Skip to content
North Korean Actors Use JSON Services for Malware Delivery

North Korean Actors Use JSON Services for Malware Delivery

First seen 17 Nov 2025, 15:14 UTC • •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •March 12, 2026 at 13:27 UTC

North Korean threat actors have adopted new tactics by utilizing JSON storage services to host and deliver malware through trojanized code projects. This method is part of the Contagious Interview campaign, as reported by NVISO. The use of services like JSON Keeper and JSONsilo marks a significant evolution in their malware distribution strategies.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 214d ago How this analysis works

More articles in this cluster (3)

Following this threat?

Track Lazarus Group in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed