#ParsedReport #CompletenessHigh
09-09-2026

[Op Report\] Hands-on-Keyboard Activity from the DPRK PolinRider Supply Chain Attack

https://blog.deception.pro/blog/hok-dprk-polinrider-sep-2026

Report completeness: High

Actors/Campaigns:
Contagious_interview
Famous_chollima
Lazarus
Scarcruft
Polinrider

Threats:
Supply_chain_technique
Polinrider
Ottercandy
Winos
Xfiles_stealer
Omnistealer
I2prat
Bitsadmin_tool

Victims:
Travel and tourism

Geo:
Dprk, North korea

TTPs:
Tactics: 2
Technics: 1

ChatGPT TTPs:
do not use without manual check
T1036.005, T1053.005, T1059.001, T1059.003, T1059.006, T1059.007, T1071.001, T1105, T1113, T1115, have more...

IOCs:
IP: 3
File: 9
Domain: 5
Url: 2
Hash: 5

Soft:
Active Directory, Node.js, curl, Windows Installer, Windows PowerShell, macOS, Linux

Crypto:
ethereum

Algorithms:
sha256

Win API:
WinHttpOpen

Languages:
rust, javascript, python, powershell