November 2025 APT Group Trends

This report summarizes evolving North Korean APT activity—detailing Famous Chollima’s developer-targeted ‘Contagious Interview’ campaign using JSON storage services to deliver multi-stage malware (BeaverTail, InvisibleFerret, Tsunami), Kimsuky’s KimJongRAT-based phishing and credential-theft operations (including Chrome master-key extraction and GitHub/Drive-hosted payloads), and Konni’s social-engineering attacks that enable Android remote wipes and RAT deployments; it highlights targeted sectors, tools, delivery infrastructures, and observed TTPs used to evade detection and exfiltrate sensitive information.