Lazarus Group

November 4, 2026

• Chinese researchers describe a new Lazarus campaign dubbed "FlashHole" using AI-generated résumés as the lure, abusing banking security software for intrusion, running in memory, and using GitHub for C2 (report). · Nov 4 · observed · via fake recruiter · Nation-State & Espionage

October 28, 2026

• Lazarus Group is behind Operation FlashHole, a campaign active since at least July 2025 against at least three South Korean organisations in construction, software and wire-communication equipment manufacturing, abusing South Korean security software for delivery and using post-quantum encryption in its malware, per Kaspersky (The Hacker News). · Oct 28 · observed · via software update · Espionage & Threat Activity

Sep 25 – September 26, 2026 · 2 reports

• Bitget revised its loss upward to ~$387.5M from the initial ~$351.6M, attributing the difference to a fuller count of Zcash and TRON transfers during the same 24 September incident rather than new unauthorised movement. The attack path has been identified and the underlying vulnerability fixed; a recovery bounty pays 5% for voluntarily freezing attacker funds and 5% on recovery, and a $464M user protection fund will cover losses. CEO Gracy Chen cites IPs, behavioural patterns and on-chain signatures pointing to North Korea-linked groups; Mandiant and SlowMist are engaged (The Record, Bitget) (earlier coverage). · Sep 26 · observed · Threat Intelligence
• Bitget lost roughly $351.6M from hot and warm wallets; the CEO points at North Korea. Unauthorized transfers were detected at 18:31 UTC on 24 September. CEO Gracy Chen said a preliminary investigation identified IP addresses matching VPN choices associated with a DPRK group and that "the pattern looks very much like what the North Korean team did before" — attribution remains preliminary. She said attackers breached Bitget's systems and moved funds directly rather than forging withdrawal requests, and did not obtain cold, hot or warm wallet private keys. Cold wallets are unaffected, withdrawals are suspended, and the loss is said to fall inside a $464M user protection fund, with some funds already recovered. Cointelegraph, Bitget CEO · Sep 25 · observed · Threat Activity

Sep 9 – September 19, 2026 · 2 reports

• A five-country advisory names "WaterPlum" — FBI and DoD with Japan's National Police Agency and agencies in Australia and Germany. Between December 2025 and July 2026 the North Korean actors infected at least 30,000 devices across 100 countries, took funds or credentials from about 7,000 cryptocurrency wallets, and stole more than $10.5 million, luring web designers, engineers and crypto specialists into downloading files during fake interviews. Japanese police found BeaverTail, InvisibleFerret, OtterCookie, OtterCandy and StoatWaffle variants, with infostealers plus RMM tooling kept in place in the hope victims later get hired at target firms (The Record, The Register). · Sep 19 · observed · via fake recruiter · as waterplum · Threat Activity
• The Lazarus umbrella has been decomposed into six clusters. Kudelski Security and Sekoia map DPRK cyber capability onto TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet and Famous Chollima following a reorganization of the North Korean intelligence service two years ago, mixing espionage with crypto theft, ransomware and bank heists, and place each in the state structure (Kudelski Security). · Sep 9 · none · as temp hermit, citrine sleet, cryptocore, jade sleet, moonstone sleet, famous chollima · Threat Activity

September 5, 2026

• Fake-company employment scams got a research treatment linking the infrastructure and tradecraft to Lazarus Group patterns (Schneier) — the same lure family as above. · Sep 5 · none · via fake recruiter · Supply Chain & Build Pipelines

Aug 21 – August 22, 2026

• The poisoned arrayref Rust crate is now linked to North Korean actors. Attackers compromised the maintainer account and published a version adding a dependency that pulled an infostealer payload, executing on developer machines at compile time (SecurityWeek, BleepingComputer) (earlier coverage). · Aug 22 · observed · via package registry · Supply Chain

August 16, 2026

• Lazarus hid a zero-day behind post-quantum cryptography — Denmark's CERT.dk reported that the DPRK group concealed exploitation of a 0-day flaw using post-quantum crypto to frustrate analysis and detection. CERT.dk · Aug 16 · observed · Threat Activity

Aug 4 – August 14, 2026

• DPRK-linked NullReceiver loaders found in infected GitHub repositories. The loaders decode Ethereum wallet recipient addresses as embedded IPv4 stages — reusing the C2 technique documented by OpenSourceMalware. (OpenSourceMalware) · Aug 14 · observed · via supply chain · Threat Activity

Jul 30 – July 31, 2026 · 2 reports

• Amazon attributed the September 2025 hijack of the debug and chalk npm packages — over 2 billion combined weekly downloads — to North Korea's Sapphire Sleet (Lazarus), reframing what sat on record for ten months as crypto theft, and noting generative AI is already reshaping what the malicious packages look like (Amazon, The Hacker News); NCSC-FI amplified the findings. This sharpens the DPRK attribution flagged in earlier coverage. · Jul 31 · observed · via package registry · Threat Activity
• DPRK's BlueNoroff is now linked to the axios, debug, chalk and typo-crypto npm compromises, per new analysis tying the campaigns to a single threat actor. blackorbird · Jul 30 · observed · via package registry · as bluenoroff · Threat Activity

July 29, 2026

• Lazarus Group drove 55% of H1 2026 crypto losses in Blockaid's report — ~$609M of a record $1.1B across 212 exploits, led by KelpDAO ($292M) and Drift Protocol ($285M), with compromised private keys behind 74% of dollar losses. The report also flags what it calls the first AI prompt-injection exploit, tricking an agent into approving a $216K transaction (Coin Bureau summary). · Jul 29 · observed · Threat Activity

July 28, 2026

• JUMPSEC dissected a BlueNoroff (DPRK/Lazarus) ClickFix malware kit that abuses hijacked Telegram accounts and fake meetings to target high-value victims, deploying sophisticated Windows and macOS payloads over infrastructure tied to Cloudzy/RouterHosting (JUMPSEC). · Jul 28 · observed · via messaging app · as bluenoroff · Threat Activity

July 25, 2026

• BlueNoroff Zoom phishing kit profiles crypto wallets. The North Korean crew's typosquatted Zoom/Teams ClickFix operation runs an active kit that fingerprints wallets before deciding on malware delivery. The Hacker News. · Jul 25 · observed · via phishing email · as bluenoroff · Threat Activity

July 16, 2026

• Lazarus has augmented its RAT with a dedicated keylogger (KKernel.exe) using a three-tier cascaded capture chain — Raw Input first, falling back to a global low-level keyboard hook, then async polling of all 256 virtual keys — logging at sentence granularity with foreground-window context. blackorbird (X) · Jul 16 · observed · Threat Activity

July 13, 2026

• Lazarus reportedly used CVE-2024-21338 as a zero-day with no BYOVD required — the vulnerable driver already ships on every Windows machine, removing the need to drop one (@cr3ghost via Dinosn). · Jul 13 · disclosed · Threat Activity

July 4, 2026

• Lazarus-linked npm campaign is still running. JFrog tied fresh packages ("rollup-packages-polyfill-core," "rollup-runtime-polyfill-core") impersonating Rollup polyfill tooling to North Korea; Nextron reports new JSONKeeper URLs and a new C2 (147.189.172.105) dropping and executing 0001.dat via node. The Hacker News · Nextron · Jul 4 · observed · via package registry · Threat Intelligence