09:11 UTC. SecurityWeek. Lazarus uses fake job offers to exploit Windows CVE-2026-68820. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 14:11 UTC. Malwarebytes, its first report on the story. MS Patch Tuesday patches 421 flaws, Lazarus zero day exploited.
  • Wed 12 Aug, 14:11 UTC. Infosecurity. Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day. Cites a CVE in CISA KEV.
  • Wed 12 Aug, 18:18 UTC. The Hacker News. Lazarus Group Exploits Windows Zero Day, Installs Backdoor.
  • Thu 13 Aug, 08:52 UTC. Security Affairs. Lazarus Group exploits CVE‑2026‑68820 via fake job offers. Cites a CVE in CISA KEV.
  • Mon 7 Sep, 11:26 UTC. Infosecurity. Researchers Map Lazarus Into Six North Korean Cyber Units.
  • Wed 21 Oct, 02:31 UTC. Securelist. Lazarus Group abuses South Korean security software in FlashHole campaign.
  • Wed 21 Oct, 11:01 UTC. SecurityOnline. Lazarus Targets South Korean Firms Through Fake CV Websites.
  • Sun 25 Oct, 14:30 UTC. Security Affairs. Security Affairs newsletter rounds up malware and attack reports.
  • Mon 26 Oct, 11:30 UTC. Security Affairs. Cyfirma links PHP flaw scans to a North Korean campaign. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 04:30 UTC. SecurityOnline. CISA adds PHP2Shell flaws to KEV after confirmed attacks. Cites a CVE in CISA KEV.
  • Thu 29 Oct, 18:30 UTC. Microsoft, its first report on the story. Microsoft reports North Korean groups expanding AI operations.
  • Known exploited CVE
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
Show all 60 articles as a list
  1. Thu 28 AugDay 01
    1. Lazarus Group Targets Windows 11 with ClickFix Tactics and Fake Job Offers14:45 · GBHackers · First report

  2. Quiet for 4 days

    Mon 1 SepDay 41
    1. Typosquatting & Backdoors: Lazarus’ Latest npm Campaign10:39 · SecurityOnline · Picked up again
  3. Tue 2 SepDay 52
    1. Lazarus Subgroup Deploys Three Custom RATs in Targeted Crypto Attacks03:45 · SecurityOnline
    2. Lazarus Group Expands Malware Arsenal With PondRAT, ThemeForestRAT, and RemotePE18:39 · The Hacker News

  4. Quiet for 2 days

    Fri 5 SepDay 81
    1. SentinelLABS Reveals How North Korean “Contagious Interview” Operators Abuse Threat Intel Platforms03:00 · SecurityOnline · Picked up again

  5. Quiet for 5 days

    Wed 10 SepDay 131
    1. Lazarus Group Is Exploiting CVE-2025-48384 in New Phishing Campaign01:46 · SecurityOnline · Picked up again

  6. Quiet for 5 weeks

    Thu 16 OctDay 491
    1. North Korean Hackers Deploy BeaverTail–OtterCookie Combo for Keylogging Attacks13:40 · GBHackers · Picked up again

  7. Quiet for 7 days

    Thu 23 OctDay 561
    1. Lazarus Group Hunts European Drone Manufacturing Data04:31 · Dark Reading · Picked up again

  8. Quiet for 5 days

    Tue 28 OctDay 615
    1. Crypto wasted: BlueNoroff’s ghost mirage of funding and jobs03:30 · Securelist · Picked up again
    2. Lazarus Group Attacks with DreamLoader Malware, Leveraging DLL Sideloading and Microsoft Graph API for Stealth C204:01 · SecurityOnline
    3. BlueNoroff Shifts Tactics: Targets C-Suite and Managers with New Infiltration Methods09:47 · GBHackers
    Show 2 more from 28 Oct
    1. Researchers Expose GhostCall and GhostHire: BlueNoroff's New Malware Chains16:40 · The Hacker News
    2. North Korea's BlueNoroff Expands Scope of Crypto Heists17:10 · Dark Reading
  9. Wed 29 OctDay 621
    1. BlueNoroff APT Launches AI-Enhanced Espionage on macOS, Using GPT-4o Images in Fake GhostCall Meetings01:25 · SecurityOnline

  10. Quiet for 2 days

    Fri 31 OctDay 641
    1. Kimsuky and Lazarus Hackers Deploy New Backdoor Tools for Remote Access Attacks07:31 · GBHackers · Picked up again

  11. Quiet for 3 days

    Mon 3 NovDay 671
    1. North Korean APTs Upgrade Arsenal: Kimsuky Uses Stealthy HttpTroy, Lazarus Deploys New BLINDINGCAN RAT01:01 · SecurityOnline · Picked up again

  12. Quiet for 8 days

    Tue 11 NovDay 752
    1. Lazarus Group Attacks Aerospace/Defense with New ChaCha20-Encrypted Comebacker Backdoor01:00 · SecurityOnline · Picked up again
    2. Lazarus Group Deploys Weaponized Documents Against Aerospace & Defense06:31 · GBHackers

  13. Quiet for 7 days

    Tue 18 NovDay 821
    1. DOJ Seizes $15M in Crypto from APT38, Unveils Guilty Pleas in North Korean IT Worker Fraud Scheme02:45 · SecurityOnline · Picked up again

  14. Quiet for 2 days

    Thu 20 NovDay 841
    1. Lazarus Group’s New ScoringMathTea RAT Uses Reflective Plugin Loader and Custom Polyalphabetic Crypto for Espionage02:01 · SecurityOnline

  15. Quiet for 2 weeks

    Wed 3 DecDay 971
    1. Researchers spotted Lazarus’s remote IT workers in action14:16 · Security Affairs · Picked up again

  16. Quiet for 3 weeks

    Mon 22 DecDay 1161
    1. Shadows of the North: Unmasking the Sprawling Cyber Infrastructure of the DPRK00:41 · SecurityOnline · Picked up again

  17. Quiet for 6 weeks

    Tue 3 FebDay 1591
    1. Hydra Tactics: North Korea’s LABYRINTH CHOLLIMA Splits to Hunt Crypto & Secrets03:15 · SecurityOnline · Picked up again

  18. Quiet for 2 days

    Thu 5 FebDay 1611
    1. “Can You Hear Me?” BlueNoroff Hackers Use Fake Audio Glitch to Breach macOS01:55 · SecurityOnline

  19. Quiet for 8 days

    Fri 13 FebDay 1691
    1. Dream Job or Nightmare? Lazarus Group Hunts Crypto Devs with “Graphalgo” Malware01:15 · SecurityOnline · Picked up again

  20. Quiet for 3 days

    Sun 15 FebDay 1711
    1. Malicious npm and PyPI packages linked to Lazarus APT fake recruiter campaign18:35 · Security Affairs · Picked up again

  21. Quiet for 9 days

    Tue 24 FebDay 1801
    1. Lazarus adopts Medusa RaaS to extort hospitals and charities12:11 · The Hacker News · Picked up again
  22. Wed 25 FebDay 1811
    1. Lazarus uses Medusa ransomware to extort Middle East group08:55 · Security Affairs

  23. Quiet for 8 weeks

    Tue 21 AprDay 2363
    1. Lazarus linked to $293m KelpDAO heist via LayerZero flaw08:41 · Infosecurity · Picked up again
    2. North Korea linked hackers steal $290M from Kelp DAO DeFi10:21 · SecurityWeek
    3. Lazarus Group siphons $290M from Kelp DAO via LayerZero exploit19:27 · Security Affairs

  24. Quiet for 3 days

    Fri 24 AprDay 2391
    1. Lazarus Group targets macOS users with ClickFix fake meeting scam13:17 · Dark Reading · Picked up again

  25. Quiet for 4 days

    Tue 28 AprDay 2432
    1. North Korean hackers use fake Zoom links to steal crypto wallets08:30 · Infosecurity · Picked up again
    2. North Korea’s BlueNoroff uses fake Zoom to steal crypto exec data22:27 · Dark Reading

  26. Quiet for 3 days

    Fri 1 MayDay 2461
    1. Lazarus Exploits Fake Interviews to Steal Developer Credentials18:41 · dti.domaintools.com · Picked up again

  27. Quiet for 6 days

    Thu 7 MayDay 2521
    1. Fake Google Authenticator Chrome Extension Hits 260k Users23:25 · dti.domaintools.com · Picked up again

  28. Quiet for 2 weeks

    Mon 25 MayDay 2701
    1. Lazarus Group Deploys Memory Only RAT Against Crypto and Banks11:11 · The Hacker News · Picked up again
  29. Tue 26 MayDay 2711
    1. Lazarus Uses Fileless RemotePE RAT Powered by DPAPI Loader08:41 · Security Affairs · This article, 38th of 60

  30. Quiet for 3 days

    Fri 29 MayDay 2741
    1. North Korean hackers deploy memory only toolset against banks08:28 · SecurityOnline · Picked up again

  31. Quiet for 5 weeks

    Fri 3 JulDay 3091
    1. Lazarus-Linked npm Malware Masquerades as Rollup Polyfills10:53 · SecurityOnline · Picked up again

  32. Quiet for 3 weeks

    Fri 24 JulDay 3301
    1. BlueNoroff Zoom Phishing Kit Hits Crypto Wallets With Profiling16:30 · The Hacker News · Picked up again

  33. Quiet for 6 days

    Thu 30 JulDay 3361
    1. North Korean Hackers Exploit Fake Zoom Calls to Steal Crypto Data07:20 · SecurityOnline · Picked up again
  34. Fri 31 JulDay 3371
    1. Lazarus shares tools with Gunra ransomware in South Korea attacks13:09 · DataBreaches

  35. Quiet for 4 days

    Tue 4 AugDay 3411
    1. North Korean Hackers Hijack NPM Packages via Social Engineering09:31 · SecurityOnline · Picked up again

  36. Quiet for 7 days

    Tue 11 AugDay 3482
    1. Lazarus NullReceiver malware uses npm Ethereum queries for C215:26 · Infosecurity · Picked up again
    2. Lazarus hits defence via fake job PDFs, CVE-2026-6882017:51 · Check Point · Exploited CVE · Known exploited CVE
  37. Wed 12 AugDay 3496
    1. Microsoft Patch Tuesday Patches Critical WinSock Exploit03:40 · SecurityOnline · Known exploited CVE
    2. Lazarus Exploits Windows Zero-Day in Operation Dream Job Attacks03:41 · SecurityOnline · Known exploited CVE
    3. Lazarus uses fake job offers to exploit Windows CVE-2026-6882009:11 · SecurityWeek · Known exploited CVE
    Show 3 more from 12 Aug
    1. MS Patch Tuesday patches 421 flaws, Lazarus zero day exploited14:11 · Malwarebytes
    2. Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day14:11 · Infosecurity · Known exploited CVE
    3. Lazarus Group Exploits Windows Zero Day, Installs Backdoor18:18 · The Hacker News
  38. Thu 13 AugDay 3501
    1. Lazarus Group exploits CVE‑2026‑68820 via fake job offers08:52 · Security Affairs · Known exploited CVE

  39. Quiet for 4 weeks

    Mon 7 SepDay 3751
    1. Researchers Map Lazarus Into Six North Korean Cyber Units11:26 · Infosecurity · Picked up again

  40. Quiet for 6 weeks

    Wed 21 OctDay 4192
    1. Lazarus Group abuses South Korean security software in FlashHole campaign02:31 · Securelist · Picked up again
    2. Lazarus Targets South Korean Firms Through Fake CV Websites11:01 · SecurityOnline

  41. Quiet for 4 days

    Sun 25 OctDay 4231
    1. Security Affairs newsletter rounds up malware and attack reports14:30 · Security Affairs · Picked up again
  42. Mon 26 OctDay 4241
    1. Cyfirma links PHP flaw scans to a North Korean campaign11:30 · Security Affairs · Known exploited CVE
  43. Tue 27 OctDay 4251
    1. CISA adds PHP2Shell flaws to KEV after confirmed attacks04:30 · SecurityOnline · Known exploited CVE

  44. Quiet for 3 days

    Thu 29 OctDay 4271
    1. Microsoft reports North Korean groups expanding AI operations18:30 · Microsoft · Picked up again

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in