Russia and North Korea Collaborate in Cyber Operations

Mezha

Russia and North Korea Collaborate in Cyber Operations

First seen 2 Dec 2025, 18:33 UTC • •41.2

Article Content

1 / 5

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Research indicates that Russian APT group Gamaredon and North Korean Lazarus Group are collaborating by sharing operational infrastructure. This partnership marks a significant development in state-sponsored cyber activities, with both groups reportedly active on the same server and exchanging resources for potential global attacks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 217d ago How this analysis works

More articles in this cluster (4)

Threat Graph

9 entities, 18 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (3)

Gamaredon
Lazarus
Lazarus Group

Technique (2)

Malware
T1071 - Command And Control

Campaign (2)

Contagious Interview
ContagiousInterview

Malware (1)

InvisibleFerret

Affected Platform (1)

Telegram

Relationships

Gamaredon uses InvisibleFerret
Lazarus uses InvisibleFerret
Lazarus Group uses InvisibleFerret
Gamaredon uses Malware
Gamaredon uses T1071 - Command And Control
Lazarus uses Malware
Lazarus uses T1071 - Command And Control
Lazarus Group uses Malware
Lazarus Group uses T1071 - Command And Control
Contagious Interview attributed to Gamaredon
Contagious Interview attributed to Lazarus
Contagious Interview attributed to Lazarus Group
ContagiousInterview attributed to Gamaredon
ContagiousInterview attributed to Lazarus
ContagiousInterview attributed to Lazarus Group
Contagious Interview uses InvisibleFerret
ContagiousInterview uses InvisibleFerret
Gamaredon related to Telegram

Following this threat?

Track Gamaredon and InvisibleFerret in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

New WeaselBiscuit JavaScript Stealer Discovered in npm Packages Cybersecurity researchers identified a new JavaScript stealer named WeaselBiscuit, which spreads through 13 malicious npm packages. This malware is believed to have functional overlaps with DPRK-associated strains BeaverTail and OtterCookie but is smaller and lacks certain advanced features. It operates by executing a…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…