INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

North Korean hacker group steals developer authentication information online

| 2026-10-28 23:00 CRITICAL LOW DATA BREACH SUPPLY CHAIN MALWARE & BOTNETS STATE-SPONSORED & ESPIONAGE
JSON
Executive Summary
AI-generated
A North Korea-linked hacker organization has been identified as the primary perpetrator behind a recent software supply chain threat, with its initial infiltration methods dominated by service-based phishing and targeted phishing using malicious links. The attackers have expanded their scope of activities from traditional attacks to injecting malicious code into legitimate software using stolen developer accounts, compromising authentication information such as Git credentials, SSH keys, and access tokens. This organization has been linked to other North Korea-linked groups including DeceptiveDevelopment, ScarCruft, and Lazarus. As a result, at least 1000 projects managed by individual developers have been affected, with the malicious code distributed through various channels including npm, PyPI, Packagist, and browser extension distribution channels. The attackers' methods have become increasingly sophisticated, utilizing blockchain technology to hide their attack servers and infecting development tools.
Technical Mitigations AI-generated
• Patch the npm package storage (npm) to prevent malicious code from being distributed through it. • Monitor for OmniStealer, a malicious code that steals browser login information and virtual asset wallet information. • Block or hunt for DEV#POPPER, a remote-control malicious code that inserts malicious code into frequently used development studio code.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
APT37APT37Contagious InterviewContagious Interview
Target & Sectors
DPRK DPRK AFRICA AFRICA technologytechnology
Incident Timeline
‎2025/10/28
A North Korean hacker group, tracked by the organization since last year, expanded its attack scope and stole developer authentication information before publishing malicious code.
‎September 2026
North Korean hackers used various channels, including npm and PyPI, to distribute malicious code that stole developer authentication information and installed BlueLight for remote access.
threat_actor Contagious Interview
The report covered the activities of DeceptiveDevelopment, ScarCruft, and Lazarus, among other North Korea-linked organizations.
The remote-control malicious code, DEV#POPPER, was also found to insert malicious code into frequently used development studio code (VS Code), cursor, and Discord, causing the program to run again after execution.
threat_actor APT37
The report covered the activities of DeceptiveDevelopment, ScarCruft, and Lazarus, among other North Korea-linked organizations.
organisation Decoy Development Project
A Decoy Development Project is a North Korean-linked organization that has been known to carry out a type of cyber attack in which it poses as a recruitment officer for a well-known company to approach software developers.
organisation Skarium
A North Korean-linked organization, Skarium, was found to have attacked an organization related to the port-based facilities in Africa.
infrastructure Vs Code
The remote-control malicious code, DEV#POPPER, was also found to insert malicious code into frequently used development studio code (VS Code), cursor, and Discord, causing the program to run again after execution.
infrastructure Cursor
The remote-control malicious code, DEV#POPPER, was also found to insert malicious code into frequently used development studio code (VS Code), cursor, and Discord, causing the program to run again after execution.
organisation Discord
The remote-control malicious code, DEV#POPPER, was also found to insert malicious code into frequently used development studio code (VS Code), cursor, and Discord, causing the program to run again after execution.
infrastructure Linux
The set has confirmed the presence of CinderRelay, a malicious code installed on the infected Linux servers in Korea.
organisation CinderRelay
The set has confirmed the presence of CinderRelay, a malicious code installed on the infected Linux servers in Korea.
organisation SSH
The attackers have stolen authentication information, such as Git credentials, SSH keys, and access tokens, from infected developer computers.
organisation PyPI
This means that the malicious program was distributed through various channels, including the JavaScript package storage npm, the Python package storage PyPI, the Go module distribution path, Packagist, and browser extension distribution channels.
organisation Packagist
This means that the malicious program was distributed through various channels, including the JavaScript package storage npm, the Python package storage PyPI, the Go module distribution path, Packagist, and browser extension distribution channels.
organisation Ethereum
A set of researchers analyzed a method used by attackers to utilize information from Ethereum blockchain transactions to identify the server addresses of malicious code command centers.
organisation OmniStealer
Among the malicious code used in the attack, OmniStealer was found to steal browser login information, virtual asset wallet information, password management program information, and development-related secret information.
organisation BlankOverride
A set of malicious code, known as BlankOverride, has been detected spreading through mobile storage devices.
organisation BlueLight
This malicious code disguises itself as a normal folder, prompting users to directly execute it, and then installs BlueLight, a malicious code used for information collection and remote access.
organisation Skyscraper
In the domestic scene, Skyscraper's intrusion activities have been observed.
‎April to September 2026
Threat actors, identified as a North Korean hacker group, stole developer authentication information and published malicious code after analyzing changes in their attack methods from April to September 2026.
‎October 28
ESET released a report on October 28 detailing changes in attack methods by the North Korean hacker group from April to September 2026.
‎2026/10/28
A North Korea-linked hacker organization used service-based phishing and software supply chain attacks to target technology sector developers, stealing authentication information before publishing malicious code.
infrastructure 12.2
The initial infiltration methods were dominated by service-based phishing (61%), followed by software supply chain attacks (12.2%), and targeted phishing using malicious links (9.8%).
infrastructure 9.8
The initial infiltration methods were dominated by service-based phishing (61%), followed by software supply chain attacks (12.2%), and targeted phishing using malicious links (9.8%).
organisation ESET
(Source: ESET)
Tactical Metrics
Metrics
infrastructure
‎12.2
Software Version
The initial infiltration methods were dominated by service-based phishing (61%), followed by software supply chain attacks (12.2%), and targeted phishing using malicious links (9.8%).
Metrics
infrastructure
‎9.8
Software Version
The initial infiltration methods were dominated by service-based phishing (61%), followed by software supply chain attacks (12.2%), and targeted phishing using malicious links (9.8%).
Metrics
infrastructure
‎Vs Code
Affected Product
The remote-control malicious code, DEV#POPPER, was also found to insert malicious code into frequently used development studio code (VS Code), cursor, and Discord, causing the program to run again after execution.
Metrics
infrastructure
‎Cursor
Affected Product
The remote-control malicious code, DEV#POPPER, was also found to insert malicious code into frequently used development studio code (VS Code), cursor, and Discord, causing the program to run again after execution.
Metrics
infrastructure
‎Linux
Affected Product
The set has confirmed the presence of CinderRelay, a malicious code installed on the infected Linux servers in Korea.
Intelligence Sources
Dailysecu 2026-10-28