Operation “Phantom Circuit”

ThaiCERT Threat Group Cards

Operation “Phantom Circuit” Operation Phantom Circuit: North Korea’s Global Data Exfiltration Campaign https://securityscorecard.com/wp-content/uploads/2025/01/Operation-Phantom-Circuit-Report_012725_03.pdf

Hackmageddon cyber attacks timelines (Paolo Passeri)

Researchers at SecurityScorecard uncover "Phantom Circuit", targeting cryptocurrency and technology developers, planting backdoors in clones of legitimate software packages and open source tools, and employing advanced obfuscation techniques through proxy servers. [Date Occurred: Since November 2024; Date Discovered: During December 2024]

India was the most impacted country with 110 unique victims during the course of this campaign.

With a concentration in Brazil (32 unique IPs) and India (284 unique IPs) being the countries with the most traffic to the C2.