Post by @malwaretech@infosec.exchange

2026-04-22 17:11 UTC

I spent nearly 4 months investigating the inner workings of a North Korean state-sponsored hacking group. Here&#39;s what I found: - The group used generative AI tools to aid in almost every part of their operations. - They exfiltrated 26,584 cryptocurrency wallets from victim systems, with a combined value totaling as much $12 million dollars. - In several cases, the threat actors set up entire front companies to lure in developers via fake job posting, then infected them with malware. - The threat actors successfully pulled off a supply-chain attack by compromising a VS Code extension developer&#39;s system. 🔗 Full article: https://expel.com/blog/inside-lazarus-how-north-korea-uses-ai-to-industrialize-attacks-on-developers/

Replies (3)

@Lee_Holmes@infosec.exchange 2026-04-22 17:58

@malwaretech One of the things I love about this investigation is that it actually imposed cost: - Found malware: reported to AV vendors - Saw abuse of Cursor: reported to Cursor, got the accounts suspended - Saw abuse of ChatGPT: reported to OpenAI - Saw that a front website was implemented / hosted on Anima: reported to Anima, got the account suspended Props on engaging like that.

Open ##1635293
@johnbrown@thecanadian.social 2026-04-22 18:27

@malwaretech do you have any first hand evidence of this I can peruse? You know, you hear SO MUCH about that little impoverished, low tech communist country basically being super hackers, behind most world hacks, whose population we firebombed from the air and killed 25% of in a non-defensive conflict once upon a time. Im an old neteng. Do you have anything I can peruse that can help me understand how this is DPRK? Thanks.

Open ##1635295
@gimulnautti@mastodon.green 2026-04-22 18:30

@malwaretech ”Mythos is groundbreaking technology”, unless you count what every single hacking group has been doing the last few years…

Open ##1635301