BlueNoroffMalware
This family contains the BlueNoroff toolkit used for SWIFT manipulation, as used by the Lazarus activity cluster also referred to as BlueNoroff.From MISP Galaxy
Last reported 8 days ago, by Huntress9 reports
ATT&CK techniques
6 of 34 · each with the sentence it comes from- T1684Social Engineering
“ClickFix has become an exceedingly popular social engineering technique over the past two years.”
- T1053.005Scheduled Task
“…to go beyond download events and hunt for suspicious browser activity, RunMRU registry key, WScript/PowerShell child processes, and scheduled tasks.”
- T1055Process Injection
“This post analyzes the final stage: PHANTOMPULSE, an implant that ships three process-injection techniques, resolves its C2 through Ethereum/Base/Optimism transaction inputs, and bypasses UAC via the public schuac technique.”
- T1056.001Keylogging
“Input Capture: Keylogging”
- T1176.001Browser Extensions
“…t released in August 2025, CloudSEK demonstrated how artificial intelligence (AI) summarization systems embedded in email clients, browser extensions, and productivity platforms can be weaponized to deliver ransomware via ClickFix.”
- T1195Supply Chain Compromise
“Supply chain compromise leading to cyber incidents (24%)”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
9 reports, newest first · the exact sentence from each-
Inside the Hunt: Sarah Reddish“What Huntress found was a full DPRK BlueNoroff intrusion targeting a Web3 company that was weeks in the making and deeply sophisticated.”
-
Fake WatchGuard VPN Site Steals Credentials“What Huntress found was a full DPRK BlueNoroff intrusion targeting a Web3 company that was weeks in the making and deeply sophisticated.”
-
ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits“CrowdStrike, for its part, said it observed the North Korea-aligned Stardust Chollima (aka BlueNoroff) cluster likely targeting an employee at a financial services entity in July 2026 using a fake video conferencing site.”
-
July 2026 Threat Trend Report on APT Groups“APT38 (BlueNoroff) lured victims into fake Zoom and Microsoft Teams meetings using compromised Telegram accounts and executed Windows and macOS malware via ClickFix to steal cryptocurrency wallets and credentials.”
-
AWS Blames North Korean Group for Axios and Other npm Supply Chain Attacks“…y 29 that compromises of the axios, debug, chalk and typo-crypto libraries were carried out by the same group, known as Saphire Sleet, BlueNoroff and other monikers.”
-
PHANTOMPULSE: anatomy of a hijackable blockchain-C2 RAT“…radecraft, targeting, and infrastructure choices align with the DPRK-aligned crypto-targeting intrusion clusters that include Lazarus, BlueNoroff, UNC5342 (Contagious Interview), and APT38.”
-
Supply Chain Compromise of axios npm Package“Additionally, the internal project name macWebT links directly to BlueNoroff's documented webT module from RustBucket malware campaigns.”
-
The 2025 Cybercrime Report: 9 Emerging Trends + Statistics“Specifically, AI is helping attackers launch more advanced threats, like AI-generated deepfakes, such as the North Korean BlueNoroff attack.”
-
Inside the BlueNoroff Web3 macOS Intrusion Analysis“Inside the BlueNoroff Web3 macOS Intrusion Analysis”
Indicators in its reports
named in the reports above- sfrclak[.]comin 1 report
- packages.npm[.]orgin 1 report
- 142.11.206[.]73in 1 report
- callnrwise[.]comin 1 report
- 2553649f23220496…d0d6adc700cain 1 report
- d6f3f62fd3b9f543…fd5247d5ee71in 1 report
- 07d889e2dadce6f3…7d28ca61c766in 1 report
- 617b67a8e1210e4f…f583c900d101in 1 report
- f7d335205b8d7b20…f4e7d07121cdin 1 report
- 92ff08773995ebc8…071230c9645ain 1 report
- fcb81618bb15edfd…02bf980375cfin 1 report
- calltan[.]comin 1 report
- hxxp://sfrclak[.]com:8000/6202033in 1 report
Copy these 13 indicators · defanged
Thanks — we review every report.