Sign in Subscribe

Lazarus Group

Lazarus Group is a North Korean state-sponsored threat actor conducting espionage, cryptocurrency theft, and destructive attacks. Also tracked as Diamond Sleet, Hidden Cobra, UNC2970, and APT-Q-1 depending on the reporting vendor.

Trending Topics

CVE‑2026‑32202

Trending Topics

CISA flags an actively exploited Windows Shell zero-day, CVE-2026-32202. A GitHub race condition could have enabled mass repo hijacking. LiteLLM SQL injection exposes AI provider keys. Lazarus Group targets macOS crypto users via fake meeting invites.

Trending Topics

Dohdoor Backdoor Campaign

Trending Topics

Dohdoor backdoor campaign hits U.S. schools and healthcare with possible Lazarus ties. APT37 uses USB couriers to bridge air-gapped networks in the Ruby Jumper campaign. Infostealer-sourced credentials fuel brute-force attacks on F5 BIG-IP logins.

Trending Topics

Trending Topics

Lazarus subgroup Andariel (Stonefly) joins the Medusa ransomware ecosystem, targeting U.S. healthcare. Anthropic alleges Chinese AI labs ran industrial-scale Claude distillation via 24,000 fake accounts. A malicious npm package hides Pulsar RAT inside PNG steganography.

Trending Topics

Trending Topics

Lazarus Group's "Fake Font" campaign abuses VS Code tasks to deploy InvisibleFerret via fake coding interviews. Stanley MaaS guarantees Chrome Web Store approval for phishing extensions. Amatera Stealer spreads via fake CAPTCHA and App-V LOLBIN abuse.

Trending Topics

Trending Topics

UNC6229 targets job seekers to steal ad credentials. Lazarus Group (Diamond Sleet, Hidden Cobra, UNC2970) targets European defense engineers via fake job offers. YouTube Ghost Network spreads malware via 3,000 videos. Top CVEs of the week.

Trending Topics

Trending Topics

Fake Microsoft Teams site spreads Odyssey macOS stealer. Atomic Stealer hides in cracked software. Lazarus Group (tracked as APT-Q-1) adds ClickFix social engineering to its espionage campaigns. iCloud Calendar invites abused for phishing.

Trending Topics

Trending Topics

Chrome zero-day CVE-2025-6558 hits multiple platforms via WebKit. RedHook Android trojan impersonates banks in Vietnam. Gunra ransomware adds a Linux variant. Lazarus Group refines its Contagious Interview malware delivery to evade detection.

Trending Topics

Trending Topics

Tax-season phishing hits U.S. orgs via fake Microsoft 365 pages. Lazarus Group pairs fake crypto job interviews with ClickFix to deploy GolangGhost. Hunters International rebrands as WorldLeaks, dropping ransomware for pure data extortion.

Monthly Wrap - March 2025

State Sponsored

Monthly Wrap - March 2025

Lazarus Group uses CAPTCHA phishing and Lumma Stealer to hit crypto wallets. APT41 exploits Check Point VPN flaw to deploy ShadowPad. LockBit hits Confluence CVE-2023-22527 for fast ransomware deployment. Mustang Panda and Kimsuky continue espionage campaigns.

Monthly Wrap - February 2025

State Sponsored

Monthly Wrap - February 2025

February 2025 wrap: Vo1d botnet compromises 1.5M Android TVs. Lazarus Group and Mustang Panda continue espionage campaigns. Sandworm (APT44) targets Ukraine via fake Windows activators. LockBit and Cl0p exploit zero-days.