#DPRK

DPRK-aligned threat activity: Lazarus, Kimsuky and related clusters

Subscribe (RSS)


#DPRK

DPRK-aligned activity: Lazarus, Kimsuky and more

Subscribe (RSS)

IOCs by window

Today

0

IOCs tagged #DPRK

Week

0

IOCs tagged #DPRK

Month

5

IOCs tagged #DPRK

Year

11,669

IOCs tagged #DPRK

Counts as of 2026-10-29. Regenerated daily.

About #DPRK

  • Scope: Umbrella tag for DPRK-aligned clusters.
  • Clusters: Lazarus, Kimsuky, Andariel, BlueNoroff, plus Konni and ScarCruft / APT37 in some schemes.
  • Goals: Crypto theft, South Korea intel, supply-chain attacks, defence-contractor recon.
  • Lures: Spearphishing with LinkedIn / Instagram lures. Weaponised HWP / PDF files.
  • Malware: Implants like AppleJeus, LightlessCan, Manuscrypt, BabyShark, GoldDragon.
  • References: G0032 Lazarus · G0094 Kimsuky · CISA North Korea.

Recent IOCs tagged #DPRK

Latest 5 IOCs from the past 30 days. Live JSON: api.tweetfeed.live/v1/month/dprk.

Date Type Value Source
Oct 14, 14:35 domain iwnw-1knwni-21siw.xo.je @fr0s7_
Oct 14, 14:35 url https://iwnw-1knwni-21siw.xo.je/YE97Bw999zB87t1U8i.php @fr0s7_
Oct 01, 10:22 domain rajug.eu @smica83
Oct 01, 10:22 url http://rajug.eu @smica83
Oct 01, 10:22 sha256 4f954c7c6228ca4eb0e6b7c3d5f2d025467996866c2d9ae4dd1f005cb6cb... @smica83

Low volume this month. Year total: 11,669. Older data: api.tweetfeed.live/v1/year (all tags, filter for #DPRK).

Related tags

Often seen with #DPRK.

See all tags on the Dashboard or browse the full IOC feed.

Frequently asked questions

What does the #DPRK tag cover?

Any IOC that researchers attribute to North Korean state-aligned activity, for any cluster. Sub-tags #Kimsuky and #Lazarus narrow it, and an IOC often has #DPRK plus one of them.

Which DPRK clusters are most active in this feed?

Kimsuky gives the most IOCs, many of them phishing domains and credential-harvesting URLs. Lazarus gives fewer but higher-impact IOCs, and BlueNoroff and Andariel appear less often.

How is this list updated?

The feed and the API update every 15 minutes from researcher posts on X. This page refreshes once a day.

What is the license? Can I use this commercially?

Yes. All IOC data, including this DPRK subset, is CC0 1.0 Universal. No attribution needed. No warranty. The website code and branding are not CC0.

License

DPRK IOC data: CC0 1.0 Public Domain. No attribution required, no warranty.