North Korea's Fake IT Worker Infiltration Campaign
TLP: WHITE
Audience: Human Resources Leadership
Prepared by: Threat Intelligence
01 May
DPRK
Defense Industrial Base Targeting and External Threat Exposure
Adversaries linked to Russia, China, Iran, and North Korea are targeting the defense industrial base through recruitment scams, secure-messaging takeovers, and end-of-support edge devices to gain long-dwell access to controlled technical data.
Trending Topics
Lazarus Group's "Fake Font" campaign abuses VS Code tasks to deploy InvisibleFerret via fake coding interviews. Stanley MaaS guarantees Chrome Web Store approval for phishing extensions. Amatera Stealer spreads via fake CAPTCHA and App-V LOLBIN abuse.
Trending Topics
TRENDING TOPICS
JAN 15, 2026
Microsoft Disrupts RedVDS Cybercrime Subscription Service Fueling
Trending Topics
TRENDING TOPICS
NOV 26, 2025
Russian RomCom Uses SocGholish to Deliver Mythic
Trending Topics
TRENDING TOPICS
NOV 24, 2025
Update: DPRK Expands Contagious Interview Operation With
Trending Topics
APT36 (Transparent Tribe) adapts ClickFix attacks to target Linux systems. APT37 targets North Korea-focused activists with fileless malware in Operation ToyBox Story. DPRK remote work fraud indictments reveal $88 million funneled through fake IT hires.