The PolySwarm Blog

Verticals Targeted: Government, Financial, Manufacturing, Aviation, Airports
Regions Targeted: United States, Japan, South Korea, Thailand, Indonesia, Australia, Taiwan, India, Singapore, UAE, Saudi Arabia, European Union
Related Threat Actors: Lazarus Group

Executive Summary

A suspected North Korean state-linked threat operation has reportedly progressed from reconnaissance to active scanning of internet-facing PHP servers exposed to CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Operators communicating through a closed I2P channel reportedly identified 216 potentially vulnerable hosts and began conducting low-volume scans using 21 compromised systems, with government agencies and financial institutions among their priority targets. The activity raises concerns that attackers could exploit these critical vulnerabilities to establish persistent access, steal credentials, and conduct financial or intelligence-gathering operations against targeted organizations.

Verticals Targeted: Cryptocurrency
Regions Targeted: Not Specified
Related Families: None

Executive Summary

NimDoor is a sophisticated MacOS malware deployed by North Korea-linked threat actors, likely Stardust Chollima, targeting Web3 and cryptocurrency organizations. Utilizing Nim and C++ binaries, AppleScript, and social engineering via fake Zoom updates, NimDoor employs process injection, WebSocket communications, and signal-based persistence to steal sensitive data.

Verticals Targeted: Cryptocurrency
Regions Targeted: India
Related Families: GolangGhost

Executive Summary

Famous Chollima, a North Korean-aligned threat actor, has deployed PylangGhost, a Python-based remote access trojan (RAT), targeting cryptocurrency and blockchain professionals in India. This malware, a variant of the GolangGhost RAT, facilitates credential theft and remote system control via sophisticated social engineering tactics.

Executive Summary

KoSpy is a sophisticated Android spyware linked to North Korean threat actor Ricochet Chollima. It has been targeting Korean and English-speaking users since March 2022.

Executive Summary

This Threat Bulletin is part of PolySwarm’s 2024 Recap series. This report highlights the activity perpetrated by North Korea-based threat actors in 2024.

Related Families: Preft

Related Families: PondRAT, PoolRAT
Verticals Targeted: Software Development 

Executive Summary

North Korea nexus threat actor group Labyrinth Chollima was observed using poisoned Python packages to deliver PondRAT, a backdoor that targets MacOS and Linux systems.  

Verticals Targeted: Software Development

Executive Summary

An ongoing social engineering campaign was observed targeting software developers. The threat actors use fake interviews to deliver a Python-based RAT, known as DevPopper.