New Lazarus and Kimsuky Infrastructure Discovered with Active Tools and Tunneling Nodes

Gbhackers •Mayura Kathir • December 18, 2025

GBHackers on Security is a top cybersecurity news platform, delivering up-to-date coverage on breaches, emerging threats, malware, vulnerabilities, and global cyber incidents.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Lazarus and Kimsuky Infrastructure Exposed with Active Tools A joint investigation by Hunt.io and the Acronis Threat Research Unit has uncovered a new network associated with North Korean cyber actors Lazarus and Kimsuky. The research revealed active tool-staging servers, credential-theft environments, and tunneling nodes controlled by DPRK operators, indicating ongoing global cyber operations. 2 sources 40

Extracted Entities

APT Groups (2)

Kimsuky Lazarus