Undisclosed organizations in the retail industry

Date (as written): 25/03/2026
Year: 2026
Country: Unknown
Actors (as written): North Korean APT groups (overlapping with "Contagious Interview")
Actor pages: North Korean APT groups
Tags (as written): Attack: Malware; Target Class: Wholesale/Retail; Attack Class: Cyber Espionage Cyber Crime; Initial Access: Social Engineering

Source entries (1)

Hackmageddon cyber attacks timelines (Paolo Passeri)

Undisclosed organizations in the retail industry · 25/03/2026

Researchers at eSentire’s discover EtherRAT, a Node.js-based backdoor linked to North Korean actors. The malware uses "EtherHiding" via Ethereum smart contracts to secure C2 addresses, targeting the retail sector through ClickFix and IT support scams to exfiltrate data. [Date Occurred: During March 2026; Date Discovered: During March 2026]

https://www.hackmageddon.com/2026/04/14/16-31-march-2025-cyber-attacks-timeline/

https://www.infosecurity-magazine.com/news/etherrat-bypass-security-ethereum/

Suggest a correction on GitHub