{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-23T05:24:08.307Z",
  "tag": {
    "id": "north-korea",
    "label": "North Korea",
    "isStack": false,
    "url": "https://pwn.watch/t/north-korea",
    "feed": "https://pwn.watch/t/north-korea/feed.xml"
  },
  "counts": {
    "incidents": 4,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 4
  },
  "incidents": [
    {
      "slug": "bybit-1-5b-hack-safe-wallet-february-2025",
      "title": "Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)",
      "url": "https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025",
      "json": "https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "no-fix-needed",
      "product": "Bybit cold wallet / Safe{Wallet} web UI",
      "tags": [
        "bybit",
        "safe-wallet",
        "crypto",
        "north-korea",
        "lazarus",
        "aws",
        "supply-chain"
      ],
      "cveIds": [],
      "affectedVersions": [
        "n/a"
      ],
      "fixedVersions": [],
      "startedAt": "2025-02-21",
      "closedAt": "2025-03-06",
      "updatedAt": "2025-03-06",
      "summary": "North Korean TraderTraitor/Lazarus hackers compromised a Safe{Wallet} developer's Mac, took over AWS session tokens and injected JavaScript into Safe's S3-hosted frontend. Bybit's signers approved what looked like a routine transfer but was a malicious transaction. It is the largest crypto theft on record; the FBI attributed it to North Korea.",
      "xPost": null
    },
    {
      "slug": "jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "title": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "json": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "JetBrains TeamCity On-Premises",
      "tags": [
        "devtools",
        "jetbrains",
        "teamcity",
        "ci-cd",
        "auth-bypass",
        "rce",
        "north-korea",
        "apt29",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-42793"
      ],
      "affectedVersions": [
        "Before 2023.05.4 (NVD)"
      ],
      "fixedVersions": [
        "2023.05.4"
      ],
      "startedAt": "2023-09-18",
      "closedAt": "2023-12-13",
      "updatedAt": "2023-12-13",
      "summary": "An authentication bypass in JetBrains TeamCity On-Premises gave unauthenticated attackers remote code execution on the CI server. Microsoft saw two North Korean groups exploit it, and US and allied agencies later said Russia's SVR (APT29) mass-exploited it. That's a direct path into build pipelines.",
      "xPost": null
    },
    {
      "slug": "jumpcloud-nation-state-breach-2023",
      "title": "JumpCloud breached by North Korean hackers to reach crypto customers",
      "url": "https://pwn.watch/i/jumpcloud-nation-state-breach-2023",
      "json": "https://pwn.watch/i/jumpcloud-nation-state-breach-2023.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "JumpCloud (directory / device management SaaS)",
      "tags": [
        "jumpcloud",
        "north-korea",
        "phishing",
        "supply-chain",
        "crypto"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-06-27",
      "closedAt": "2023-07-20",
      "updatedAt": "2023-07-20",
      "summary": "A spear-phishing attack let a nation-state actor into JumpCloud's infrastructure. The attacker abused its command framework to target a small set of customers. JumpCloud force-rotated all customer API keys, and researchers tied the attack to North Korea, aimed at crypto companies.",
      "xPost": null
    },
    {
      "slug": "3cx-desktopapp-supply-chain-attack-2023",
      "title": "3CX DesktopApp supply-chain attack (trojanized signed builds)",
      "url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023",
      "json": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "3CX DesktopApp (Electron)",
      "tags": [
        "3cx",
        "supply-chain",
        "electron",
        "north-korea",
        "windows",
        "macos"
      ],
      "cveIds": [
        "CVE-2023-29059"
      ],
      "affectedVersions": [
        "Windows Electron app 18.12.407 and 18.12.416 (Update 7) (NVD)",
        "macOS Electron app 18.11.1213, 18.12.402, 18.12.407 and 18.12.416 (NVD)"
      ],
      "fixedVersions": [
        "See vendor advisory"
      ],
      "startedAt": "2023-03-29",
      "closedAt": "2023-04-20",
      "updatedAt": "2023-04-20",
      "summary": "Signed 3CX DesktopApp builds for Windows and macOS shipped with embedded malicious code. Mandiant traced it to a North Korea-linked actor (UNC4736) who first got in through a trojanized X_TRADER install from Trading Technologies: a supply-chain attack caused by another supply-chain attack.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "bybit-1-5b-hack-safe-wallet-february-2025",
      "incidentTitle": "Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-03-06",
      "title": "Safe{Wallet} confirms a developer machine compromise by TraderTraitor",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2025/03/safewallet-confirms-north-korean.html",
      "url": "https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025"
    },
    {
      "incident": "bybit-1-5b-hack-safe-wallet-february-2025",
      "incidentTitle": "Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-02-26",
      "title": "FBI attributes the theft to North Korea ('TraderTraitor')",
      "body": null,
      "sourceUrl": "https://www.ic3.gov/psa/2025/psa250226",
      "url": "https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025"
    },
    {
      "incident": "bybit-1-5b-hack-safe-wallet-february-2025",
      "incidentTitle": "Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-02-21",
      "title": "About $1.5B in ETH drained from a Bybit cold wallet",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/bybit-1-5b-hack-safe-wallet-february-2025"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-12-13",
      "title": "CISA, FBI, NSA and partners: Russia's SVR exploiting TeamCity at scale (AA23-347A)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-18",
      "title": "Microsoft: North Korean actors Diamond Sleet and Onyx Sleet are exploiting it",
      "body": null,
      "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-04",
      "title": "CISA adds CVE-2023-42793 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-18",
      "title": "JetBrains releases TeamCity 2023.05.4 and a security patch plugin",
      "body": null,
      "sourceUrl": "https://blog.jetbrains.com/teamcity/2023/09/critical-security-issue-affecting-teamcity-on-premises-update-to-2023-05-4-now/",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793"
    },
    {
      "incident": "jumpcloud-nation-state-breach-2023",
      "incidentTitle": "JumpCloud breached by North Korean hackers to reach crypto customers",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-07-20",
      "title": "SentinelOne links the intrusion infrastructure to North Korean APT activity",
      "body": null,
      "sourceUrl": "https://www.sentinelone.com/labs/jumpcloud-intrusion-attacker-infrastructure-links-compromise-to-north-korean-apt-activity/",
      "url": "https://pwn.watch/i/jumpcloud-nation-state-breach-2023"
    },
    {
      "incident": "jumpcloud-nation-state-breach-2023",
      "incidentTitle": "JumpCloud breached by North Korean hackers to reach crypto customers",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-07-12",
      "title": "JumpCloud publishes incident details and indicators",
      "body": null,
      "sourceUrl": "https://jumpcloud.com/blog/security-update-incident-details",
      "url": "https://pwn.watch/i/jumpcloud-nation-state-breach-2023"
    },
    {
      "incident": "jumpcloud-nation-state-breach-2023",
      "incidentTitle": "JumpCloud breached by North Korean hackers to reach crypto customers",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-07-05",
      "title": "JumpCloud rotates all customer API keys",
      "body": null,
      "sourceUrl": "https://jumpcloud.com/blog/security-update-incident-details",
      "url": "https://pwn.watch/i/jumpcloud-nation-state-breach-2023"
    },
    {
      "incident": "jumpcloud-nation-state-breach-2023",
      "incidentTitle": "JumpCloud breached by North Korean hackers to reach crypto customers",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-06-27",
      "title": "JumpCloud finds anomalous activity on an internal orchestration system",
      "body": null,
      "sourceUrl": "https://jumpcloud.com/blog/security-update-incident-details",
      "url": "https://pwn.watch/i/jumpcloud-nation-state-breach-2023"
    },
    {
      "incident": "3cx-desktopapp-supply-chain-attack-2023",
      "incidentTitle": "3CX DesktopApp supply-chain attack (trojanized signed builds)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-04-20",
      "title": "Mandiant: the 3CX breach began with a trojanized X_TRADER package, the first software supply-chain attack it had seen caused by another",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/3cx-software-supply-chain-compromise",
      "url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023"
    },
    {
      "incident": "3cx-desktopapp-supply-chain-attack-2023",
      "incidentTitle": "3CX DesktopApp supply-chain attack (trojanized signed builds)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-03-30",
      "title": "3CX confirms the compromise and tells customers to uninstall the Electron desktop app",
      "body": null,
      "sourceUrl": "https://www.3cx.com/blog/news/desktopapp-security-alert/",
      "url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023"
    },
    {
      "incident": "3cx-desktopapp-supply-chain-attack-2023",
      "incidentTitle": "3CX DesktopApp supply-chain attack (trojanized signed builds)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-03-29",
      "title": "CrowdStrike reports malicious activity from the signed 3CXDesktopApp on customer machines",
      "body": null,
      "sourceUrl": "https://www.crowdstrike.com/en-us/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/",
      "url": "https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023"
    }
  ]
}