WageMole

ACTIVE CAMPAIGN TRACKED ⚠ Critical Threat North Korea

Primary Aliases: Famous Chollima UNC5267 Nickel Tapestry PurpleBravo

Sponsor / State Affiliation Democratic People's Republic of Korea (DPRK)

Primary Motivation Financial gain to evade international sanctions and fund weapons programs, alongside state-sponsored cyber espionage.

Confidence Rating 95% (Grounded)

Koalemos, PurpleDelta / Fraudulent Employment Operations, Contagious Interview

🎯 Target Sectors & Focus

Software & Technology Financial Technology (FinTech) Cryptocurrency Defense & Aerospace Healthcare Biotechnology Staffing & Consulting

🛡️ MITRE ATT&CK® Attack Lifecycle (9 TTPs)

📥 Download Navigator JSON

Initial Access 1

T1566 Abuse of Remote Administration Tools (RATs) and VPNs

Credential Access & Discovery 1

T1003 Social Engineering via Fake Job Interviews

Command & Control 3

T1071 AI-generated Personas (deepfake photos and voice)

T1071 Laptop Farms (use of domestic facilitators to receive corporate hardware)

T1071 Custom Backdoors (e.g., InvisibleFerret)

Operational Techniques 4

T1000 Fraudulent Remote Employment

T1000 Malicious npm Packages

T1000 Identity Fabrication (stolen/forged passports and IDs)

T1000 Information Stealing Malware (e.g., BeaverTail)

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] North Korean WaterPlum Group Compromised 30,000 Devices in 8‑Month Cryptocurrency Theft Campaign

Attacks and Vulnerabilities 2026-10-07

[DEEP DIVE] North Korean Threat Actors Deploy PylangGhost and GolangGhost via Sophisticated Job Interview Scams

Attacks and Vulnerabilities 2026-07-22

Copied to clipboard

LINK COPIED TO CLIPBOARD