{"investigation":{"slug":"unk-deaddrop-north-korea-developer-phishing-campaign","entity_name":"UNK_DeadDrop North Korea Developer Phishing Campaign","trust_score":0,"severity_base":null,"score_modifier":0,"confidence":0.93,"status":"published","content_type":"investigation","summary":"UNK_DeadDrop is Proofpoint's tracking designation for a threat cluster it assesses as likely North Korea-aligned, which over about six weeks in April and May 2026 sent more than 250 phishing emails to software developers at roughly 100 organizations, with a focus on cryptocurrency firms. Fake job offers and code-review requests led victims to actor-controlled GitHub and GitLab repositories that, once opened in VS Code or Cursor, deployed cross-platform malware including a modified Overlord Go framework and a persistent malicious VS Code extension (VSIX) built to steal cryptocurrency wallets, browser credentials and API tokens. Proofpoint disclosed the campaign on June 8, 2026 and tracks it separately from the Contagious Interview cluster despite substantial overlap; no government attribution or sanctions specifically naming UNK_DeadDrop had been published as of the reports.","sections":[{"content":"Proofpoint Threat Research disclosed the UNK_DeadDrop campaign on June 8, 2026, assigning the activity to a very likely North Korea-aligned threat actor. 'UNK_DeadDrop' is Proofpoint's internal tracking label for the cluster; the 'UNK' prefix indicates it had not been fully attributed to a known named group at the time of initial publication. Proofpoint observed that the campaign's victim targeting, social-engineering techniques and focus on cryptocurrency wallet theft and credential harvesting overlap substantially with the previously documented Contagious Interview campaign (attributed to DPRK-aligned actors, sometimes referred to under the Lazarus umbrella, and also tracked as DeceptiveDevelopment, PurpleBravo and TAG-121 by other vendors), but found no direct telemetry overlap and continues to track UNK_DeadDrop as a distinct operation because of differences in delivery mechanism, communication channel and malware tooling. The campaign ran for approximately six weeks across April and May 2026, suggesting organized, sustained resourcing rather than an opportunistic one-off.","heading":"Threat Actor Overview and Attribution","sources":[{"url":"https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal","name":"Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency — Proofpoint","type":"research","credibility":1},{"url":"https://www.theregister.com/security/2026/06/08/suspected-norks-send-250-fake-dev-job-pitches-to-steal-crypto/5252526","name":"Norks blast 250+ fake job offers to developers over 6 weeks to try and snarf creds and crypto — The Register","type":"news_article","credibility":1},{"url":"https://www.infosecurity-magazine.com/news/north-korean-hackers-developers/","name":"North Korean Hackers Use Fake Coding Tasks to Steal Crypto — Infosecurity Magazine","type":"news_article","credibility":2},{"url":"https://attack.mitre.org/groups/G1052/","name":"Contagious Interview, DeceptiveDevelopment — MITRE ATT&CK Group G1052","type":"research","credibility":1}],"severity":"critical"},{"content":"Over the six-week campaign window in April and May 2026, the actor sent more than 250 highly targeted phishing emails to individuals at approximately 100 organizations. Targeted sectors included technology, finance, cryptocurrency, education, business services, entertainment and media, and telecommunications. Most targeted organizations were based in the United States, though targeting was global in scope. Software developers were the primary intended victims, as the lures were crafted to appeal to developer workflows and professional interests, and Proofpoint identified cryptocurrency firms as a specific area of focus, consistent with the campaign's objective of draining digital-asset holdings.","heading":"Campaign Scale and Targeting","sources":[{"url":"https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal","name":"Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency — Proofpoint","type":"research","credibility":1},{"url":"https://www.theregister.com/security/2026/06/08/suspected-norks-send-250-fake-dev-job-pitches-to-steal-crypto/5252526","name":"Norks blast 250+ fake job offers to developers over 6 weeks to try and snarf creds and crypto — The Register","type":"news_article","credibility":1},{"url":"https://www.infosecurity-magazine.com/news/north-korean-hackers-developers/","name":"North Korean Hackers Use Fake Coding Tasks to Steal Crypto — Infosecurity Magazine","type":"news_article","credibility":2},{"url":"https://www.scworld.com/news/suspected-north-korean-actors-use-fake-coding-assignments-to-steal-crypto","name":"Suspected North Korean actors use fake coding assignments to steal crypto — SC Media","type":"news_article","credibility":2}],"severity":"critical"},{"content":"UNK_DeadDrop used two lure categories, both delivered by email rather than through LinkedIn or Telegram. In the first wave, attackers posed as recruiters from legitimate, named organizations offering software development roles and asked candidates to clone a repository as a coding assignment. Impersonated companies, whose names and branding were used without authorization, include Ondo Finance (a decentralized finance platform), Nourish (a telehealth company), Empower Pharmacy, NXLog, OnePlan, Hypen Connect (a Web3 and AI talent agency) and Valon. In later May 2026 emails, the actor shifted to peer code-review lures, posing as representatives of fictional cryptocurrency trading or AI prediction companies named Pulsynk and Trixauvex, presented with professional Python project structures. Some variants asked targets to test an ERC-4626 smart-contract vault using the Foundry framework or to build AI payment agents. Unlike Contagious Interview, the campaign used unsolicited job offers and code-review requests rather than staged fake interviews.","heading":"Social Engineering and Impersonated Companies","sources":[{"url":"https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal","name":"Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency — Proofpoint","type":"research","credibility":1},{"url":"https://cybersecuritynews.com/north-korea-aligned-hackers-abuse-github-repositories/","name":"North Korea-Aligned Hackers Abuse GitHub Repositories to Infect Developers — CybersecurityNews","type":"news_article","credibility":2},{"url":"https://cyberpress.org/north-korean-hackers-weaponize-github/","name":"North Korea-Linked Hackers Infect Developers via GitHub — CyberPress","type":"news_article","credibility":2},{"url":"https://www.infosecurity-magazine.com/news/north-korean-hackers-developers/","name":"North Korean Hackers Use Fake Coding Tasks to Steal Crypto — Infosecurity Magazine","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Each phishing email directed recipients to an actor-controlled GitHub or GitLab repository formatted to resemble a legitimate coding assignment, open-source project or cryptocurrency-related project, and instructed them to clone it and open the folder in Visual Studio Code or the Cursor editor. A hidden folder in the repository contained a tasks.json configuration file that abused the editors' legitimate feature of automatically running pre-configured workspace tasks when a folder is opened, so that little or no user interaction was needed beyond cloning and opening the repository. The tasks deployed a malicious VS Code extension (VSIX) masquerading as a Google service, which persisted across editor restarts and provided a durable foothold; reporting describes the VSIX as used in later phases of the campaign. Hosting on GitHub and GitLab let the actor exploit the implicit trust developers place in major code-repository platforms.","heading":"Attack Chain and Delivery Mechanism","sources":[{"url":"https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal","name":"Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency — Proofpoint","type":"research","credibility":1},{"url":"https://www.infosecurity-magazine.com/news/north-korean-hackers-developers/","name":"North Korean Hackers Use Fake Coding Tasks to Steal Crypto — Infosecurity Magazine","type":"news_article","credibility":2},{"url":"https://cybersecuritynews.com/north-korea-aligned-hackers-abuse-github-repositories/","name":"North Korea-Aligned Hackers Abuse GitHub Repositories to Infect Developers — CybersecurityNews","type":"news_article","credibility":2},{"url":"https://www.techradar.com/pro/security/north-korean-hackers-are-at-it-again-phishing-scheme-targets-hundreds-of-workers-to-try-and-steal-crypto-and-more","name":"North Korean hackers are at it again — phishing scheme targets hundreds of workers to try and steal crypto and more — TechRadar","type":"news_article","credibility":2},{"url":"https://gbhackers.com/north-korea-hackers-weaponize-github/","name":"North Korea Hackers Weaponize GitHub to Target Developers — GBHackers","type":"news_article","credibility":2}],"severity":"critical"},{"content":"The malware was tailored by operating system. On Linux and macOS, the chain executed Go binaries derived from a modified version of Overlord, an open-source Go remote-access and command-and-control framework, with custom modules including browserlogin (browser credential extraction), companywallet (cryptocurrency wallet targeting) and cleanup (removal of forensic artifacts), together implementing a persistent remote access trojan. Accounts of the Windows payload differ in detail: the survivor page, citing Proofpoint, Infosecurity Magazine and The Register, describes a JavaScript-based payload running inside the VS Code editor's Electron process and leaving minimal file-system artifacts, while the merged page, citing Proofpoint, TechRadar and GBHackers, describes platform-specific launchers that decoded embedded payloads. The final stage deleted the malicious payloads, repository files and hidden folder from the cloned repository while leaving the VSIX extension in place for persistence, reducing the chance of detection by file-system inspection alone.","heading":"Malware: Overlord Framework and Platform-Specific Payloads","sources":[{"url":"https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal","name":"Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency — Proofpoint","type":"research","credibility":1},{"url":"https://www.infosecurity-magazine.com/news/north-korean-hackers-developers/","name":"North Korean Hackers Use Fake Coding Tasks to Steal Crypto — Infosecurity Magazine","type":"news_article","credibility":2},{"url":"https://www.theregister.com/security/2026/06/08/suspected-norks-send-250-fake-dev-job-pitches-to-steal-crypto/5252526","name":"Norks blast 250+ fake job offers to developers over 6 weeks to try and snarf creds and crypto — The Register","type":"news_article","credibility":1},{"url":"https://www.techradar.com/pro/security/north-korean-hackers-are-at-it-again-phishing-scheme-targets-hundreds-of-workers-to-try-and-steal-crypto-and-more","name":"North Korean hackers are at it again — phishing scheme targets hundreds of workers to try and steal crypto and more — TechRadar","type":"news_article","credibility":2},{"url":"https://gbhackers.com/north-korea-hackers-weaponize-github/","name":"North Korea Hackers Weaponize GitHub to Target Developers — GBHackers","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Proofpoint identified the campaign's objectives as theft of browser-based cryptocurrency wallets, desktop cryptocurrency wallets, decrypted passwords and valuable API tokens. The Overlord-based payload targeted 35 browser-based wallet extensions, including MetaMask, Phantom and Keplr, and 18 standalone desktop wallet applications, including Exodus, Electrum and Ledger Live. On Linux and macOS, fake system password dialogs harvested user credentials that were then used to access OS keychains or keyrings for privilege escalation and further secret extraction. Browser exfiltration covered saved passwords and session cookies from Chrome, Brave, Edge and Firefox, and developer API tokens and credentials stored in the environment were also targeted. The targeting of developers in the cryptocurrency and DeFi sectors is consistent with a broader pattern of alleged North Korea-aligned operations generating hard-currency revenue through digital-asset theft.","heading":"Credential and Cryptocurrency Theft Capabilities","sources":[{"url":"https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal","name":"Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency — Proofpoint","type":"research","credibility":1},{"url":"https://www.infosecurity-magazine.com/news/north-korean-hackers-developers/","name":"North Korean Hackers Use Fake Coding Tasks to Steal Crypto — Infosecurity Magazine","type":"news_article","credibility":2},{"url":"https://www.scworld.com/news/suspected-north-korean-actors-use-fake-coding-assignments-to-steal-crypto","name":"Suspected North Korean actors use fake coding assignments to steal crypto — SC Media","type":"news_article","credibility":2}],"severity":"critical"},{"content":"No specific cryptocurrency theft amount had been attributed to the UNK_DeadDrop cluster as of the reports. Proofpoint's broader tracking of related North Korean campaigns noted that Contagious Interview and DangerousPassword had together allegedly netted $37.5 million since January 1, 2026; that figure is not attributed to UNK_DeadDrop.","heading":"Losses Attributed","sources":[{"url":"https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal","name":"Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency — Proofpoint","type":"research","credibility":1},{"url":"https://cyberpress.org/dprk-hackers-target-crypto/","name":"North Korea-Tied Operators Sustain Aggressive Crypto Targeting Campaign — CyberPress","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Proofpoint places UNK_DeadDrop within a longer pattern of suspected North Korean targeting of software developers stretching back to at least 2022, including campaigns tracked as TraderTraitor, Jade Sleet, AppleJeus and Citrine Sleet as well as Contagious Interview. UNK_DeadDrop shares Contagious Interview's victim profile (developers at cryptocurrency and finance organizations), fake-job and coding-assignment themes, and theft objectives. The distinctions Proofpoint cites are email-first contact instead of LinkedIn or Telegram; no fake interview stage; abuse of VS Code tasks.json auto-execution instead of malicious npm package installation; a self-contained, modified Overlord Go payload instead of the BeaverTail and InvisibleFerret tooling associated with Contagious Interview; industrialized repository creation at scale; and the VSIX persistence technique. These differences may indicate either a new subordinate unit within the broader Lazarus structure or a parallel DPRK-affiliated group that independently adopted the developer-targeting playbook. Contagious Interview is also tracked as DeceptiveDevelopment (ESET), PurpleBravo, TAG-121 and DEV#POPPER, and is indexed by MITRE ATT&CK as Group G1052; GitLab's Threat Intelligence Team has published analysis of North Korean developer-targeting tradecraft with overlapping characteristics, and Contagious Interview expanded in 2026 to over 1,700 malicious packages across npm, PyPI and other registries. Proofpoint characterized the activity as 'maturing and evolving' North Korean operations, reflecting concern that industrialization is increasing the volume and efficiency of compromise attempts against developers.","heading":"Relationship to Known North Korean Developer-Targeting Clusters","sources":[{"url":"https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal","name":"Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency — Proofpoint","type":"research","credibility":1},{"url":"https://securitybrief.com.au/story/north-korea-linked-hackers-target-developers-via-github","name":"North Korea-linked hackers target developers via GitHub — SecurityBrief","type":"news_article","credibility":2},{"url":"https://www.techradar.com/pro/security/north-korean-hackers-are-at-it-again-phishing-scheme-targets-hundreds-of-workers-to-try-and-steal-crypto-and-more","name":"North Korean hackers are at it again — phishing scheme targets hundreds of workers to try and steal crypto and more — TechRadar","type":"news_article","credibility":2},{"url":"https://attack.mitre.org/groups/G1052/","name":"Contagious Interview, DeceptiveDevelopment — MITRE ATT&CK Group G1052","type":"research","credibility":1},{"url":"https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/","name":"GitLab Threat Intelligence Team reveals North Korean tradecraft — GitLab","type":"research","credibility":2},{"url":"https://securityonline.info/contagious-interview-north-korea-malicious-packages-dev-registries/","name":"The 1,700-Package Blitz: North Korea's Contagious Interview Infiltrates Every Major Dev Registry — Security Online","type":"news_article","credibility":2}],"severity":"high"},{"content":"No official U.S. government attribution, OFAC sanctions designation, DOJ indictment or FBI advisory specifically naming UNK_DeadDrop had been issued as of the reports; attribution to North Korea rests on private-sector threat intelligence that Proofpoint assesses as 'likely'. The U.S. government has previously indicted and sanctioned North Korean state-sponsored hacking groups and individuals associated with cryptocurrency theft, including members of the Lazarus Group and associated sub-clusters, but those actions have not been linked to UNK_DeadDrop in available public records. This is a gap in the public record rather than an indicator of lower severity.","heading":"Government Attribution and Regulatory Status","sources":[{"url":"https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal","name":"Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency — Proofpoint","type":"research","credibility":1},{"url":"https://ofac.treasury.gov/recent-actions","name":"OFAC Recent Actions — U.S. Department of the Treasury","type":"regulatory","credibility":1}],"severity":"high"},{"content":"The campaign is a direct threat to cryptocurrency organizations and to developers who build, maintain or audit blockchain-adjacent software. It combines email-delivered lures, trusted code-hosting platforms (GitHub, GitLab), legitimate editor features (VS Code workspace tasks, Cursor auto-execution) and a cross-platform malware framework able to take both software wallet and hardware-wallet-adjacent credentials. Because infection requires only that a developer open a cloned repository folder, a routine step in technical assessments and code reviews, the social-engineering barrier is very low. Cryptocurrency-sector organizations are advised to treat unsolicited coding assignments and peer code-review invitations with heightened suspicion, audit VS Code extension installations and workspace task configurations, and restrict automatic task execution in editor settings.","heading":"Risk to Cryptocurrency Firms and Developers","sources":[{"url":"https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal","name":"Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency — Proofpoint","type":"research","credibility":1},{"url":"https://cybersecuritynews.com/north-korea-aligned-hackers-abuse-github-repositories/","name":"North Korea-Aligned Hackers Abuse GitHub Repositories to Infect Developers — CybersecurityNews","type":"news_article","credibility":2},{"url":"https://www.infosecurity-magazine.com/news/north-korean-hackers-developers/","name":"North Korean Hackers Use Fake Coding Tasks to Steal Crypto — Infosecurity Magazine","type":"news_article","credibility":2}],"severity":"critical"}],"timeline":[{"date":"2026-04","event":"Campaign begins (approximate; exact start date not publicly specified): UNK_DeadDrop starts sending phishing emails to developers with fake job-offer and code-review pretexts, directing targets to malicious GitHub and GitLab repositories.","source":"Proofpoint Threat Research","source_url":"https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal"},{"date":"2026-04","event":"Lure emails impersonate at least seven legitimate companies, including Ondo Finance, Empower Pharmacy, NXLog, OnePlan, Hypen Connect, Valon and Nourish.","source":"Proofpoint Threat Research","source_url":"https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal"},{"date":"2026-05","event":"In later May 2026, lures shift to peer code-review requests from fictional cryptocurrency and AI firms Pulsynk and Trixauvex, plus ERC-4626 smart-contract testing and AI payment agent themes.","source":"Proofpoint Threat Research","source_url":"https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal"},{"date":"2026-05","event":"Campaign ends (approximate): by the end of May 2026 more than 250 phishing emails had been sent to individuals at approximately 100 organizations over a six-week window.","source":"Proofpoint Threat Research; The Register","source_url":"https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal"},{"date":"2026-06","event":"Proofpoint publicly discloses the UNK_DeadDrop campaign in a threat-insight post describing its techniques, impersonated companies, Overlord framework, VSIX persistence and likely North Korean attribution.","source":"Proofpoint Threat Research","source_url":"https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal"},{"date":"2026-06","event":"The Register, Infosecurity Magazine, CybersecurityNews, TechRadar, SC Media and other outlets publish coverage of the Proofpoint disclosure.","source":"The Register","source_url":"https://www.theregister.com/security/2026/06/08/suspected-norks-send-250-fake-dev-job-pitches-to-steal-crypto/5252526"}],"sources_used":[{"url":"https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal","name":"Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency — Proofpoint","type":"research","archive_url":"http://web.archive.org/web/20260610202230/https://www.proofpoint.com/us/blog/threat-insight/dont-fear-repo-unkdeaddrop-phishing-campaign-targets-developers-steal","credibility":1,"archive_timestamp":"2026-06-10T20:22:30+00:00"},{"url":"https://www.theregister.com/security/2026/06/08/suspected-norks-send-250-fake-dev-job-pitches-to-steal-crypto/5252526","name":"Norks blast 250+ fake job offers to developers over 6 weeks to try and snarf creds and crypto — The Register","type":"news_article","archive_url":"http://web.archive.org/web/20260714061329/https://www.theregister.com/security/2026/06/08/suspected-norks-send-250-fake-dev-job-pitches-to-steal-crypto/5252526","credibility":1,"archive_timestamp":"2026-07-14T06:13:29+00:00"},{"url":"https://www.infosecurity-magazine.com/news/north-korean-hackers-developers/","name":"North Korean Hackers Use Fake Coding Tasks to Steal Crypto — Infosecurity Magazine","type":"news_article","archive_url":"http://web.archive.org/web/20260623202204/https://www.infosecurity-magazine.com/news/north-korean-hackers-developers/","credibility":2,"archive_timestamp":"2026-06-23T20:22:04+00:00"},{"url":"https://cybersecuritynews.com/north-korea-aligned-hackers-abuse-github-repositories/","name":"North Korea-Aligned Hackers Abuse GitHub Repositories to Infect Developers — CybersecurityNews","type":"news_article","archive_url":"http://web.archive.org/web/20260613013048/https://cybersecuritynews.com/north-korea-aligned-hackers-abuse-github-repositories/","credibility":2,"archive_timestamp":"2026-06-13T01:30:48+00:00"},{"url":"https://www.techradar.com/pro/security/north-korean-hackers-are-at-it-again-phishing-scheme-targets-hundreds-of-workers-to-try-and-steal-crypto-and-more","name":"North Korean hackers are at it again — phishing scheme targets hundreds of workers to try and steal crypto and more — TechRadar","type":"news_article","archive_url":"http://web.archive.org/web/20260621111158/https://www.techradar.com/pro/security/north-korean-hackers-are-at-it-again-phishing-scheme-targets-hundreds-of-workers-to-try-and-steal-crypto-and-more","credibility":2,"archive_timestamp":"2026-06-21T11:11:58+00:00"},{"url":"https://www.scworld.com/news/suspected-north-korean-actors-use-fake-coding-assignments-to-steal-crypto","name":"Suspected North Korean actors use fake coding assignments to steal crypto — SC Media","type":"news_article","archive_url":"http://web.archive.org/web/20260611092337/https://www.scworld.com/news/suspected-north-korean-actors-use-fake-coding-assignments-to-steal-crypto","credibility":2,"archive_timestamp":"2026-06-11T09:23:37+00:00"},{"url":"https://securitybrief.com.au/story/north-korea-linked-hackers-target-developers-via-github","name":"North Korea-linked hackers target developers via GitHub — SecurityBrief","type":"news_article","archive_url":"http://web.archive.org/web/20260629123030/https://securitybrief.com.au/story/north-korea-linked-hackers-target-developers-via-github","credibility":2,"archive_timestamp":"2026-06-29T12:30:30+00:00"},{"url":"https://cyberpress.org/north-korean-hackers-weaponize-github/","name":"North Korea-Linked Hackers Infect Developers via GitHub — CyberPress","type":"news_article","archive_url":"http://web.archive.org/web/20260726143444/https://cyberpress.org/north-korean-hackers-weaponize-github/","credibility":2,"archive_timestamp":"2026-07-26T14:34:44+00:00"},{"url":"https://gbhackers.com/north-korea-hackers-weaponize-github/","name":"North Korea Hackers Weaponize GitHub to Target Developers — GBHackers","type":"news_article","archive_url":"https://web.archive.org/web/20260726192240/https://gbhackers.com/north-korea-hackers-weaponize-github/#google_vignette","credibility":2,"archive_timestamp":"2026-07-26T19:22:40+00:00"},{"url":"https://attack.mitre.org/groups/G1052/","name":"Contagious Interview, DeceptiveDevelopment — MITRE ATT&CK Group G1052","type":"research","archive_url":"http://web.archive.org/web/20260723020829/https://attack.mitre.org/groups/G1052/","credibility":1,"archive_timestamp":"2026-07-23T02:08:29+00:00"},{"url":"https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/","name":"GitLab Threat Intelligence Team reveals North Korean tradecraft — GitLab","type":"research","archive_url":"http://web.archive.org/web/20260707052607/https://about.gitlab.com/blog/gitlab-threat-intelligence-reveals-north-korean-tradecraft/","credibility":2,"archive_timestamp":"2026-07-07T05:26:07+00:00"},{"url":"https://cyberpress.org/dprk-hackers-target-crypto/","name":"North Korea-Tied Operators Sustain Aggressive Crypto Targeting Campaign — CyberPress","type":"news_article","archive_url":"http://web.archive.org/web/20260311045352/https://cyberpress.org/dprk-hackers-target-crypto/","credibility":2,"archive_timestamp":"2026-03-11T04:53:52+00:00"},{"url":"https://securityonline.info/contagious-interview-north-korea-malicious-packages-dev-registries/","name":"The 1,700-Package Blitz: North Korea's Contagious Interview Infiltrates Every Major Dev Registry — Security Online","type":"news_article","archive_url":"https://web.archive.org/web/20260726094316/https://securityonline.info/contagious-interview-north-korea-malicious-packages-dev-registries/","credibility":2,"archive_timestamp":"2026-07-26T09:43:16+00:00"},{"url":"https://ofac.treasury.gov/recent-actions","name":"OFAC Recent Actions — U.S. Department of the Treasury","type":"regulatory","archive_url":"http://web.archive.org/web/20260725070749/https://ofac.treasury.gov/recent-actions","credibility":1,"archive_timestamp":"2026-07-25T07:07:49+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-06-14T17:03:44.769366+00:00","updated_at":"2026-10-27T04:29:49.737+00:00"},"source_quality":{"total":14,"tier1":1,"tier2":0,"tier3":0,"unrated":13},"follower_count":null,"content_updated_at":"2026-10-27T04:29:50.111Z","last_fact_checked_at":"2026-06-15T00:11:58.880Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}