[Unnamed groups: North Korea]

Also known as: Operation “DEV#POPPER”

These are reported APT activities attributed to a country, but not to an individual threat group.

🌍 Country ["North Korea"]

Associated Operations

2019-08 2024-04 2024-07 2024-08 2024-10 APT Actors Embed Malware within macOS Flutter Applications Analysis of DEV#POPPER: New Attack Campaign Targeting Software Developers Likely Associated With North Korean Threat Actors Operation “DEV#POPPER” Research Update: Threat Actors Behind the DEV#POPPER Campaign Have Retooled and are Continuing to Target Software Developers via Social Engineering South Korea says DPRK hackers stole spy plane technical data Suspected North Korean Cyber Espionage Campaign Targets Multiple Foreign Ministries and Think Tanks https://www.anomali.com/blog/suspected-north-korean-cyber-espionage-campaign-targets-multiple-foreign-ministries-and-think-tanks#When:14:00:00Z https://www.bleepingcomputer.com/news/security/south-korea-says-dprk-hackers-stole-spy-plane-technical-data/ https://www.jamf.com/blog/jamf-threat-labs-apt-actors-embed-malware-within-macos-flutter-applications/ https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/ https://www.securonix.com/blog/research-update-threat-actors-behind-the-devpopper-campaign-have-retooled-and-are-continuing-to-target-software-developers-via-social-engineering/

Introduction

These are reported APT activities attributed to a country, but not to an individual threat group.

Activities and Tactics

Country of Origin: 🇰🇵 [“North Korea”]

Notable Campaigns

  • 2019-08
  • 2024-04
  • 2024-07
  • 2024-08
  • 2024-10
  • APT Actors Embed Malware within macOS Flutter Applications
  • Analysis of DEV#POPPER: New Attack Campaign Targeting Software Developers Likely Associated With North Korean Threat Actors
  • Operation “DEV#POPPER”
  • Research Update: Threat Actors Behind the DEV#POPPER Campaign Have Retooled and are Continuing to Target Software Developers via Social Engineering
  • South Korea says DPRK hackers stole spy plane technical data
  • Suspected North Korean Cyber Espionage Campaign Targets Multiple Foreign Ministries and Think Tanks
  • https://www.anomali.com/blog/suspected-north-korean-cyber-espionage-campaign-targets-multiple-foreign-ministries-and-think-tanks#When:14:00:00Z
  • https://www.bleepingcomputer.com/news/security/south-korea-says-dprk-hackers-stole-spy-plane-technical-data/
  • https://www.jamf.com/blog/jamf-threat-labs-apt-actors-embed-malware-within-macos-flutter-applications/
  • https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/
  • https://www.securonix.com/blog/research-update-threat-actors-behind-the-devpopper-campaign-have-retooled-and-are-continuing-to-target-software-developers-via-social-engineering/

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

Information pending cataloguing.

Attribution and Evidence

Country of Origin: [“North Korea”] Additional attribution information pending cataloguing.

References

References pending cataloguing.