{"id":59410,"date":"2025-09-25T19:59:08","date_gmt":"2025-09-25T19:59:08","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/north-koreas-lazarus-group-shares-its-malware-with-it-work-scammers\/"},"modified":"2025-09-25T19:59:08","modified_gmt":"2025-09-25T19:59:08","slug":"north-koreas-lazarus-group-shares-its-malware-with-it-work-scammers","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/north-koreas-lazarus-group-shares-its-malware-with-it-work-scammers\/","title":{"rendered":"North Korea’s Lazarus Group shares its malware with IT work scammers"},"content":{"rendered":"

North Korean-linked crews connected to the pervasive IT worker scams have upped their malware game, using more advanced tools, including a backdoor that has much of the same code as Pyongyang’s infamous Lazarus Group deploys.<\/p>\n

In a white paper<\/a> [PDF] presented at Virus Bulletin 2025, ESET researchers Peter K\u00e1lnai and Mat\u011bj Havr\u00e1nek identified new links between DeceptiveDevelopment’s malware and the Lazarus Group<\/a>‘s PostNapTea RAT.<\/p>\n

DeceptiveDevelopment, a North Korea-aligned group that has been active since at least 2023, overlaps with the Contagious Interview and WageMole campaigns<\/a>, plus a gang that CrowdStrike tracks as Famous Chollima. Its members pose as recruiters, posting fake profiles on social media along the lines of Lazarus’ Operation Dream Job<\/a>, which tricked job seekers into clicking on malicious links. But in this case, the cybercriminals primarily reach out to software developers and typically those involved in cryptocurrency projects.<\/p>\n