A Security Pro Hacked North Korean Hackers. He Found They’d Breached Hundreds of Networks Worldwide

For years, North Korea’s stealthy hackers and scam IT workers person infiltrated companies, stealing firm secrets and plundering billions successful cryptocurrency to assistance money the totalitarian authorities and its weapons programs. Now, a information researcher who has spent astir 2 years wrong the systems belonging to a radical of those North Korean hackers is raising the alarm connected conscionable however effectual and acold reaching the targeting of idiosyncratic employees and contractors has been successful breaching organizations crossed the globe.

Since Greece-based cybersecurity researcher Vangelis Stykas gained entree to North Korean systems 22 months ago, helium says, helium has recovered grounds that 1,640 companies crossed 57 countries person been impacted by the country’s hacking operations. Among these, Stykas volition item astatine the Black Hat information league successful Las Vegas today, astir 700 to 800 of the impacted organizations person had “really damaging” intrusions.

“It’s institution access, it’s basal entree to servers, it’s basal entree to AWS,” the researcher tells WIRED, referring to Amazon Web Services and the word “root” to mean the highest level of permissions successful a machine system. “For crypto companies, it’s keys, it’s blockchain access—it’s ridiculous access.”

Stykas, the CTO astatine cybersecurity steadfast Kumio, says helium accessed aggregate command-and-control servers utilized by the hackers, though helium asked WIRED not to uncover the details of however helium gained that entree owed to the sensitivity of that information. In immoderate cases, helium notes, the hackers appeared to person infected themselves with their ain malware—which, arsenic a result, gave him entree to the hackers’ workstations, too. “I person entree to their Slack, I person entree to their Discord, I person entree to a batch of stuff,” Stykas says, adding helium has seen astir 5 terabytes of information successful total.

As helium probed those systems implicit months, Stykas identified imaginable victims—by analyzing developer keys, root code, and more—and says helium has disclosed the incidents to those impacted. As portion of his speech astatine Black Hat, Stykas is publically naming astir a twelve of the impacted companies—these are, helium says, mostly the ones that handled the disclosures good and/or fixed imaginable compromises. The researcher says these see the Boston Children’s Hospital (which held a immense Covid-19 database of Americans’ idiosyncratic wellness data), the ample Japanese tech steadfast AEON Smart Technology, Chinese telephone shaper Oppo, cryptocurrency firms Coinbase and Uniswap Labs, Italy’s Supreme Judicial Council, a subsidiary of Saudi Arabian slope Al Rajhi Bank, and Digitaal Vlaanderen, portion of the Flemish Government successful Belgium.

Multiple companies and organizations named successful this nonfiction did not respond to WIRED’s petition for remark astir the incidents. Japan’s Computer Emergency Response Team says it confirmed the information researcher’s findings and worked with AEON Smart Technology connected “remediation.”

“We tin corroborate that we were notified of this incidental connected March 3, 2026 by the Centre for Cybersecurity Belgium (CCB), pursuing the researcher’s disclosure,” a spokesperson for the Flemish authorities says. “As portion of that response, the affected workstation was isolated and the perchance exposed credentials and entree were revoked and rotated. Based connected our investigation, the incidental has been contained and remediated.”

A spokesperson for Boston Children’s Hospital says that the incidental “involved a erstwhile autarkic contractor's idiosyncratic device” and not the hospital’s systems. “Upon notification, our cybersecurity and IT teams instantly investigated, disabled immoderate remaining progressive entree credentials wrong hours, and recovered nary grounds of unauthorized entree to Boston Children's systems,” the spokesperson says, adding that the “data astatine issue” was already publically available.

Meanwhile, a Coinbase spokesperson says they investigated a contractor, who they recovered was successful the United States, and “uncovered nary grounds that helium was either located successful North Korea nor affiliated with the DPRK government” earlier it was reported by the researcher, utilizing DPRK to notation to the Democratic People’s Republic of Korea. “However, our information controls identified imaginable risks successful their exertion setup, suggesting they whitethorn person outsourced their enactment to a 3rd party, and we terminated the contractor wrong 30 days of onboarding, anterior to receiving a extremity from Vangelis Stykas,” the spokesperson says. They adhd that “no delicate accusation was compromised and nary lawsuit information was exposed.”