DPRK Cyber Program Uses Modular Malware Strategy to Evade Attribution and Survive Takedowns

The report describes a mature, loss-tolerant DPRK cyber program that fragments purpose-built malware families into three mission-aligned tracks—espionage (long-term stealth targeting governments and think tanks), financial theft (Lazarus-linked campaigns against crypto platforms using fake wallets and supply-chain compromise), and disruptive operations (Andariel-associated wipers and ransomware timed to political events)—emphasizing social engineering for initial access and recommending behavior-based detection and cloud/identity telemetry.