Cybersecurity

Infiltrated: Inside North Korea's Hacking Network

A Black Hat researcher spent 22 months inside a North Korean hacking group's systems, exposing 1,640 breached companies and a fake-recruiter attack vector.

CybersecurityBy Servola Tech Desk2026-08-063 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Infiltrated: Inside North Korea's Hacking Network

Key takeaways

A Black Hat researcher spent 22 months secretly inside a North Korean hacking group's own systems and found it had compromised 1,640 companies in 57 countries, with 700 to 800 breaches reaching root-level or cloud access.
Named victims include Oppo, Coinbase, Uniswap Labs, and Boston Children's Hospital, alongside several unnamed government agencies.
A related, active campaign called Contagious Interview uses fake LinkedIn recruiters and fake coding tests to plant malware on developers' machines.
The payload often hides inside a GitHub repository's .githooks folder, so it runs automatically the moment a developer commits code, no download needed.
Proofpoint tracked over 250 malicious recruitment emails in April and May 2026 alone, focused on tech, education, and finance workers, especially crypto-adjacent roles.

A Hacker's Own Mistake Opened the Door

For 22 months, Vangelis Stykas watched a North Korean state hacking crew from the inside, not because he broke into their systems, but because their own malware broke into their own workstations first. Stykas, chief technology officer at cybersecurity firm Kumio, told the Black Hat Las Vegas conference in early August 2026 that the operators infected themselves, opening a window into their internal Slack and Discord channels.

That accidental foothold gave him quiet access to roughly 5 terabytes of data the group had stolen from its own victims, plus a rare look at how the operation actually ran day to day, entirely undetected by the hackers themselves.

1,640 Companies, 57 Countries, a Dozen Names

Stykas said the group had compromised 1,640 companies across 57 countries during the period he had access. Between 700 and 800 of those intrusions he classified as severe, meaning the attackers had reached root-level access to servers, AWS cloud environments, or cryptocurrency wallets, well beyond a foothold on a single machine.

In his presentation, Stykas publicly named roughly a dozen of the affected organizations, including smartphone maker Oppo, Coinbase, Uniswap Labs, Boston Children's Hospital, and several government agencies he did not identify by name.

The Way In Was a Job Interview

Separate from Stykas's research, security teams at Elastic Security Labs, Proofpoint, and other firms have spent 2026 tracking a live North Korean campaign known as Contagious Interview, linked to the Lazarus Group. Operators pose as recruiters on platforms such as LinkedIn, approach software developers with what looks like a genuine job opportunity, and then send a coding assessment hosted on a GitHub repository.

The trap sits inside the repository's .githooks folder as a pre-commit hook, so it fires automatically the moment the developer commits their test code, no separate download or double-click required. Other variants of the same campaign have hidden the payload inside SVG image files using steganography, and Proofpoint tracked more than 250 malicious recruitment emails in April and May 2026 alone, concentrated on technology, education, and finance-sector workers, with a particular focus on cryptocurrency-adjacent roles.

What the Malware Actually Does

The malware families used in these campaigns, including OTTERCOOKIE and related tools, are built to steal browser credentials, cryptocurrency wallets, and files, and to hand the operators remote access to the infected machine. For a developer, that access often lands inside the same environment that holds company repositories, cloud credentials, and client data.

That is the link between the two threads. A group shown capable of running intrusions at the scale Stykas documented, 1,640 companies in 57 countries, is also documented running a significant share of its access through the ordinary act of hiring, which makes the vector relevant to any EU or UK company that hires remote developers or contractors, and to any developer currently job hunting.

Three Checks Before You Clone That Repo

The practical defense is specific, not generic phishing advice. Verify a recruiter's identity independently, through the company's own careers page or a known employee, before running any code they send. Treat a coding test that requires cloning a full repository with hooks and setup scripts as more suspect than one delivered through an isolated, sandboxed platform, since the sandbox removes the exact mechanism the .githooks trick depends on.

Treat an unusually fast, high-pressure hiring timeline as a bigger red flag than it would have been a year ago, and never run a setup script, npm install, or build command from a test repository before that identity check is complete. None of this requires new tooling, only a pause before the first command runs.

Frequently asked questions

How did Vangelis Stykas gain access to the North Korean hacking group's systems?

Their own malware infected their own operators' workstations, which exposed the group's internal Slack and Discord channels and about 5 terabytes of stolen data to Stykas for 22 months.

Were the 1,640 compromised companies all breached through fake job offers?

That is not established. Stykas's infiltration documented the scale of the group's intrusions overall; the fake-recruiter and fake coding-test campaign, tracked separately by researchers at Elastic Security Labs and Proofpoint, is a related and currently active vector used by the same North Korean ecosystem, not a claim about how every one of the 1,640 companies was breached.

What should a developer do if a recruiter asks them to clone a GitHub repo for a coding test?

Verify the recruiter and the company independently before running anything, prefer coding tests delivered through a sandboxed platform rather than a full repository clone, and treat any request to run a setup script, npm install, or build command before that verification as a reason to stop.

The scale Stykas documented, 1,640 companies compromised over 22 months of quiet access, is a research finding. The mechanism tying a meaningful share of it to ordinary recruiting messages is the actionable part: any EU or UK company hiring remote developers, and any developer answering a recruiter's DM, now has a concrete, checkable reason to verify identity before a single line of test code ever runs.

North KoreaLazarus GroupBlack HatHiring SecurityContagious InterviewGitHub Security

Rotate Every CI Credential You Used on 4 August

A worm called ChainDrop poisoned 435 npm packages with 1,557 versions in a 124 minute window on 4 August. The libraries with the widest reach are caching helpers almost nobody installs on purpose.

4 min read

Cybersecurity

The Pen Test Moved Into Production and Stayed

Horizon3 raised 250 million dollars at a valuation above 2 billion for NodeZero, which runs penetration tests continuously against live production systems. The company opened an Amsterdam office in June.

4 min read

Decisions

The Codename Worked. The Trading Controls Did Not

An indictment unsealed on 24 July says two Volkswagen engineers traded on a joint venture known internally as Project Climb. The control that failed is a common one.

5 min read

← All articles