Inside DPRK Operations: New Lazarus and Kimsuky Infrastructure Uncovered Across Global Campaigns

Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.

Hunt.io traces new Kimsuky-suspected infrastructure reusing the distinctive 'Million OK!!!!' HTTP response and Naver branding, with domains on linked p-e.kr-style TLDs hosted in South Korea.

On 23 September 2026, a threat actor published a novel supply chain worm to the following packages:

CrowdStrike identified a financially motivated threat actor who works as a bug bounty hunter and who developed and distributed the JavaScript-based information stealer PhantomRaven.

TeamPCP hit durabletask 1.4.1-1.4.3, Microsoft's Durable Task client: a hijacked account dumped a GitHub-stored PyPI token to push malware that steals credentials, spreading via AWS SSM.

Wiz attributes the cross-ecosystem campaign to TeamPCP: @antv npm packages, actions-cool/issues-helper GitHub Action, and a VS Code extension steal credentials and drop a GitHub-polled backdoor.