Operation Phantom Circuit: North Korea’s Global Data Exfiltration Campaign

**Executive Summary:** STRIKE attributes a sophisticated, large-scale supply-chain campaign called “Phantom Circuit” to North Korea’s Lazarus Group, reporting that attackers embedded malware into trusted development tools to compromise ~1,500 developer systems across three waves, operated a modern React/Node.js C2 platform, used VPNs and Oculus proxies to obfuscate origin, and exfiltrated credentials and other sensitive data to Dropbox.