ESET APT Activity Report Q2 2025–Q3 2025 (DPRK-related paragraph 1)

ESET WeLiveSecurity

North Korea-aligned threat actors targeted the cryptocurrency sector and, notably, expanded their operations to Uzbekistan – a country not previously observed in their scope. In recent months, we have documented several new campaigns conducted by DeceptiveDevelopment, Lazarus, Kimsuky, and Konni, with the aim of espionage, advancing Pyongyang’s geopolitical priorities, and generating revenue for the regime. Kimsuky experimented with the ClickFix technique to target diplomatic entities, and South Korean think tanks and academia, while Konni used social engineering with an unusual focus on macOS systems.