Researchers Uncovered New Lazarus and Kimsuky Infrastructure with Active Tools and Tunnelling Nodes

Cybersecuritynews •Tushar Subhra Dutta • December 18, 2025

A joint investigation by Hunt.io and the Acronis Threat Research Unit has exposed an extensive network of North Korean state- infrastructure, revealing fresh connections between Lazarus and Kimsuky operations across global campaigns. The research uncovered active tool-staging servers, credential-theft environments, FRP tunneling nodes, and a certificate-linked infrastructure fabric controlled by DPRK operators. This discovery provides […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Lazarus and Kimsuky Infrastructure Exposed with Active Tools A joint investigation by Hunt.io and the Acronis Threat Research Unit has uncovered a new network associated with North Korean cyber actors Lazarus and Kimsuky. The research revealed active tool-staging servers, credential-theft environments, and tunneling nodes controlled by DPRK operators, indicating ongoing global cyber operations. 2 sources 40

Researchers Uncovered New Lazarus and Kimsuky Infrastructure with Active Tools and Tunnelling Nodes

The full story

Extracted Entities

APT Groups (2)

Domains (1)