North Korean hackers spotted using new tools on employees of 'nuclear-related' org

North Korean state-backed hackers (Lazarus Group and Andariel) conducted targeted intrusion attempts against employees of a nuclear-related organization using trojanized VNC lures and a multi-stage malware chain—including CookieTime and the newly observed modular CookiePlus—while Andariel employed SmallTiger to exploit asset-management and document consolidation software; the activity demonstrates evolved delivery, persistence, and modular capabilities and is contextualized by significant cryptocurrency theft attributed to North Korean-linked actors in 2024.