Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
|
Description: Multiple state-sponsored hacking groups from Iran, North Korea, and Russia have been found leveraging the increasingly popular ClickFix social engineering tactic to deploy malware over a three-month period from late 2024 through the beginning of 2025.
The phishing campaigns adopting the strategy have been attributed to clusters tracked as TA427 (aka Kimsuky), TA450 (aka MuddyWater,
April 17th, 2025 (3 days ago)
|
|
Description: The North Korea-linked threat actor assessed to be behind the massive Bybit hack in February 2025 has been linked to a malicious campaign that targets developers to deliver new stealer malware under the guise of a coding assignment.
The activity has been attributed by Palo Alto Networks Unit 42 to a hacking group it tracks as Slow Pisces, which is also known as Jade Sleet, PUKCHONG,
April 15th, 2025 (5 days ago)
|
|
Description: North Korean state-sponsored group Slow Pisces (Jade Sleet) targeted crypto developers with a social engineering campaign that included malicious coding challenges.
The post Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware appeared first on Unit 42.
April 14th, 2025 (6 days ago)
|
|
Description: The North Korean threat actors behind the ongoing Contagious Interview campaign are spreading their tentacles on the npm ecosystem by publishing more malicious packages that deliver the BeaverTail malware, as well as a new remote access trojan (RAT) loader.
"These latest samples employ hexadecimal string encoding to evade automated detection systems and manual code audits, signaling a variation
April 5th, 2025 (15 days ago)
|
|
Description: The North Korean threat actors behind Contagious Interview have adopted the increasingly popular ClickFix social engineering tactic to lure job seekers in the cryptocurrency sector to deliver a previously undocumented Go-based backdoor called GolangGhost on Windows and macOS systems.
The new activity, assessed to be a continuation of the campaign, has been codenamed ClickFake Interview by
April 3rd, 2025 (17 days ago)
|
|
Description: By using fake references and building connections with recruiters, some North Korean nationals are landing six-figure jobs that replenish DPRK coffers.
April 2nd, 2025 (18 days ago)
|
|
Description: North Korea’s IT worker scam has expanded widely into Europe after years of focusing on U.S. companies, according to new research.
April 2nd, 2025 (18 days ago)
|
|
April 2nd, 2025 (19 days ago)
|
|
Description: North Korea's IT workers have expanded operations beyond the United States and are now increasingly targeting organizations across Europe. [...]
April 1st, 2025 (19 days ago)
|
|
|
Description: A continuation of the North Korean nation-state threat's campaign against employment seekers uses the social engineering attack to target CeFi organizations with the GolangGhost backdoor.
April 1st, 2025 (19 days ago)
|