"Beyond Lazarus: Organization of DPRK Cyber Capabilities" published by KudelskiSecurity. #APT38, #Andariel, #Kimsuky, #CryptoCore, #TEMPHermit, #JadeSleet, #CitrineSleet, #ITWorker, #MoonstoneSleet, #Lazarus https://kudelskisecurity.com/research/beyond-lazarus-organization-of-dprk-cyber-capabilities

"1inch-analysis.app — A DPRK Trojan Horse" published by pcaversaccio. #CitrineSleet, #DPRK, #CTI https://hackmd.io/@pcaversaccio/1inch-analysis-app-a-dprk-trojan-horse

"State-Sponsored Financially Motivated Attacks" published by Microsoft. #CitrineSleet, #Cryptocurrency, #Slides, #3CXDesktopApp, #CTI, #OSINT, #LAZARUS https://speakerdeck.com/fr0gger/state-sponsored-financially-motivated-attacks

Our investigation into malware #POOLRAT and a new variant PondRAT uncovers a scheme by Gleaming Pisces (aka #CitrineSleet) where Python packages distributed malware via PyPI. Analysis of these backdoors sheds light on tactics of a DPRK-based threat group. bit.ly/3zw3Vzi