Campaign targeting security researchers (fake research blog, Twitter profiles, Visual Studio projects)

CSIS Significant Cyber Incidents

North Korean government hackers engaged in a sophisticated social engineering campaign against cybersecurity researchers that used multiple fake twitter accounts and a fake blog to drive targets to infected sites or induce them to open infected attachments in emails asking the target to collaborate on a research project.

EuRepoC

Since 2020, APT Lazarus has been targeting security researchers using a Trojanized version of the IDA Pro application. In its tweet, IT company ESET links the campaign to reports from Microsoft and Google of attacks on security researchers.

ThaiCERT Threat Group Cards

New campaign targeting security researchers https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/ https://www.zdnet.com/article/google-north-korean-hackers-have-targeted-security-researchers-via-social-media/ https://www.microsoft.com/security/blog/2021/01/28/zinc-attacks-against-security-researchers/

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

South Korean cybersecurity firm ENKI report that they were the target of a campaign by the Lazarus Group exploiting an Internet Explorer 0-day vulnerability.

CFR Cyber Operations Tracker

North Korean hackers used spear-phishing social media techniques to target security researchers to install malware onto targets’ Windows systems.

Wikipedia (English), accessed 2026-10-06

In January 2021, Google and Microsoft both publicly reported on a group of North Korean hackers targeting cybersecurity researchers via a social engineering campaign, with Microsoft specifically attributing the campaign to the Lazarus Group.

Check Point Research

Researchers suspect that North Korean APT Lazarus is behind a social engineering espionage campaign that has been targeting security researchers in the past few months. The group has established several Twitter accounts posting high quality security content in order to gain credibility.

Hackmageddon cyber attacks timelines (Paolo Passeri)

Researchers from Google (and few days later from Microsoft) reveal the details of a North Korean government-backed hacking group, targeting security researchers who focus on vulnerability and exploit development via social networks, disclosed Google tonight. [Date Occurred: Mid-2020; Date Discovered: -]

Hackmageddon cyber attacks timelines (Paolo Passeri)

South Korean cybersecurity firm ENKI report that they were the target of a campaign by the Lazarus Group exploiting an Internet Explorer 0-day vulnerability. [Date Occurred: -; Date Discovered: -]

Microsoft Threat Intelligence (Microsoft Security Blog)

In recent months, Microsoft has detected cyberattacks targeting security researchers by an actor we track as ZINC. The campaign originally came to our attention after Microsoft Defender for Endpoint detected an attack in progress. Observed targeting includes pen testers, private offensive security researchers, and employees at security and tech companies. Microsoft Threat Intelligence Center (MSTIC) attributes this campaign with high confidence to ZINC, a DPRK-affiliated and state-sponsored group ... In mid-2020, ZINC started building a reputation in the security research community on Twitter

Google Threat Analysis Group (TAG) blog

Over the past several months, the Threat Analysis Group has identified an ongoing campaign targeting security researchers working on vulnerability research and development at different companies and organizations. The actors behind this campaign, which we attribute to a government-backed entity based in North Korea

Affiliations: Lazarus Group ... North Korean hackers used spear-phishing social media techniques to target security researchers