September 2025 APT Group Trends

Executive summary: This intelligence brief details multiple North Korea-linked APT campaigns (Kimsuky, Lazarus, TA-RedAnt/APT37) targeting defense, research, cryptocurrency, and retail sectors using advanced social engineering (spear-phishing, deepfake military IDs, ClickFix), repository-based distribution, and a range of malware (MSC/AutoIt/PowerShell loaders, BeaverTail, InvisibleFerret, Rustonotto, Chinotto, FadeStealer). The report lists tactics, persistence mechanisms, and sample artefacts/filenames, describing sustained information-stealing and remote-access operations with potential credential and sensitive data exfiltration.