Inside North Korea's Global Hack Network: A Researcher Maps 1,640 Breached Companies

A Greece-based security researcher spent about two years inside North Korea–linked hackers’ servers and found evidence of 1,640 compromised companies across 57 countries, with roughly 700–800 suffering highly damaging intrusions. The attackers often lure developers with fake job offers to gain credentials and broad access, including root access to servers and AWS, targeting crypto wallets and blockchain keys. Stykas publicly names about a dozen affected organizations at Black Hat, while noting many more firms never responded, creating a risk of ongoing, widespread breaches and potential espionage or crypto theft if attackers maintain persistent access.