← threat actors
threat actor · not yet in the cluster map
north-korea
also tracked as contagious interview 1
3 stories · 3 in the wild · July 4, 2026 – August 17, 2026
evidence: 3 observed
how they got in
- browser extension 1 · Jul 5
- package registry 1 · Jul 5
sectors
- developers 1 · Jul 5
- crypto 1 · Jul 4
techniques
- privilege escalation 1 · Aug 17
attack phases seen
- Privilege escalation 1 · Aug 17
- Execution 1 · Jul 5
- Initial access 1 · Jul 5
what we reported, newest first, grouped by story
August 17, 2026
- North Korea has burned the same Windows driver four times in four years. Researchers note DPRK operators keep returning to
afd.sys, the Ancillary Function Driver for WinSock, as a reliable exploitation target (@cyb3rops).
· Aug 17 · observed · Threat Intelligence
Jul 4 – July 5, 2026 · 2 reports
- North Korea's PolinRider campaign publishes 108 malicious packages/extensions across npm, Packagist, Go, and the Chrome Web Store, linked to the ongoing Contagious Interview cluster. Compromised maintainer accounts mean the count is expected to grow. The Hacker News
· Jul 5 · observed · via package registry · as contagious interview · Threat Activity
- NCSC-FI: North Korea stole ~$643M in crypto in H1 2026. Finland's NCSC highlighted a TRM Labs report finding roughly two-thirds of all crypto stolen worldwide this year went to North Korea-linked groups, out of nearly $1B in total losses. NCSC-FI / Yle
· Jul 4 · observed · Threat Intelligence