NorthScan Logo
PyLangGhost RAT: Rising Stealer from Lazarus Group Striking Finance and Technology
Malware Analysis

PyLangGhost RAT: Rising Stealer from Lazarus Group Striking Finance and Technology

Analysis of PyLangGhost RAT, a Python-based malware from Lazarus subgroup Famous Chollima targeting finance and tech sectors through fake job interviews, stealing credentials and cryptocurrency wallets.

Lazarus GroupRATCryptocurrency
NS
Mauro Eldritch
•August 6, 2025•14 min read
PyLangGhost RAT: Rising Stealer from Lazarus Group Striking Finance and TechnologyMalware Analysis

PyLangGhost RAT: Rising Stealer from Lazarus Group Striking Finance and Technology

by Mauro Eldritch•August 6, 2025•14 min read

Analysis of PyLangGhost RAT, a Python-based malware from Lazarus subgroup Famous Chollima targeting finance and tech sectors through fake job interviews, stealing credentials and cryptocurrency wallets.

Unmasking Suspicious GitHub Activity: The WageMole Campaign and DPRK Threat ActorsDPRK Analysis

Unmasking Suspicious GitHub Activity: The WageMole Campaign and DPRK Threat Actors

by NorthScan Team•January 15, 2025•12 min read

Comprehensive investigation into suspicious GitHub activity revealing coordinated campaigns by DPRK-affiliated actors using fake identities and the #OpenToWork hashtag to infiltrate organizations.

Fraud Alert: Fake recruiters on GitHub and LinkedInFraud Alert

Fraud Alert: Fake recruiters on GitHub and LinkedIn

by NorthScan Team•January 10, 2025•10 min read

Investigation into fraudulent recruiter accounts on GitHub and LinkedIn used by threat actors to target developers and infiltrate organizations through fake job opportunities.

Summary of Findings on Suspicious GitHub Activity Linked to DPRK IT WorkersDPRK Analysis

Summary of Findings on Suspicious GitHub Activity Linked to DPRK IT Workers

by NorthScan Team•January 8, 2025•15 min read

Comprehensive recap of findings regarding suspicious Lazarus Group activity on GitHub, analyzing patterns in fake developer profiles, achievement badges, and coordinated campaigns targeting the developer community.

Reviewing the activity of GitHub accounts linked to DPRK IT workersDPRK Analysis

Reviewing the activity of GitHub accounts linked to DPRK IT workers

by NorthScan Team•December 4, 2024•12 min read

In-depth analysis of GitHub account activity associated with Lazarus Group, examining commit history manipulation, identity obfuscation techniques, and patterns used by DPRK IT workers to maintain cover identities.

Suspicious activity in GitHub associated with DPRK IT WorkersDPRK Analysis

Suspicious activity in GitHub associated with DPRK IT Workers

by NorthScan Team•November 29, 2024•14 min read

Detailed investigation into suspicious GitHub activity patterns associated with Lazarus Group and DPRK IT workers, revealing coordinated efforts to establish fake developer identities and infiltrate software development communities.

From North Korean IT Workers to IT RecruitersDPRK Intelligence

From North Korean IT Workers to IT Recruiters

by SEAL Intel (Heiner)•November 7, 2024•18 min read

DPRK IT workers evolve from job seekers to recruiters, orchestrating systematic identity harvesting campaigns on Upwork and Freelancer platforms through scripted collaboration requests and remote access tools.