DPRK Cyber IndexYearsActorsSourcesAttacks on North KoreaMethodologyContributeSearch

DPRK-Related Campaigns with LNK and GitHub C2 | FortiGuard Labs

Date (as written)
2026-04-02T13:00:00.000Z
Year
2026

Source entries (2)

Hackmageddon cyber attacks timelines (Paolo Passeri)

Various companies and users in South Korea. · 02/04/2026
Researchers at Fortinet reveal that North Korean threat actors are deploying LNK files and GitHub infrastructure to target South Korean entities. They utilize multi-stage PowerShell scripts for persistence, data exfiltration, and evasion of security environments. [Date Occurred: 'Recently'; Date Discovered: 'Recently']
https://www.hackmageddon.com/2026/04/24/1-15-april-2026-cyber-attacks-timeline/
https://docs.google.com/spreadsheets/d/e/2PACX-1vQ2r4m8VwOtuzK2FJuvkcNKKkg6xMvBiZ2EhovYv9UrG3HLCH6yZ9e0udWfTyL8Gkf3-M33jOAfC_rR/pub?gid=1060075184&single=true&output=csv
https://thehackernews.com/2026/04/dprk-linked-hackers-use-github-as-c2-in.html

Fortinet FortiGuard Labs blog

DPRK-Related Campaigns with LNK and GitHub C2 | FortiGuard Labs · 2026-04-02T13:00:00.000Z
Analysis of DPRK-linked LNK-based attacks using GitHub as covert C2 infrastructure, detailing multi-stage PowerShell execution, persistence mechanisms, and data exfiltration techniques targeting Wi…
https://www.fortinet.com/blog/threat-research/dprk-related-campaigns-with-lnk-and-github-c2

Suggest a correction on GitHub