Executive Summary

Last week’s reporting covered DPRK activity against developers, software supply chains, and remote hiring. Genians found Kimsuky infrastructure running local AI tools and document retrieval software. CrowdStrike attributed the poisoning of 131 AI framework packages to STARDUST CHOLLIMA, while an investigation into North Korean command-and-control servers found evidence of intrusions at hundreds of organizations.

Researchers also placed DPRK-linked IT workers inside a controlled DeFi company and recorded their remote-access tools, VPN use, job-application services, and account synchronization. AhnLab connected current Xctdoor distribution with older CRAT operations attributed by other firms to Lazarus, though the current campaign was not directly attributed on that basis. Reports on device surveillance and smishing inside North Korea concerned domestic control and crime rather than an external state-directed campaign.

Key Trends

1. Kimsuky adds AI tools to established attack methods

Genians linked Operation GitPower to Kimsuky through linguistic artifacts, overlap with earlier campaigns, and infrastructure behavior. The operation uses spearphishing, malicious LNK files, obfuscated PowerShell, scheduled tasks, and Git repositories to collect system information and deliver encrypted AsyncRAT payloads.¹²

Logs from the infrastructure recorded Ollama, GPT4All, and Msty installations. The operators also configured document-based retrieval augmented generation and collected libraries for AI agents, external model integration, and speech-to-text processing. The evidence points to work with existing models, not the training of a proprietary model. Plausible uses include preparing lures, analyzing stolen data, and assisting malware development, but the observed installations do not establish how extensively the tools were used in live operations.

2. Developers remain both an access route and a supply-chain target

Researcher Vangelis Stykas told Wired that 22 months of access to North Korean command-and-control servers exposed evidence affecting 1,640 companies in 57 countries. He assessed that 700 to 800 organizations suffered serious intrusions involving root access to servers, AWS environments, or cryptocurrency wallets. Much of the activity relied on Contagious Interview, which uses fake job offers and malicious coding tests, as well as fraudulent remote employment by North Korean IT workers.³

CrowdStrike separately attributed the poisoning of 131 AI framework packages to STARDUST CHOLLIMA. The package campaign sought access through components trusted by developers, creating a route into downstream systems. These reports describe distinct operations, but both exploit routine developer work: evaluating code from a recruiter and importing software into a project.⁴

3. A controlled workplace exposed IT worker tradecraft

BCA LTD, NorthScan, and ANY.RUN recruited operators they identified as DPRK-linked Famous Chollima IT workers into a simulated DeFi company. Monitored Windows sandboxes recorded screen activity, files, and network requests. The workers used AnyDesk and Chrome Remote Desktop, Astrill VPN, one-time-password services, synchronized Google accounts, and automated job-application tools.⁵

The researchers observed four Astrill VPN nodes and a residential address in Vladivostok. They connected the latter through an associated individual and logistics company to prior reporting on North Korean connectivity and IT worker activity. That association is an investigative lead rather than proof of each operator’s physical location. The presentation also traced clusters of similar company websites, suspected shell-company arrangements, and cryptocurrency services used to move earnings.

4. Xctdoor activity overlaps with older CRAT operations

AhnLab connected Larva-26005’s recent Xctdoor distribution to CRAT attacks against South Korean users dating to 2020. Shared AppX installation paths, runtime code obfuscation, and the earlier deployment of CRAT, Xctdoor, and Hansom ransomware on the same systems support the connection. Other security firms attributed the older CRAT activity to Lazarus, so the finding does not amount to a new direct attribution of the current campaign.⁶⁷

The 2026 activity delivered C++ and Go variants of Xctdoor through fake Veraport and SoftCamp installers and malicious LNK files. Related activity abused compromised IIS servers, groupware upload pages, ERP update components, and a trojanized BeeBEEP installer. Xctdoor can run shell commands, transfer files, capture keystrokes and screenshots, monitor the clipboard, and inject payloads into memory.

5. Domestic surveillance and fraud require separate treatment

A DEF CON presentation described controls built into North Korean Android devices. TraceViewer captures a screenshot every five minutes, while RedFlag deletes transferred files that lack an approved cryptographic signature. State-run distribution points, network isolation, radio detection, device searches, and physical punishment reinforce these technical restrictions. The Pigeon tool counters one part of the system by self-signing media so it can pass RedFlag checks.⁸

Daily NK separately reported the arrest of two state-trained IT specialists accused of stealing from North Korean donju through smishing and voice phishing. The suspects allegedly impersonated the central bank and inspection agencies, stole Jonsong payment credentials, and used family information in extortion calls. The case describes domestic criminal use of state-developed skills. It does not establish direction by a DPRK external cyber unit.⁹

What to Watch

Development teams should isolate coding tests from unknown recruiters and review newly introduced packages before they reach build systems. Remote-hiring checks should compare identity documents, access location, payment ownership, interview behavior, and remote-control software. Account synchronization on managed workstations deserves attention because it can expose credentials and browsing data beyond the immediate session.

Endpoint monitoring should flag malicious LNK execution, unexpected scheduled tasks, fake enterprise-software installers, and payload retrieval from public code repositories. South Korean organizations using Veraport, SoftCamp, groupware, or ERP update components should also check for unauthorized installers and abnormal child processes.

Reports Reviewed