SecurityScorecard Blog

Lazarus Group Targets Developers Through NPM Packages and Supply Chain Attacks

North Korea’s Lazarus Group is evolving its tactics again. The latest campaign, dubbed Operation Marstech Mayhem, introduces an advanced implant named "Marstech1."

A Deep Peek at DeepSeek

DeepSeek’s rapid ascent in the AI space has made it impossible to ignore. Its sophisticated models and AI assistant have captured global attention. And, while headlines focus on DeepSeek’s capabilities, STRIKE research exposes critical security flaws, hidden data flows, and unanswered questions about who has access to the data and why.

Operation Phantom Circuit: North Korea’s Global Data Exfiltration Campaign

In December 2024, a routine software update concealed a global threat. Attackers from the Lazarus Group, based in North Korea, infiltrated trusted development tools, compromising hundreds of victims worldwide. This sophisticated campaign, code-named "Phantom Circuit," targeted cryptocurrency and technology developers, employing advanced obfuscation techniques through proxy servers in Hasan, Russia.

Operation 99: North Korea’s Cyber Assault on Software Developers

On January 9, the SecurityScorecard STRIKE team uncovered Operation 99, a cyberattack by the Lazarus Group, North Korea’s state-sponsored hacking unit.

The Botnet is Back: SSC STRIKE Team Uncovers a Renewed Cyber Threat

Discover the resurgence of Volt Typhoon, a state-sponsored cyber-espionage group targeting the energy sector. Learn how they exploit legacy systems and outdated devices to embed themselves within critical infrastructure, posing a silent yet significant threat. Stay informed about the evolving tactics, global reach, and implications for national security.

The Job Offer That Wasn’t: How We Stopped an Espionage Plot

Discover how SecurityScorecard thwarted a sophisticated cyber-espionage plot disguised as a job offer. Learn about the 'Contagious Interview' campaign, the tactics used by the Famous Chollima group, and essential strategies to protect your organization from targeted attacks. Don't let your next career move become a trap—stay informed and secure!

Inside a North Korean Phishing Operation Targeting DevOps Employees

Uncover how SecurityScorecard thwarted a sophisticated phishing attack targeting our DevOps team. This blog details a North Korean state actor's attempt to deploy a malicious backdoor through a fake job offer on social media. Learn about the evolving tactics of threat actors and how our swift response blocked potential damage. Stay informed and strengthen your defenses against these persistent cyber threats.

TTPs Associated With a New Version of the BlackCat Ransomware

In this post, we describe a real engagement that we recently handled by giving details about the tools, techniques, and procedures (TTPs) used by this threat actor.

Analysis of APT35 infrastructure reveals interest in Egyptian Shipping Companies

Was the Explosion at Freeport LNG a Result of a Russian Cyber Attack?

KillNet Utilizes CC-Attack: A Quick & Dirty DDoS Method

SecurityScorecard's analysis of CC-Attack reveals the script automates the process of using open proxy servers to relay attacks.

JBS Ransomware Attack Started in March and Much Larger in Scope than Previously Identified

SecurityScorecard found that the JBS ransomware attack started in March and is much larger in scope than previously identified. Check out SecurityScorecard's research.