A security researcher who spent nearly two years inside the infrastructure of North Korean state-linked hackers has surfaced evidence that the group breached hundreds of organizations' networks worldwide, according to reporting published by WIRED on August 5, 2026. The finding lands in the middle of a month of separate, independently sourced disclosures that sketch the same picture from other angles: Amazon's threat intelligence team attributing four npm supply chain compromises to a single DPRK crew, ENKI WhiteHat documenting Kimsuky's compromise of South Korean software vendors to reach their customers, South Korea's Foreign Ministry disclosing a ten-month intrusion into its diplomatic academy, and four South Korean agencies warning that Lazarus tooling is now in ransomware operators' hands. No single source in this brief is a primary victim statement about the counter-intrusion itself, and the WIRED account is the only one describing it. Treat the "hundreds of networks" figure as WIRED's reporting of one researcher's findings, not as a confirmed or independently corroborated count.
What Happened
WIRED reports that for nearly two years a researcher maintained access to systems used by North Korean state-linked hackers, and that the material recovered showed the group had breached hundreds of networks around the world. The available excerpt of that story does not name the researcher's specific DPRK unit, enumerate the victims, or give a country breakdown, so the scope claim currently rests on WIRED's characterization alone.
What is corroborated across multiple outlets is the operational tempo that makes such a number plausible. Amazon told reporters at a media roundtable at its Arlington, Virginia offices that one actor was responsible for four separate npm library compromises: typo-crypto in March 2025, debug and chalk in September 2025, and axios in March 2026. Axios alone is downloaded more than 100 million times a week. "We found one hand on the keyboard behind four different supply chain attacks," Amazon Integrated Security CISO CJ Moses said, per Computer Weekly. "When you connect these dots, this stops being a series of isolated incidents and starts looking more like an industrial operation."
In parallel, ENKI WhiteHat found that the Kimsuky group (also tracked as APT43) compromised South Korean collaborative-work software vendors during 2025 and early 2026, then pivoted into those suppliers' customers. And on July 20 and 21, South Korea's Foreign Ministry disclosed that attackers had held a server at the Korea National Diplomatic Academy for roughly ten months.
What Was Taken
The Korea National Diplomatic Academy breach is the one incident here with a stated data inventory, and the victim counts conflict. The Straits Times, summarizing the ministry's disclosure, put potential exposure at about 6,000 diplomats and officials. Help Net Security cites South Korean daily Dong-A Ilbo reporting roughly 10,000 current and former diplomats and officials seconded from other ministries. Ministry spokesperson Park Il described the leak as of "considerable scale" while stating the full extent had not been determined.
Per the ministry, the compromised records include usernames, names, email addresses, and encrypted passwords tied to the online training platform, which launched in 2022 for remote job training and language courses. The ministry explicitly stated that resident registration numbers, phone numbers, home addresses, and photos were not part of the leak. No misuse of the data had been confirmed as of the July 21 briefing.
The npm compromises stole a different class of asset. Researchers describe Sapphire Sleet's payloads as designed to harvest passwords, cryptocurrency, and personal data. The Record notes North Korea stole more than $2 billion in crypto amid sanctions pressure, which is the revenue half of the campaign the WIRED findings describe.
In the Kimsuky vendor intrusions, the stolen material was access itself: customer server information lifted from a vendor to enable downstream targeting, plus employee credentials harvested through tampered login pages.
Why It Matters
Three distinct tradecraft lines converge on the same conclusion. First, the supplier is now the target. Kimsuky compromised software vendors specifically to reach their customers, and researchers subsequently found the Gomir backdoor installed on a server belonging to a SaaS customer of a compromised vendor. Second, the dependency tree is now the target. Four npm compromises in twelve months, culminating in a package pulled 100 million times weekly, means an organization can be breached without any attacker ever touching its perimeter.
Third, and most consequential for incident responders: the boundary between DPRK state espionage and criminal ransomware is eroding. On July 30, four South Korean security and intelligence agencies issued a joint advisory, published alongside an AhnLab technical report on "Operation Double Barrel," warning that Lazarus Group tooling and infrastructure appear to have been shared with ransomware criminals targeting South Korean organizations, specifically the Gunra operation. Tool-based attribution gets less reliable when state tooling circulates downstream, and a Lazarus indicator no longer guarantees a Lazarus operator.
The Foreign Ministry disclosure also illustrates a defender-side problem that has nothing to do with the attacker. The ministry detected the intrusion in February 2026 and disclosed it in July. Park Il attributed the five-month gap to "the sensitivity of the matter regarding our diplomatic and security affairs, and the need for careful review and analysis." Another official said the delay was technical, not diplomatic. Downstream organizations whose staff appear in that data spent five months unaware they were phishing targets.
The Attack Technique
Across the corroborated incidents, initial access came from three routes.
Social engineering of package maintainers. In all four npm compromises, per Amazon, the group built trust with a legitimate maintainer before pushing a malicious update that flowed to anyone auto-installing the latest version. Sapphire Sleet is repeatedly characterized as preferring social engineering to software vulnerabilities.
Staged, evasion-aware payloads. CyberScoop details the typo-crypto case: a malicious file named "core.js," disguised to resemble the unrelated legitimate core-js package, that activated only on receiving a specific numeric input before pulling a second stage tailored to Windows, macOS, or Linux. Moses said the encoded-text-plus-cipher construction was intended to slow analysis, including by AI-based review tools, without heavy encryption. Amazon characterizes typo-crypto as a deliberate rehearsal, discovered by tracing domain records from the axios attack backward. In the axios case, Computer Weekly reports two new npm packages were injected with a malicious dependency that reached C2 infrastructure and deployed a second-stage RAT.
Exploitation plus credential theft. Kimsuky compromised one groupware vendor via a remote code execution flaw in an externally accessible mail server, and a second through social engineering of an employee leading to remote access tooling. Post-access, they deployed Gomir and new variants, moved laterally, and tampered with login pages to harvest credentials. Absent multifactor authentication was cited as a contributing factor. At the Diplomatic Academy, the ministry says attackers used a previously unknown zero-day vulnerability combined with security configuration weaknesses.
Attribution: Where the Accounts Diverge
Naming is genuinely inconsistent across these reports and defenders should not flatten it. The Record reports Google attributes the axios compromise to UNC1069, and Microsoft links it to Sapphire Sleet, which Microsoft says overlaps with UNC1069, BlueNoroff, Stardust Chollima, CageyChameleon, and Alluring Pisces. Computer Weekly describes the same actor as "APT38, Sapphire Sleet, or Stardust Chollima among other names," likely operating under the Lazarus Group umbrella and linked to the Reconnaissance General Bureau. CyberScoop lists UNC1069, Sapphire Sleet, and Stardust Chollima. The APT38 label appears in Computer Weekly's account but not the others, and no source in this set reconciles it against BlueNoroff.
The Kimsuky vendor campaign is a separate cluster: ENKI WhiteHat attributes it to Kimsuky/APT43, sanctioned by the US government in 2023 for spear-phishing.
The Diplomatic Academy attribution remains open. Park Il stated there was insufficient technical evidence to identify the attacker, while the government was "not ruling out any possibilities, including foreign-based hacking groups." Reporting frames a North Korea link as a line of inquiry, not a finding. Do not treat it as confirmed DPRK activity.
What Organizations Should Do
- Pin dependencies and stop auto-installing latest. Every npm compromise in Amazon's set reached victims through automatic updates. Lockfiles, a delay window before adopting new releases, and an internal registry mirror all break that path. Audit for exposure to axios (March 2026), debug and chalk (September 2025), and typo-crypto (March 2025).
- Treat maintainer accounts as production infrastructure. If your engineers maintain public packages, enforce phishing-resistant MFA and hardware-key signing on publish. The attack surface here is a human relationship, not a CVE.
- Extend monitoring to supplier-managed systems. Gomir turned up on a SaaS customer's server via the vendor. Contractually require breach notification from groupware and collaboration vendors, and monitor vendor-managed hosts inside your estate as if they were your own.
- Close the MFA gap on externally reachable services. Missing MFA was named as a direct contributor to the Kimsuky compromises, and credential harvesting via tampered login pages only pays off where a password alone is sufficient.
- Harden and patch externally accessible mail and training platforms. Both the groupware vendor and the Diplomatic Academy were reached through internet-facing systems, the latter through a zero-day plus configuration weakness. Long-lived low-attention systems, like a training portal stood up in 2022 for pandemic remote learning, deserve the same review cadence as core infrastructure.
- Hunt for Lazarus-linked tooling as a ransomware precursor. Given the July 30 joint South Korean advisory, review the AhnLab Operation Double Barrel report and reassess playbooks that assume state tooling implies espionage-only intent.
- Brief high-risk staff on targeted phishing now. The South Korean government's own guidance to affected personnel was to "exercise special caution when receiving emails from unknown sources." Where credential data including hashed passwords is exposed, force resets and check for password reuse across systems.
Sources: A Security Pro Hacked North Korean Hackers. He Found They’d Breache... | Months-long breach exposes South Korean diplomats' personal data -... | North Korean hackers behind major open-source supply ... | North Korean hackers target South Korean software vendors brief S... | South Korea probes diplomatic academy hack, eyes ... | A little-known npm package was North Korea’s warm-up act for the ax... | Amazon pins multiple open source compromises on North Korea Comput... | North Korea’s Lazarus Group sharing tools with ransomware hackers,...