News
Cybersecurity news across South Asia and the wider Asia-Pacific — everything from Bangladesh, India, Pakistan, Sri Lanka, and Nepal, plus high-signal incidents from the region. Collected hourly, deduped across outlets.
- Stories in view
- 41 stories
- Countries covered
- 22 countries
- Outlets
- 18 outlets
- Latest story
- 2h ago latest
Filter the wire
showing KP · clear all
Tue 13 Oct1
KP
GBHackers
A Kimsuky campaign that delivers Funhouse ransomware through a malicious Hangul document disguised as a resume. The operation combines embedded OLE objects, sequential scripts, a Python backdoor, and Quasar RAT, linking the September 2026 activity to earlier Endpoint ransomware deployments attributed to the group. The findings indicate continuity rather than an entirely new ransomware operation. […] The post Kimsuky Uses Quasar RAT to Deploy Funhouse Ransomware Through Multi-Stage Scripts appear
Mon 5 Oct1
KP
Cyber Security News
Blockchain investigator ZachXBT says he infiltrated a Chinese crypto laundering network linked to North Korea’s Lazarus Group after the $1.5 billion Bybit hack. His investigation connected private chats with public blockchain records and, he says, helped freeze stolen funds while exposing operators who claimed to handle money from several major thefts. In an October 5 […] The post Researcher Infiltrates Lazarus Group’s Crypto Laundering Network After $1.5B Bybit Hack appeared first on Cyber Secu
Wed 30 Sept1
From Endpoint to Funhouse: Evolution of Ransomware Families and Kimsuky-Linked Distribution Cases
12d agoKP
AhnLab ASEC
1. Overview AhnLab SEcurity intelligence Center (ASEC) recently identified a case in which the Kimsuky group ultimately distributed the Funhouse ransomware via a malicious Hangul document that was disguised as a resume. The Funhouse ransomware was identified as a variant of previously disclosed endpoint ransomware, and the tools used in this attack—such as Quasar RAT—as […]
Tue 29 Sept2
KP
A North Korea-linked malware campaign has found a way to keep infected computers connected to its operators. Instead of storing malware on Ethereum, the attackers hide the location of a control server inside cryptocurrency transfers. The campaign reaches developers through fake job offers, tainted code repositories and malicious software packages. Running the code can install […] The post Hackers Turned Ethereum Into a Secret Messaging System for Malware appeared first on Cyber Security News .
KP
DPRK-linked operators behind the Cross-Chain TxDataHiding (XCTDH) campaign have expanded their blockchain-backed command-and-control infrastructure with a new Ethereum-based recovery channel dubbed HashHiding. The technique stores an active C2 IP address and port inside the recipient address of ordinary Ethereum transfers, allowing infected systems to recover attacker infrastructure without relying on domains, smart contracts, or transaction […] The post DPRK-Linked Hackers Add HashHiding to Blo
Mon 28 Sept2
KP
Cryptocurrency exchange Bitget has begun restoring withdrawals after attackers exploited its backend wallet infrastructure on September 24, stealing approximately $387.5 million from hot and warm wallets. The incident did not involve stolen private keys, and Bitget said its offline cold wallets and separate self-custodial Bitget Wallet service remained unaffected. Nevertheless, the breach demonstrates how attackers […] The post Bitget Backend Breach Drains $387.5 Million as DPRK-Linked Launderer
KP
BleepingComputer
Cryptocurrency exchange Bitget has resumed Bitcoin withdrawals suspended after suspected North Korean hackers breached its systems last week and stole over $350 million. [...]
Sat 26 Sept1
KP
Security Affairs
Bitget says suspected North Korea-linked actors stole $351.6M from hot and warm wallets. Withdrawals were suspended while Mandiant investigates. Cryptocurrency exchange Bitget says suspected North Korea-linked threat actors stole $351.6 million from a limited number of hot and warm wallets. The company detected unauthorized transfers on September 24 and temporarily suspended withdrawals. Bitget said customer […]
Fri 25 Sept3
KP
The Hacker News
Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets. "At 18:31 UTC on September 24, 2026, Bitget's security systems identified unauthorized transfers involving a limited number of hot wallets," BitGet said in a post shared on X. "Bitget's cold wallets and the overwhelming majority of platform assets remain
KP
Cryptocurrency exchange Bitget disclosed today that suspected North Korean hackers have stolen $351.6 million from its hot and warm wallets. [...]
KP
Hackread
Bitget confirms a $351.6 million theft, suspends withdrawals and says North Korea's Lazarus Group may be involved as investigators examine the breach in detail.
Thu 24 Sept1
KP
North Korea-linked threat actor Konni has launched a targeted cyberespionage operation against Ukraine-focused entities using malicious Windows shortcut files disguised as PDF documents. The campaign, tracked by SOCRadar Threat Research Unit as Operation Conflict Compass, deploys a modular PowerShell malware family dubbed VelvetCake to collect intelligence on the Russia-Ukraine war. The activity appears designed to […] The post Operation Conflict Compass Deploys VelvetCake PowerShell Malware Thr
Tue 22 Sept2
KP
Infosecurity Magazine
WaterPlum compromised 30,000 devices and took funds or credentials from 7000 crypto wallets
KP
SOCRadar
Operation Conflict Compass: Konni Targets Ukraine via Malicious LNK Lures Since 2009, the Democratic People’s Republic of Korea (DPRK) has fully integrated cyber operations into its national strategy, leveraging state-ne
Mon 21 Sept3
KP
The North Korean threat actors behind the Contagious Interview campaign have compromised at least 30,000 devices located in more than 100 countries and siphoned funds or account credentials from over 7,000 cryptocurrency wallets, according to a new joint cybersecurity advisory. The primary targets of the campaign are individual web designers, engineers, and specialists in cryptocurrency,
KP
SecurityWeek
It’s unclear if the attacks are part of previous campaigns against Rust, but the techniques used by the attackers match those used by North Korea. The post Rust Team Members and Popular Crate Owners Targeted via Video Calls appeared first on SecurityWeek .
North Korean WaterPlum Hackers Infect 30,000 PCs via Fake Job Interviews, Steal $10.7M Crypto
22d agoKP
North Korean-linked WaterPlum operators have turned job hunting into a route for theft. By posing as recruiters, they persuaded software developers to run harmful files during apparently normal online interviews. The campaign, also known as Contagious Interview, reached at least 30,000 computers in more than 100 countries between December 2025 and July 2026. The attackers […] The post North Korean WaterPlum Hackers Infect 30,000 PCs via Fake Job Interviews, Steal $10.7M Crypto appeared first on
Sun 20 Sept1
KP
CloudSEK
CloudSEK researchers uncovered GHAPPIER, a previously unreported loader operation spanning at least 65 public repositories, 73 infected files and 22 accounts. The investigation began with a compromised legitimate npm package whose malicious release carried valid provenance through trusted publishing. The report maps the wider infrastructure, links parts of the activity to the PolinRider campaign, and details indicators, attack flow and defensive actions. Authors : Vikas Kundu
Sat 19 Sept2
KP
A joint law enforcement advisory warns that the North Korean hacking group WaterPlum compromised at least 30,000 devices worldwide from December 2025 through July 2026 and transferred more than $10.7 million in stolen cryptocurrency to North Korea. [...]
North Korean WaterPlum Hackers Target IT Professionals With Fake Job Interviews to Steal Crypto
24d agoKP
North Korean threat actors, known as WaterPlum (also referred to as Contagious Interview), have infected at least 30,000 devices in over 100 countries by luring software developers and IT professionals into malicious job interviews. This campaign specifically targets web developers, freelancers, blockchain specialists, and cryptocurrency professionals. The attackers use persuasive recruitment messages that mimic legitimate […] The post North Korean WaterPlum Hackers Target IT Professionals With
Fri 18 Sept3
KP
SentinelLabs
North Korean operators built a foothold on a DevOps engineer's Mac in a campaign whose job interview lures deliver malware via Terraform lock files.
KP
The Register
WaterPlum recruiters used bogus coding tests to backdoor jobseekers and raid more than 7,000 crypto wallets
KP
Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit. The new malware family, per OpenSourceMalware, exhibits functional overlaps with two malware strains associated with the Democratic People's Republic of Korea's (DPRK) Contagious Interview campaign: BeaverTail and
Thu 17 Sept1
KP
North Korean operators are using artificial intelligence, remote-control software, and hired stand-ins to make fraudulent job candidates look genuine during technical interviews. The scheme turns routine hiring into a route for sanctions evasion, payroll fraud, data theft, and access to company systems. The activity surfaced through a job advertisement posted in the Mouse Review Discord […] The post North Korean IT Workers Use AI and Remote Desktop Tools to Fake Technical Interviews appeared fir
Wed 16 Sept1
KP
Dark Reading
A likely North Korean advanced persistent threat (APT) group used a previously undocumented Linux espionage toolkit to compromise load balancers, gain access to communications, and further exploit networks.
Sun 13 Sept1
KP
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter REVSTEALER ramps up Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode GuardBreaker: Derailing AI-assisted malware analysis with a code comment DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive […]
Tue 8 Sept1
KP
North Korea-linked hackers hid a backdoor inside HAProxy, masking C2 traffic and stealing data while keeping the load balancer working normally. North Korean-linked hackers found a genuinely clever hiding spot for their malware: inside the actual source code of HAProxy, the load balancing software running at the edge of two South Korean companies’ networks. Rapid7’s […]
Mon 7 Sept2
KP
The stealthy toolkit embeds a backdoor in HAProxy and targets automotive and media organizations in South Korea for long-term surveillance. The post North Korean Hackers Deploy New Linux Espionage Toolkit appeared first on SecurityWeek .
KP
South Korean automotive and media organizations have been hit by a quiet Linux intrusion toolkit built for long-term access. The malware hides inside software that manages web traffic, allowing attackers to watch users, steal information, and change pages delivered through compromised servers. The operation appears designed for patience rather than disruption. Attackers likely entered through […] The post DPRK-Linked Hackers Deploy Ted Backdoor and CurlRAT Against South Korean Firms appeared fir
Fri 4 Sept5
KP
Rapid7
Overview A new Linux toolkit, identified by Rapid7 Labs, has been targeting organizations across South Korea’s automotive and media industries with minimal detection. The campaign made use of a HAProxy instance named “ted backdoor”, alongside trojanized versions of crond, agetty, atd, sshd, and polkitd. This previously undocumented framework enabled threat actors to execute remote commands on compromised servers, inject malicious scripts into web traffic, perform credential harvesting, and engag
KP
Mac users are being targeted with 14 fake application installers that appear to offer familiar software but instead start a credential-stealing remote-access trojan. The files were distributed as macOS disk images and installer packages, giving attackers another route into systems used by developers and job seekers. The activity is tied to the long-running Contagious Interview […] The post 14 Fake macOS Installers Linked to DPRK Campaign Deliver Credential-Stealing RAT appeared first on Cyber Se
KP
Team Cymru
Uncover how DPRK cyber threat actors use fake IT schemes, Astrill VPN, and freelance platforms to infiltrate networks. Learn to spot these advanced persistent threats.
KP
Stop hunting for North Korean malware and start hunting for North Korean behavior. See how Eli Woodward uses criminal indictments and Team Cymru’s global telemetry to surface DPRK remote worker infrastructure by identifying subtle TTP patterns.
KP
Explore how ransomware and incident response have evolved with Matt McKnew of Thermo Fisher. Learn about the shift to RaaS and the rise of DPRK fake IT worker scams.
Mon 24 Aug1
KP
Kimsuky has been linked to a new espionage campaign that turns a Chrome extension into a quiet Gmail collector. The operation begins with convincing phishing emails and ends with attackers gaining access to messages, attachments, and a victim’s computer. Its mix of browser theft and remote control makes a single opened file especially risky. The […] The post Kimsuky Uses AI-Generated Chrome Extension to Automatically Steal Gmail Data appeared first on Cyber Security News .
Fri 21 Aug2
KP
Cybersecurity researchers have linked a malicious backdoor in compromised Rust packages to previous North Korean supply chain attacks
KP
Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server. The post Rust Supply Chain Attack Linked to North Korean Hackers appeared first on SecurityWeek .
Tue 18 Aug2
KP
North Korean state-backed threat actor Kimsuky is extending its established espionage playbook with locally hosted artificial intelligence tooling, according to new research into an activity cluster tracked as Operation GitPower. The campaign retains familiar phishing-led intrusion chains but shows the operators preparing AI-assisted capabilities for malware development, data analysis, social engineering, and operational automation. The […] The post Kimsuky Uses Local AI Development Environment
KP
Recorded Future
Learn how North Korean IT worker threat cluster "PurpleDelta" uses AI-generated personas, sophisticated tradecraft, and custom ChatGPT assistants to infiltrate organizations. Discover key indicators of compromise and mitigation strategies to protect your company from these fraudulent employment operations.
Wed 1 Apr1
KP
Hunt.ioResearch
The axios npm maintainer account was hijacked to push two malicious versions. Inside: an obfuscated postinstall dropper, three platform-specific RATs, self-destructing cleanup, and C2 infrastructure linked to TA444/BlueNoroff
Wed 17 Dec1
Inside DPRK Operations: New Lazarus and Kimsuky Infrastructure Uncovered Across Global Campaigns
300d agoKP
Deep investigation into DPRK activity, revealing new Lazarus and Kimsuky infrastructure through multi-stage hunts and exposed operational patterns.