Researcher Says North Korean Hackers Gained Access to Hundreds of Networks Worldwide

A cybersecurity researcher who spent almost two years monitoring infrastructure linked to North Korean hackers says the group gained access to companies, government bodies and technology platforms across dozens of countries.

Greece-based researcher Vangelis Stykas claims he identified evidence connecting the hackers to 1,640 organisations in 57 countries. Between 700 and 800 of those cases involved potentially serious intrusions, including administrative control over servers, cloud environments, developer accounts and cryptocurrency systems.

The findings, presented at the Black Hat security conference in Las Vegas, offer a rare view inside North Korea’s sprawling cyber operations. They also show how attackers can turn the compromise of a single developer or contractor into access across multiple organisations.

Stykas, the chief technology officer at cybersecurity company Kumio, reportedly gained access to several command-and-control servers operated by the hackers around 22 months ago. He has not publicly explained the method used to enter those systems, citing concerns that disclosure could interfere with investigations or reveal sensitive defensive techniques.

In several cases, the North Korean operators appeared to have accidentally infected their own computers with malware. That mistake allegedly allowed Stykas to observe workstations and communication platforms used by the group, including internal discussions conducted through Slack and Discord.

He estimates that the systems contained approximately five terabytes of material.

By examining source code, developer credentials, access keys and other technical evidence, Stykas attempted to identify companies whose employees or contractors had been targeted. He then contacted affected organisations and relevant cybersecurity authorities.

The organisations publicly connected to his findings include Boston Children’s Hospital, Japanese technology company AEON Smart Technology, Chinese smartphone manufacturer Oppo, cryptocurrency exchange Coinbase, decentralised finance company Uniswap Labs, Italy’s Supreme Judicial Council, a subsidiary of Saudi Arabia’s Al Rajhi Bank and Digitaal Vlaanderen, a digital agency within the Flemish Government in Belgium.

The inclusion of an organisation does not necessarily mean its central networks or sensitive information were successfully compromised. Responses from several of the named organisations indicate that some incidents were confined to contractors, individual workstations or credentials that were disabled before further access occurred.

Japan’s Computer Emergency Response Team confirmed it had reviewed the researcher’s findings and worked with AEON Smart Technology on remediation.

The Flemish Government said it was alerted by the Centre for Cybersecurity Belgium on 3 March 2026. Its response included isolating an affected workstation, cancelling potentially exposed credentials and rotating access information. The government’s investigation concluded that the incident had been contained.

Boston Children’s Hospital said the matter involved a personal device belonging to a former independent contractor rather than the hospital’s internal systems. The organisation disabled any remaining credentials associated with the contractor and reported finding no evidence that its networks had been accessed without authorisation. It also maintained that the information involved was already publicly available.

Coinbase said it had previously investigated and terminated a contractor after its internal security controls identified risks associated with the person’s technology setup. The company found no evidence that the contractor was located in North Korea or directly connected to the North Korean government.

However, Coinbase believed the contractor may have passed work to an outside party. The relationship was ended within 30 days of the contractor joining the company and before Stykas provided his warning. Coinbase said it found no evidence that customer data or sensitive company information had been exposed.

The operation appears to have relied heavily on a familiar social engineering technique known as the fake interview attack.

Under this approach, attackers contact software developers with apparently attractive employment opportunities, often offering unusually high salaries or remote working arrangements. Candidates are then asked to download a coding test, software package or development tool as part of the recruitment process.

The downloaded file silently installs malware, giving the attackers access to the developer’s computer. From there, the hackers can search for cloud credentials, source code, cryptocurrency keys, authentication tokens and other information that may provide entry into corporate systems.

The broader campaign, often identified by cybersecurity researchers as Contagious Interview, has been active since at least 2022. Its success depends less on discovering advanced software vulnerabilities than on persuading technically skilled employees to execute malicious files themselves.

External contractors have created a particularly significant risk. Contractors may work with several clients simultaneously and can hold privileged access to repositories, cloud services and production environments belonging to multiple organisations.

Stykas found examples of individual contractors who appeared to have access to as many as 30 companies. Compromising one such device could therefore give attackers multiple pathways into otherwise unrelated businesses.

The researcher’s findings suggest that North Korean operators concentrated primarily on cryptocurrency, even when their access could potentially have exposed healthcare information, criminal records or other highly sensitive data.

This focus is consistent with international warnings that cryptocurrency theft has become a major source of revenue for North Korea. Digital assets can be stolen remotely, moved quickly across borders and laundered through complicated networks of wallets, exchanges and decentralised financial services.

The proceeds are widely believed to support a regime facing extensive international sanctions, including restrictions intended to limit funding for its nuclear weapons and ballistic missile programs.

North Korea’s cyber operations extend beyond direct hacking. Thousands of workers are also believed to seek remote technology jobs using fabricated identities, stolen personal information and intermediaries in other countries.

Once hired, these workers may send part of their salaries to the North Korean government, obtain access to corporate systems or pass information to separate hacking teams. Some operations combine fraudulent employment with malware, identity theft and cryptocurrency theft.

Security researchers have warned that the structure of North Korea’s cyber workforce is adaptable. Individual teams may shift between revenue generation, espionage, sanctions evasion and intelligence collection depending on the regime’s immediate priorities.

That flexibility means an intrusion initially focused on cryptocurrency could later be used for a different purpose. Persistent access obtained by one team could potentially be transferred to operators interested in government information, commercial intellectual property or sensitive personal records.

The scale of the reported campaign also raises questions about how organisations respond when independent researchers warn them of a compromise.

Stykas says hundreds of companies did not respond to his notifications. New organisations also continue to appear in the data, suggesting the operation remains active.

For businesses, the findings demonstrate that cybersecurity cannot be limited to permanent employees or company-owned devices. Contractors, recruitment candidates and third-party developers may all possess credentials capable of exposing critical systems.

Organisations can reduce the risk by restricting contractor permissions, separating development and production environments, monitoring unusual credential use and requiring coding assessments to run inside isolated systems. Recruitment teams should also warn applicants about unsolicited job offers, unfamiliar software packages and requests to download files from unofficial sources.

The North Korean campaign shows how a routine employment approach can become the opening move in a global intrusion operation. A single malicious coding test can provide access not only to one developer’s computer, but also to every organisation, cloud platform and cryptocurrency wallet that developer is authorised to use.