@sekoia.com
Sekoia is the European cybersecurity company building the Cyber Operations Platform for the AI era.
@sekoia.comSekoia #TDR team traces how the operation reached cloud and SaaS environments, then turned trusted access into money. Written with @BeazleySecurity, the report also draws on first-hand incident response from a zero-day Oracle PeopleSoft compromise.
@sekoia.comWhat makes #ShinyHunters hard to stop? Well… the name can survive the people using it. Since 2020, changing operators have used the name to steal data and run extortion schemes.
@sekoia.comAs usual, IoCs are available in our Community GitHub repository: buff.ly/5CISNsZ
@sekoia.comExvicy is already widespread in the wild. We identified dozens of active administration panels and more than 100 C2 servers. Its monthly price also jumped from $1,200 to $2,000 in mid-August 2026.
@sekoia.comExvicy reuses ErrTraffic's obfuscated JavaScript, ClickFix HTML, FNV-1a hashing and C2 actions. The main advertised change is the use of Win+R instead of Win+X for the ClickFix command.
@sekoia.comExvicy's affiliates compromise WordPress sites to display a fake Cloudflare Turnstile CAPTCHA in a fullscreen iframe. Victims are told to press Win+R, Ctrl+V, and Enter, executing Base64-encoded PowerShell that drops malware.
@sekoia.comTDR analysts uncovered #Exvicy, an emerging #ClickFix MaaS sold on Exploit.IN since May 2026.
We assess with high confidence that Exvicy is a copycat of #ErrTraffic, reusing its injected JavaScript, ClickFix HTML, and C2 communication logic.
@sekoia.comIT workers operating under false identities are part of this model too, functioning as a revenue channel and an insider threat.
Read the full report, Beyond Lazarus: Organization of DPRK Cyber Capabilities
@sekoia.comOne finding runs throughout the research: espionage and revenue generation are closely linked. Access obtained for financial gain can be reused for intelligence collection. Shared infrastructure can support both missions.
@sekoia.comThe analysis also covers the wider support structure behind North Korea’s cyber operations. Academic institutions train operators and provide cover. Front companies act as proxies across several regions. Criminal networks support fund movements.
@sekoia.comBy cross-referencing multiple taxonomies, the report breaks down the former Lazarus umbrella into six distinct sub-clusters. This provides a clearer view of who is operating and how.
@sekoia.comIt also addresses a persistent challenge in threat intelligence: cluster deconfliction. Aliases multiply. Boundaries shift between vendors. Different names can hide the same activity.
@sekoia.comThe research maps the institutions responsible for North Korea’s cyber offensive operations, including recent reorganizations and the intrusion sets operating under them.
@sekoia.comNorth Korea’s cyber program was built to serve two purposes: intelligence collection and revenue generation.
A new joint report from Sekoia #TDR and @KudelskiSec examines how that system is organized.
