DPRK

North Korea, also referred to as the Democratic People’s Republic of Korea (DPRK), is a nation-state cyber threat actor ecosystem encompassing DPRK state-sponsored, affiliated, aligned, and linked actors. The content describes DPRK as a major cyber threat with activity spanning cryptocurrency theft, software supply-chain compromise, malware operations, social engineering, and fraudulent remote-worker infiltration. Known aliases in the provided content include Democratic People’s Republic of Korea (DPRK), DPRK actors, DPRK-affiliated actors, DPRK-aligned actors, DPRK cyber threat actors, DPRK-linked hackers, North Korea, and North Korean state-sponsored threat actors. The reporting attributes large-scale cryptocurrency theft to DPRK-connected hackers, including more than $2 billion stolen in 2025 and the $1.5 billion Bybit heist. The content states DPRK continues to pose the most significant nation-state threat to cryptocurrency security and uses stolen cryptocurrency to circumvent sanctions and fund state priorities. Reported laundering behavior includes use of Chinese-language money laundering services, bridge services, mixing protocols, smaller transfer tranches, and an approximately 45-day laundering cycle. The content also describes a sophisticated DPRK remote-worker program in which operatives use stolen identities, deepfake-enhanced interviews, proxy chains, residential IPs, and laptop farms to obtain remote jobs at Western and U.S. companies. These operations are described as generating revenue for the regime and, in some cases, enabling espionage, sabotage, insider access, and persistent access to production systems. Related activity includes fake job interview coding tests and fake front companies that lure candidates into running malicious code from attacker-controlled repositories. Additional DPRK-linked activity in the content includes suspected involvement in major software supply-chain compromises such as malicious npm package campaigns, including a campaign involving 338 malicious npm packages and reporting that the Axios npm compromise was attributed to a suspected DPRK-linked actor. The content also references DPRK use of EtherHiding and an Ethereum-based implant called EtherRAT in React2Shell attacks. Quantstamp assessed malware used in the Humanity Protocol compromise as characteristic of DPRK intrusions, and the project’s later AML-related response cited linkage to DPRK-affiliated actors. The content further notes that North Korean state-sponsored actors have misused AI to improve cyber operations, including phishing lure creation, reconnaissance, and data extraction, and that DPRK operatives have used deepfake job candidates to infiltrate enterprise technology teams.