North Korea and Russia Collaborate in Cyber Operations

Nknews

North Korea and Russia Collaborate in Cyber Operations

First seen 24 Nov 2025, 09:25 UTC • •39.7

Article Content

1 / 5

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

North Korea's Lazarus Group and Russia's Gamaredon have reportedly begun collaborating in cyber operations, marking the first known instance of such cooperation. Researchers from Gen Digital indicate that the two groups may be sharing infrastructure and resources, suggesting a significant escalation in their cyber activities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 229d ago How this analysis works

More articles in this cluster (4)

Threat Graph

9 entities, 18 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (3)

Gamaredon
Lazarus
Lazarus Group

Technique (2)

Malware
T1071 - Command And Control

Campaign (2)

Contagious Interview
ContagiousInterview

Malware (1)

InvisibleFerret

Affected Platform (1)

Telegram

Relationships

Gamaredon uses InvisibleFerret
Lazarus uses InvisibleFerret
Lazarus Group uses InvisibleFerret
Gamaredon uses Malware
Gamaredon uses T1071 - Command And Control
Lazarus uses Malware
Lazarus uses T1071 - Command And Control
Lazarus Group uses Malware
Lazarus Group uses T1071 - Command And Control
Contagious Interview attributed to Gamaredon
Contagious Interview attributed to Lazarus
Contagious Interview attributed to Lazarus Group
ContagiousInterview attributed to Gamaredon
ContagiousInterview attributed to Lazarus
ContagiousInterview attributed to Lazarus Group
Contagious Interview uses InvisibleFerret
ContagiousInterview uses InvisibleFerret
Gamaredon related to Telegram

Following this threat?

Track Gamaredon and InvisibleFerret in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Russian Hackers Use Yggdrasil Network in Cyberattack on Ukrainian Grain Firm In July 2025, Russia-aligned hackers from UAC-0099 gained access to a Ukrainian grain logistics company via a phishing email. They deployed the MATCHWOK backdoor and later introduced a new backdoor, MythicRatatoskr, which communicated through the Yggdrasil decentralized network. This attack culminated in a data-wiping…

PHP2Shell Vulnerabilities Exploited by AI-Driven Attackers Threat actors have exploited PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to target a government entity in Europe, gaining access to sensitive data within two hours of the initial breach. The attackers utilized AI tools for reconnaissance and post-exploitation activities, including accessing…