Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
5 / 13 results
highperson_alertThreat ActorNorth Korea Linked to PHP2Shell Scanning Campaign Targeting Global Infra
North Korean threat actors, attributed with moderate confidence to operators within the Lazarus Group ecosystem, are conducting a deliberate, low-and-slow scanning campaign targeting vulnerable PHP infrastructure globally.
highperson_alertThreat ActorNorth Korea Fraudulent IT Worker Scheme: 14 Charged, 187 Devices Seized
North Korean state-sponsored operation tracked as Famous Chollima, purpledelta, and Wagemole. Active from approximately 2019 to July 2025, this scheme involves DPRK IT workers obtaining remote employment at U.S.
highperson_alertThreat ActorNorth Korea's Contagious Interview Campaign Steals $10.71M in Crypto
North Korean state-sponsored threat actors operating under the 313 General Bureau of the Munitions Industry Department. The activity is tracked under multiple names including CL-STA-0240, DeceptiveDevelopment, DEV#POPPER, Famous Chollima, Gwisin Gang…
highperson_alertThreat ActorNorth Korean IT Worker Scheme Expands Into Healthcare and Sales Roles
North Korean state-sponsored threat actors, tracked as Famous Chollima, Jasper Sleet, Nickel Tapestry, PurpleDelta (formerly TAG-121), UNC5267, and Wagemole, operate a sophisticated job fraud scheme to generate revenue for the DPRK's nuclear weapons…
highperson_alertThreat ActorNorth Korea IT Worker Infiltration Targets Crypto and Tech Firms
North Korean IT worker operations, attributed by researchers to Famous Chollima (a CrowdStrike designation under the Lazarus umbrella), involve operatives seeking employment at Western technology and cryptocurrency companies under fraudulent identiti…