˚✦APT33 ✫ ·
.
˚ · . ✷ ✦APT35 ˚ .
✫ * ⠀.
⠀⠀. * ⠀⠀ .
* . ✦APT38
✦ APT41 . * ˚ ﾟ.
✫ · ˚
╱|、
(˚ˎ 。7
|、˜〵
じしˍ,)ノ
.
˚ · . ✷ ✦APT35 ˚ .
✫ * ⠀.
⠀⠀. * ⠀⠀ .
* . ✦APT38
✦ APT41 . * ˚ ﾟ.
✫ · ˚
╱|、
(˚ˎ 。7
|、˜〵
じしˍ,)ノ
November 16, 2024 at 6:17 PM
˚✦APT33 ✫ ·
.
˚ · . ✷ ✦APT35 ˚ .
✫ * ⠀.
⠀⠀. * ⠀⠀ .
* . ✦APT38
✦ APT41 . * ˚ ﾟ.
✫ · ˚
╱|、
(˚ˎ 。7
|、˜〵
じしˍ,)ノ
.
˚ · . ✷ ✦APT35 ˚ .
✫ * ⠀.
⠀⠀. * ⠀⠀ .
* . ✦APT38
✦ APT41 . * ˚ ﾟ.
✫ · ˚
╱|、
(˚ˎ 。7
|、˜〵
じしˍ,)ノ
Uncovered: Lazarus Group's #APT38 uses Cosmic Rust malware to target macOS devices, linking back to known C&C servers. This highlights ongoing threats from North Korean hackers involved in global financial attacks. 💻💥 #LazarusGroup #Korea www.hendryadrian.com/apt38-infras...
APT38 Infrastructure Hunt Uncovers macOS Malware
North Korean threat actor Lazarus Group and its financially motivated subgroup APT38 (Bluenoroff) have conducted extensive cyberattacks targeting financial institutions worldwide, including the notabl...
www.hendryadrian.com
June 28, 2025 at 10:33 PM
Uncovered: Lazarus Group's #APT38 uses Cosmic Rust malware to target macOS devices, linking back to known C&C servers. This highlights ongoing threats from North Korean hackers involved in global financial attacks. 💻💥 #LazarusGroup #Korea www.hendryadrian.com/apt38-infras...
#FBI has confirmed that #NorthKorean hackers stole $1.5 billion from cryptocurrency exchange #Bybit on Friday in the largest crypto heist recorded until now.
#LazarusGroup #APT38 #CyberCrime www.bleepingcomputer.com/news/securit...
#LazarusGroup #APT38 #CyberCrime www.bleepingcomputer.com/news/securit...
FBI confirms Lazarus hackers were behind $1.5B Bybit crypto heist
FBI has confirmed that North Korean hackers stole $1.5 billion from cryptocurrency exchange Bybit on Friday in the largest crypto heist recorded until now.
www.bleepingcomputer.com
February 27, 2025 at 8:11 AM
#FBI has confirmed that #NorthKorean hackers stole $1.5 billion from cryptocurrency exchange #Bybit on Friday in the largest crypto heist recorded until now.
#LazarusGroup #APT38 #CyberCrime www.bleepingcomputer.com/news/securit...
#LazarusGroup #APT38 #CyberCrime www.bleepingcomputer.com/news/securit...
May 5, 2025 at 10:02 PM
May 5, 2025 at 10:01 PM
Let’s talk name retirement!
Aside from the obvious ones in DPRK land, I think APT38 can probably get sunset
There’s probably a bunch of Chinese groups that this would apply to
Aside from the obvious ones in DPRK land, I think APT38 can probably get sunset
There’s probably a bunch of Chinese groups that this would apply to
May 21, 2025 at 9:59 PM
Let’s talk name retirement!
Aside from the obvious ones in DPRK land, I think APT38 can probably get sunset
There’s probably a bunch of Chinese groups that this would apply to
Aside from the obvious ones in DPRK land, I think APT38 can probably get sunset
There’s probably a bunch of Chinese groups that this would apply to
The FBI seized $500k worth of crypto stolen by APT38 from Rain[.]com in April
www.courtlistener.com/docket/69432...
www.courtlistener.com/docket/69432...
Complaint – #1 in United States v. APPROXIMATELY 2210.8222 OF SOL CRYPTOCURRENCY (D.D.C., 1:24-cv-03375) – CourtListener.com
COMPLAINT against APPROXIMATELY 2210.8222 OF SOL CRYPTOCURRENCY (Fee Status:Filing Fee Waived) filed by UNITED STATES OF AMERICA. (Attachments: # 1 Civil Cover Sheet)(Blaylock, Rick) (Entered: 12/03/2...
www.courtlistener.com
December 8, 2024 at 3:17 PM
The FBI seized $500k worth of crypto stolen by APT38 from Rain[.]com in April
www.courtlistener.com/docket/69432...
www.courtlistener.com/docket/69432...
Up next:
Resume Warfare
North Korea isn’t just hacking your infrastructure — it’s applying for jobs.
#InsiderThreat #APT38 #AdversaryTradecraft
Resume Warfare
North Korea isn’t just hacking your infrastructure — it’s applying for jobs.
#InsiderThreat #APT38 #AdversaryTradecraft
May 5, 2025 at 9:48 PM
Up next:
Resume Warfare
North Korea isn’t just hacking your infrastructure — it’s applying for jobs.
#InsiderThreat #APT38 #AdversaryTradecraft
Resume Warfare
North Korea isn’t just hacking your infrastructure — it’s applying for jobs.
#InsiderThreat #APT38 #AdversaryTradecraft
Blockchain investigator ZachXBT has published a report on how the APT38 (Bluenoroff) group laundered $200 million worth of crypto from 25+ hacks to fiat between 2020 and 2023.
paragraph.com/@investigati...
paragraph.com/@investigati...
How Lazarus Group laundered $200M from 25+ crypto hacks to fiat from 2020–2023
Table of contents1). Introduction 2). CoinBerry, Unibright, & CoinMetro hacks 3). Nexus Mutual founder hack 4). EasyFi hack 5). Bondly hack 6). Unreported hacks 7). MGNR and PolyPlay hacks 8). bZx hac...
paragraph.com
November 20, 2025 at 1:34 PM
Blockchain investigator ZachXBT has published a report on how the APT38 (Bluenoroff) group laundered $200 million worth of crypto from 25+ hacks to fiat between 2020 and 2023.
paragraph.com/@investigati...
paragraph.com/@investigati...
"Lazarus Phishing Campaign Detected (APT38)" published by BretWitt. #APT38, #Youtube, #DPRK, #CTI https://www.youtube.com/watch?v=py4KMWYCgPk
June 30, 2025 at 1:30 PM
"Lazarus Phishing Campaign Detected (APT38)" published by BretWitt. #APT38, #Youtube, #DPRK, #CTI https://www.youtube.com/watch?v=py4KMWYCgPk
@molly.wiki DPRK is pushing 4 billion in stolen crypto. Seems like crypto is a boon for NK
github.com/tayvano/laza...
github.com/tayvano/laza...
GitHub - tayvano/lazarus-bluenoroff-research: a collection of north korean apt articles, analysis and heists attributed to lazarus / bluenoroff / apt38.
a collection of north korean apt articles, analysis and heists attributed to lazarus / bluenoroff / apt38. - tayvano/lazarus-bluenoroff-research
github.com
November 23, 2024 at 4:50 AM
@molly.wiki DPRK is pushing 4 billion in stolen crypto. Seems like crypto is a boon for NK
github.com/tayvano/laza...
github.com/tayvano/laza...
#OpenAI says it blocked several North Korean hacking groups from using its #ChatGPT platform to research future targets and find ways to hack into their networks.
#APT38 #CyberAttacks #CyberAlert #Hacking www.bleepingcomputer.com/news/securit...
#APT38 #CyberAttacks #CyberAlert #Hacking www.bleepingcomputer.com/news/securit...
OpenAI bans ChatGPT accounts used by North Korean hackers
OpenAI says it blocked several North Korean hacking groups from using its ChatGPT platform to research future targets and find ways to hack into their networks.
www.bleepingcomputer.com
February 25, 2025 at 1:45 AM
#OpenAI says it blocked several North Korean hacking groups from using its #ChatGPT platform to research future targets and find ways to hack into their networks.
#APT38 #CyberAttacks #CyberAlert #Hacking www.bleepingcomputer.com/news/securit...
#APT38 #CyberAttacks #CyberAlert #Hacking www.bleepingcomputer.com/news/securit...
DOJ cracks down on North Korea’s crypto scheme! 🇰🇷➡️💰 $15M in USDT seized linked to cyberattacks by “APT38.” Individuals convicted of helping North Korea evade sanctions & using fake identities to work remotely for US firms, funding weapons programs. (CoinDesk)
#crypto #blockchain #news
#crypto #blockchain #news
November 14, 2025 at 6:02 PM
DOJ cracks down on North Korea’s crypto scheme! 🇰🇷➡️💰 $15M in USDT seized linked to cyberattacks by “APT38.” Individuals convicted of helping North Korea evade sanctions & using fake identities to work remotely for US firms, funding weapons programs. (CoinDesk)
#crypto #blockchain #news
#crypto #blockchain #news
So are the puppet masters... As APT28,APT29, APT38... If you want I can give you their number so you can SMS them..
July 16, 2025 at 3:03 PM
So are the puppet masters... As APT28,APT29, APT38... If you want I can give you their number so you can SMS them..
"USA v. APPROXIMATELY 2210.8222 OF SOL CRYPTOCURRENCY" published by USCOURTS. #APT38, #Cryptocurrency, #Rain, #TraderTraitor, #DPRK, #CTI https://storage.courtlistener.com/recap/gov.uscourts.dcd.275374/gov.uscourts.dcd.275374.1.0.pdf
December 9, 2024 at 12:33 PM
"USA v. APPROXIMATELY 2210.8222 OF SOL CRYPTOCURRENCY" published by USCOURTS. #APT38, #Cryptocurrency, #Rain, #TraderTraitor, #DPRK, #CTI https://storage.courtlistener.com/recap/gov.uscourts.dcd.275374/gov.uscourts.dcd.275374.1.0.pdf
This PowerShell sample attributed to APT38 is already noisy af when scanned with THOR and the .bat that gets dropped also triggers a rule
PS1
https://
virustotal.com/gui/file/675bb
a15b954318398f1a34aef4ecffce515feb35130fb12a8…
— from @cyb3rops (https://x.com/cyb3rops/status/2068244526611788001)
PS1
https://
virustotal.com/gui/file/675bb
a15b954318398f1a34aef4ecffce515feb35130fb12a8…
— from @cyb3rops (https://x.com/cyb3rops/status/2068244526611788001)
June 20, 2026 at 1:15 PM
This PowerShell sample attributed to APT38 is already noisy af when scanned with THOR and the .bat that gets dropped also triggers a rule
PS1
https://
virustotal.com/gui/file/675bb
a15b954318398f1a34aef4ecffce515feb35130fb12a8…
— from @cyb3rops (https://x.com/cyb3rops/status/2068244526611788001)
PS1
https://
virustotal.com/gui/file/675bb
a15b954318398f1a34aef4ecffce515feb35130fb12a8…
— from @cyb3rops (https://x.com/cyb3rops/status/2068244526611788001)
"Justice Department Announces Nationwide Actions to Combat Illicit North Korean Government Revenue Generation" published by USJustice. #APT38, #ITWorker, #News, #DPRK, #CTI https://www.justice.gov/opa/pr/justice-department-announces-nationwide-actions-combat-illicit-north-korean-government
November 15, 2025 at 1:30 PM
GhostCall & GhostHire — two ongoing campaigns tied to North Korea’s Lazarus sub-cluster BlueNoroff, part of the long-running SnatchCrypto operation. They target Web3 and blockchain professionals via Telegram lures posing as investors or recruiters.
#CyberEspionage #APT38 #Web3Threats
#CyberEspionage #APT38 #Web3Threats
October 30, 2025 at 11:26 AM
GhostCall & GhostHire — two ongoing campaigns tied to North Korea’s Lazarus sub-cluster BlueNoroff, part of the long-running SnatchCrypto operation. They target Web3 and blockchain professionals via Telegram lures posing as investors or recruiters.
#CyberEspionage #APT38 #Web3Threats
#CyberEspionage #APT38 #Web3Threats
Says you and your visibility - which is not mine. I think you will never get agreement on this so don’t bother trying. Don’t talk to me about APT38. Talk to me about the activity you’re seeing. The facts are indisputable- the names will be argued over for eternity.
May 22, 2025 at 1:07 AM
Says you and your visibility - which is not mine. I think you will never get agreement on this so don’t bother trying. Don’t talk to me about APT38. Talk to me about the activity you’re seeing. The facts are indisputable- the names will be argued over for eternity.
Malicious versions of three Rust packages, one of which Wiz finds in more than 35 percent of environments, ran a backdoor during compilation. The attacker infrastructure overlaps heavily with recent North Korean supply chain attacks.
#APT38 #APT #infosec
#APT38 #APT #infosec
Hijacked Rust package backdoors any machine that builds it
Nation-State · IntelFusions threat intelligence
www.intelfusions.com
August 20, 2026 at 11:22 PM
US DOJ seized $15M in USDT linked to North Korean cybercrime! 🇰🇵💰 Five pleaded guilty to helping North Korean hackers get remote IT jobs with US firms via fake IDs & stolen credentials. Impacted 136+ companies, generating $2.2M for the regime. Linked to APT38. #cryptocrime #NorthKorea
November 15, 2025 at 12:26 AM
US DOJ seized $15M in USDT linked to North Korean cybercrime! 🇰🇵💰 Five pleaded guilty to helping North Korean hackers get remote IT jobs with US firms via fake IDs & stolen credentials. Impacted 136+ companies, generating $2.2M for the regime. Linked to APT38. #cryptocrime #NorthKorea
North Korea...
...is funding nuclear weapons...
...with cryptocurrency hacks.
https://www.wired.co.uk/article/north-korea-hackers-apt38-cryptocurrency
North Korea's elite hackers are funding nukes with crypto...
APT 38 is Kim Jong-un's highly skilled group of bank hack...
www.wired.co.uk
November 23, 2024 at 1:33 AM
North Korea...
...is funding nuclear weapons...
...with cryptocurrency hacks.
https://www.wired.co.uk/article/north-korea-hackers-apt38-cryptocurrency
Park Jin HYOK is wanted by the FBI for his role as a hacker for hashtag#DPRK, specifically his affiliation with hashtag#Lazerus group also known as hashtag#APT38.
My starting point was the 4 name/alias variants of his name shared on the hashtag#FBI most wanted page and the image of his face.
My starting point was the 4 name/alias variants of his name shared on the hashtag#FBI most wanted page and the image of his face.
November 20, 2025 at 1:31 PM
Park Jin HYOK is wanted by the FBI for his role as a hacker for hashtag#DPRK, specifically his affiliation with hashtag#Lazerus group also known as hashtag#APT38.
My starting point was the 4 name/alias variants of his name shared on the hashtag#FBI most wanted page and the image of his face.
My starting point was the 4 name/alias variants of his name shared on the hashtag#FBI most wanted page and the image of his face.