This guide brings together and replaces our earlier news posts on North Korean state hacking groups, rewritten and expanded in October 2026 as a sourced reference.
Few countries use hacking as openly as a tool of state as North Korea does. Its operators steal money to fund a heavily sanctioned government, spy on diplomats and researchers, and go after defense and technology secrets. In 2021, the U.S. Justice Department charged three North Korean military intelligence officers in a conspiracy it said aimed to steal and extort more than $1.3 billion in money and cryptocurrency. In February 2025, the FBI attributed the theft of about $1.5 billion in virtual assets from the exchange Bybit to North Korea.
Our earlier posts covered four episodes between 2019 and 2024: a Microsoft court action, a German and South Korean warning about attacks on the defense industry, a South Korean warning about the chip industry, and a research report on spoofed emails. This guide puts them in context. It explains who the main groups are, sets out each case with what happened next, and finishes with practical defenses for individuals and organizations.
In this guide
- Who North Korea's hacking groups are
- The cases at a glance
- December 2019: Microsoft seizes 50 Thallium domains
- February 2024: Germany and South Korea warn the defense sector
- March 2024: South Korea's chip equipment makers targeted
- April 2024: Kimsuky abuses weak DMARC settings
- The money side: crypto theft and fake IT workers
- What this means for you and for organizations
- FAQ
Who North Korea's hacking groups are
Security companies and governments track North Korean activity under many names, which can be confusing. Each vendor uses its own naming scheme, and the same cluster of activity can carry half a dozen labels. Two names cover most of what you will read about.
Lazarus Group
Lazarus is the best-known label. The U.S. Justice Department describes the hackers it charged in 2021 as members of units of the Reconnaissance General Bureau (RGB), North Korea's military intelligence agency, "also known as Lazarus Group and APT38." According to that indictment, the schemes included the 2014 attack on Sony Pictures, the WannaCry 2.0 ransomware of May 2017, fraudulent SWIFT bank transfers, ATM cash-out schemes, cryptocurrency theft and spear-phishing of U.S. defense contractors. The German and South Korean intelligence services call Lazarus a "notorious and sophisticated" actor involved in financial heists, ransomware and espionage.
Kimsuky
Kimsuky is primarily an espionage group. The U.S. Treasury, which sanctioned it in November 2023, says it has been active since 2012, is subordinate to the RGB, and mainly uses spear-phishing against government bodies, research centers, think tanks, universities and news media in Europe, Japan, Russia, South Korea and the United States. Its aim is intelligence on foreign policy, sanctions and the Korean Peninsula. MITRE's ATT&CK knowledge base lists its other names, including Thallium and Emerald Sleet (Microsoft's names), APT43, TA427 (Proofpoint's name) and Velvet Chollima.
That alias list matters for this guide. The "Thallium" group Microsoft took to court in 2019 and the "TA427" group Proofpoint described in 2024 are tracked as the same Kimsuky activity. MITRE also notes that some researchers group all North Korean activity under the Lazarus name, so the boundaries between clusters are not always clear in public reporting.
The cases at a glance
- 2012
Kimsuky becomes active, according to the U.S. Treasury. - 2014 to 2019
U.S. prosecutors later tie RGB hackers to the Sony Pictures attack (2014), bank heists (2015 to 2019) and WannaCry 2.0 (May 2017). - Dec 27-30, 2019
A U.S. court order unsealed in Virginia lets Microsoft take control of 50 domains used by Thallium (Kimsuky). - Mid-2020 onward
Lazarus runs "Operation Dream Job," using fake recruiter profiles to target defense workers. - Feb 17, 2021
The Justice Department announces charges against three RGB programmers over schemes worth more than $1.3 billion. - Late 2022
A North Korean actor breaches a maritime research center through its web maintenance vendor. - Nov 30, 2023
The U.S. Treasury sanctions Kimsuky. - Dec 2023 onward
TA427 (Kimsuky) begins spoofing organizations with weak DMARC email policies. - Feb 19, 2024
Germany's BfV and South Korea's NIS publish a joint advisory on attacks against the defense sector. - Early 2024
South Korea's NIS warns of North Korean intrusions at domestic semiconductor companies. - April 2024
Proofpoint details TA427's DMARC abuse and tracking pixels. - Feb 21-26, 2025
About $1.5 billion is stolen from Bybit. The FBI attributes it to North Korea. - Jan 8, 2026
The FBI warns that Kimsuky is using malicious QR codes in spear-phishing. - October 2026
U.S. prosecutors announce charges in a North Korean remote IT worker scheme after raids on more than 40 alleged "laptop farms."
| Case | Group (as named by source) | Main targets | Main technique | Response |
|---|---|---|---|---|
| Microsoft v. Thallium (2019) | Thallium, an alias of Kimsuky | Government staff, think tanks, universities, nuclear proliferation experts | Spear-phishing with look-alike domains and fake login pages | Court order transferring 50 domains to Microsoft |
| Defense sector advisory (2024) | Lazarus, plus a second North Korean actor | Defense companies and a maritime research center | Fake job offers; supply-chain attack via a maintenance vendor | Joint BfV and NIS advisory with indicators and mitigations |
| Chip industry warning (2024) | North Korean hackers (per NIS) | South Korean chip equipment makers | Exploiting internet-connected servers; abusing built-in tools | NIS notified victims and warned the industry |
| DMARC spoofing (2024) | TA427, an alias of Kimsuky | Foreign policy experts, think tanks, NGOs, media, academics | Spoofed sender domains with weak DMARC; tracking pixels | Public research; earlier U.S. sanctions on Kimsuky |
The group names are those used by each source. Researchers do not always agree on where one North Korean cluster ends and another begins.
December 2019: Microsoft seizes 50 Thallium domains
What happened
On December 30, 2019, Microsoft announced that it had taken control of 50 web domains used by a group it called Thallium, which it believed operated from North Korea. The action followed a lawsuit Microsoft filed in the U.S. District Court for the Eastern District of Virginia. Court documents unsealed on December 27 allowed the domains to be transferred to Microsoft, so they could no longer be used in attacks. Microsoft's Digital Crimes Unit and its Threat Intelligence Center had tracked the group.
Who was targeted and how
According to Microsoft, Thallium targeted government employees, think tanks, university staff, groups focused on world peace and human rights, and people working on nuclear proliferation. Most targets were in the United States, with others in Japan and South Korea. The group's method was classic spear-phishing, carefully prepared:
- It researched targets using social media and public directories, so its emails looked credible and personal.
- It disguised sender addresses with look-alike characters, for example combining "r" and "n" to look like an "m" in microsoft.com.
- Links led to fake sign-in pages that captured user names and passwords.
- After getting into a mailbox, it created forwarding rules so it would keep receiving the victim's mail even after a password change.
- It also used malware, which Microsoft named BabyShark and KimJongRAT, to steal data and keep access.
The response
Microsoft said this was the fourth nation-state group it had pursued with this legal approach, after Barium (linked to China), Strontium (Russia) and Phosphorus (Iran). Seizing domains does not stop a group. It does break the links in phishing emails already sent, and it forces the attackers to rebuild infrastructure.
What happened next
The group carried on. Microsoft now tracks it as Emerald Sleet, and the same activity appears as Kimsuky, APT43 and TA427 elsewhere. The U.S. Treasury sanctioned Kimsuky in November 2023, and our April 2024 case below shows the same group still targeting policy experts by email. Microsoft's advice from 2019 still holds: turn on two-step sign-in, learn to spot phishing, and check your email forwarding rules regularly.
February 2024: Germany and South Korea warn the defense sector
What happened
On February 19, 2024, Germany's domestic intelligence service, the Federal Office for the Protection of the Constitution (BfV), and South Korea's National Intelligence Service (NIS) published their second joint cybersecurity advisory. It warned of campaigns that the agencies judged highly likely to have been carried out by North Korean actors against defense companies and research centers. The agencies assessed that North Korea uses stolen military technology to improve conventional weapons and develop new strategic systems, including ballistic missiles, reconnaissance satellites and submarines. They described cyber espionage as a cost-effective way for the regime to get that technology.
Case one: a supply-chain attack through a maintenance vendor
At the end of 2022, a North Korean actor broke into a research center for maritime and shipping technology. The advisory attributes this case to a North Korean group other than Lazarus. Rather than attack the well-protected center directly, the actor first breached a company that maintained one of the center's web servers.
- It stole the vendor's SSH credentials and used them to log in remotely to the research center's Linux web server.
- It used legitimate tools, including curl, to download a tunneling tool and a disguised downloader script.
- It moved to other servers, captured network traffic and collected employee account credentials.
- Using a security manager's email account, it asked the center's patch management provider to build a patch file with hidden malicious functions. The real security manager spotted and blocked the attempt.
- Even after being blocked, the actor kept trying, uploading a web shell through a file-upload flaw on the website and sending spear-phishing emails to staff.
The agencies noted that remote maintenance became common during the COVID pandemic, and that weak controls had allowed unattended access to servers.
Case two: Lazarus and "Operation Dream Job"
The second case covered Lazarus's long-running use of fake job offers, active since at least mid-2020 and known as "Operation Dream Job." The pattern described in the advisory:
- The attacker builds a convincing recruiter profile on an online job portal, either stolen from a real person or invented.
- It looks for employees at target companies who might have access to valuable systems, and may first connect with people in their circle to look more credible.
- Conversations, usually in English, can run for days, weeks or months before a job is offered, often with a generous salary.
- The target is then moved to another channel, such as WhatsApp, Telegram, Skype or Discord, and sent malware disguised as a job description, a PDF reader, a VPN client or, for programmers, a coding challenge.
The agencies pointed out a key weakness the attackers exploit: employees rarely tell colleagues or employers about job offers they are considering.
The response and what happened next
The advisory published indicators of compromise and mitigations, covered below in our defenses section. Its central message for companies was to control vendor remote access tightly, verify patch distribution steps, require multi-factor sign-in for VPNs, and build a culture where staff can report suspicious contact without fear of blame. The agencies said they expected North Korea to keep up this kind of targeting.
March 2024: South Korea's chip equipment makers targeted
What happened
On March 4, 2024, South Korea's National Intelligence Service said North Korean hackers had broken into at least two South Korean makers of semiconductor manufacturing equipment, according to Reuters and The Register. The agency said the sector had been a key target since late 2023. The attackers exploited vulnerabilities in the companies' internet-connected servers; the NIS did not say which flaws were used or name a specific North Korean group.
The impact
The NIS described two intrusions. In December 2023, attackers compromised one company's configuration management server, and in February 2024 they compromised another company's security policy server. The agency said product design drawings and photos of facility sites were stolen. The victim companies were not named.
How the attackers stayed hidden
The intrusions relied on "living off the land": using legitimate tools already present on the victim's systems rather than custom malware. Because those tools are used every day by real administrators, their misuse is harder for security software to flag. The same pattern appears in the BfV and NIS defense advisory above, where the attacker used standard tools such as curl and SSH.
The response and what happened next
The NIS said it had notified the affected companies and helped them strengthen their network security, and that it shared details of the incidents with the wider semiconductor industry. The agency said North Korea "might possibly be preparing to produce its own semiconductors," because sanctions make chips hard to obtain and demand is growing from its satellite, missile and other weapons programs.
April 2024: Kimsuky abuses weak DMARC settings
What happened
In April 2024, the security company Proofpoint published research on TA427, its name for the Kimsuky activity. Its data covered January 2023 to March 2024. The group targeted foreign policy experts, think tanks, non-governmental organizations, media, academics and government staff. It focused on topics such as nuclear disarmament, U.S. and South Korean policy, and sanctions.
What stood out was how often TA427 did not need malware at all. Posing as researchers, journalists or think tank staff, it simply asked targets for their analysis and opinions, often over a long and friendly exchange. The replies themselves were the intelligence.
The technique: spoofing domains with weak DMARC
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a setting an organization publishes in its domain records. It tells receiving mail servers what to do with an email that claims to come from the domain but fails authentication checks. A policy of p=none means "do nothing, just report," while p=quarantine sends failing mail to spam and p=reject blocks it.
Proofpoint found that since December 2023, TA427 had spoofed organizations that either had no DMARC policy or used a permissive p=none record. Spoofed emails from those domains could pass security checks. The group then put a free webmail address in the reply-to field, so replies went to the attacker. Organizations it impersonated included the Stimson Center, the Atlantic Council, the Wilson Center, the Ronald Reagan Presidential Foundation and Institute, and the Maureen and Mike Mansfield Foundation. It also used a typosquatted domain to imitate the news site NK News.
Tracking pixels
From February 2024, Proofpoint saw TA427 adding web beacons, tiny hidden images loaded from an attacker-controlled server. When the email is opened, the image request reveals that the address is active, plus details such as IP address, device and browser type and the time it was opened. The group likely used this as early reconnaissance before sending a more tailored approach.
The response and what happened next
The U.S. Treasury had already sanctioned Kimsuky in November 2023. The group adapted rather than stopped. In January 2026, the FBI warned that Kimsuky actors were embedding malicious QR codes in spear-phishing emails. Scanning the code moves the victim from a protected work computer to a phone, where it leads to fake Microsoft 365, Okta, VPN or Google sign-in pages. The FBI said stolen session tokens can let attackers get around multi-factor authentication. The lesson is the same as in 2019: the group invests in convincing people, and keeps changing the delivery method.
The money side: crypto theft and fake IT workers
Espionage is only half the picture. North Korea also uses cyber operations to raise money under heavy international sanctions.
- Bank and crypto theft. The 2021 U.S. indictment of three RGB programmers alleged schemes including fraudulent SWIFT transfers from banks in several countries, ATM cash-outs, malicious cryptocurrency trading apps and theft from crypto companies. A Canadian-American man from Mississauga, Ontario, agreed to plead guilty to conspiracy to commit money laundering for organizing teams that laundered proceeds from some of those schemes. The three North Koreans were charged but are not in U.S. custody.
- Bybit. In February 2025, about $1.5 billion in virtual assets was stolen from the Bybit exchange. The FBI attributed the theft to North Korea and called the activity "TraderTraitor." It asked exchanges and other crypto services to block transactions linked to the laundering addresses.
- Remote IT workers. North Korean workers have used false identities to get hired remotely by foreign companies. In October 2026, U.S. prosecutors announced charges against people accused of helping such workers, after raids on more than 40 alleged "laptop farms" in Texas where company laptops were hosted. Prosecutors allege the scheme affected more than 70 U.S. employers. These are allegations, and the defendants are presumed innocent unless proven guilty.
What this means for you and for organizations
Most people will never be a target of a state hacking group. But the techniques North Korean groups use, convincing emails, fake recruiters and look-alike sign-in pages, are the same ones ordinary scammers copy. If you work in policy, research, journalism, defense, crypto or tech, take these steps seriously.
For individuals
- Turn on two-step sign-in, and prefer passkeys or security keys. The FBI recommends phishing-resistant multi-factor authentication, because codes and session tokens can be stolen through fake login pages.
- Check your email forwarding rules. Microsoft found Thallium setting up silent forwarding. Look in your email settings for forwarding and filter rules you didn't create.
- Verify unexpected requests from "experts" and "journalists." If someone from a think tank or outlet asks for your analysis, confirm through the organization's official website or phone number before replying, and check the reply-to address.
- Be wary of recruiters who move you to a private chat. Never run a "coding test," PDF reader or VPN client sent by a recruiter you met online. Tell your security team about approaches that seem off.
- Don't scan QR codes in unsolicited emails. Type the address of the service yourself instead.
- Block remote images in email if your mail app allows it. This stops most tracking pixels from reporting that you opened a message.
For organizations
| Defense | Threat it counters | Source of the advice |
|---|---|---|
| Publish a DMARC policy and move from p=none to quarantine or reject once mail is aligned | Spoofing of your domain (TA427) | Proofpoint research on TA427 |
| Limit vendor remote access to necessary systems, authenticate first, and log and review access | Supply-chain intrusions via maintenance vendors | BfV and NIS joint advisory |
| Add verification steps to patch and software distribution | Malicious patch files pushed through trusted systems | BfV and NIS joint advisory |
| Require multi-factor sign-in on VPNs, and phishing-resistant MFA for sensitive systems | Stolen credentials and session tokens | BfV and NIS advisory; FBI QR code alert |
| Keep a strict patch routine for internet-facing servers | Exploited known vulnerabilities | BfV and NIS advisory; NIS chip-industry warning |
| Train staff on fake recruiters, QR codes and impersonated experts, with a blame-free reporting culture | Social engineering (Dream Job, Kimsuky) | BfV and NIS advisory; FBI QR code alert |
| Apply least-privilege access and audit unused permissions | Lateral movement after a break-in | FBI QR code alert; BfV and NIS advisory |
FAQ
Is Thallium the same group as Kimsuky?
Yes, as tracked by most researchers. MITRE's ATT&CK knowledge base lists Thallium, Emerald Sleet, APT43 and TA427 as names associated with Kimsuky. Different security companies use their own names for the same activity.
What is the difference between Lazarus and Kimsuky?
Both are linked to North Korea's Reconnaissance General Bureau. Lazarus is best known for financially motivated attacks, destructive operations and defense-sector espionage, while Kimsuky focuses mainly on intelligence gathering about foreign policy, sanctions and the Korean Peninsula. Public reporting sometimes blurs the line between them.
Why does DMARC matter if I'm not a target?
Without an enforced DMARC policy, anyone can send email that appears to come from your domain, and some of it will reach inboxes. That puts your customers, partners and reputation at risk from any scammer, not just state groups. Publishing a policy and moving it toward enforcement is a low-cost fix.
How do fake recruiter attacks usually end?
According to the BfV and NIS advisory, the target is eventually asked to open a file, a job description, PDF reader, VPN client or coding test, that installs malware. If a recruiter insists you run software to continue, treat it as a red flag.
Sources
- Microsoft On the Issues: Microsoft takes court action against fourth nation-state cybercrime group (Dec. 30, 2019)
- MITRE ATT&CK: Kimsuky (G0094)
- U.S. Treasury: sanctions on Kimsuky (Nov. 30, 2023)
- BfV: Joint cyber security advisory with the NIS (Feb. 19, 2024)
- BfV and NIS: Warning of North Korean cyber threats targeting the defense sector (PDF)
- Proofpoint: From social engineering to DMARC abuse: TA427's art of information gathering
- Reuters (via Malay Mail): North Korea broke into South Korean chip equipment firms, Seoul's spy agency says (Mar. 4, 2024)
- The Register: Seoul accuses North Korea of stealing chipmakers' designs (Mar. 4, 2024)
- FBI FLASH: Kimsuky actors leverage malicious QR codes in spearphishing (Jan. 8, 2026, PDF)
- U.S. Department of Justice: Three North Korean military hackers indicted (Feb. 17, 2021)
- FBI PSA: North Korea responsible for $1.5 billion Bybit hack (Feb. 26, 2025)
- The Hacker News: U.S. shuts down over 40 laptop farms in North Korean IT worker fraud (Oct. 2026)
- U.S. Attorney's Office, N.D. Ohio: remote IT worker conspiracy indictment
Top image: "IBM server rack internals - IMG 0572" by Jemimus, CC BY 2.0, via Wikimedia Commons (resized). Charts by Thank You Robot.
0 Comments