Discover Activities Linked to the DPRK-nexus Intrusion Sets

This report synthesizes open-source reporting on North Korea–linked intrusion sets in 2022, detailing persistent and evolving cyberespionage and financially motivated campaigns by groups such as Lazarus, Bluenoroff, Andariel, Kimsuky and Reaper. It documents malware families (BLINDINGCAN, Maui, AppleJeus, CloudMensis, Manuscrypt, MagicRAT), TTPs (spearphishing, BYOVD, zero‑day exploitation, geofencing, hosting C2 on public services), major cryptocurrency thefts and laundering, suspected ties to cybercriminal ecosystems, and concludes DPRK cyber activity remains sophisticated, adaptable, and a high-priority threat.