Security Researcher Who Hacked North Korean Cyber Network Uncovers Hundreds of Global Victims

Cybersecurity researcher Vangelis Stykas has revealed that he spent nearly 22 months secretly monitoring infrastructure used by North Korean hackers, uncovering evidence of one of the most extensive cyber espionage operations ever documented. Presenting his findings at the Black Hat cybersecurity conference, Stykas said he gained persistent access to servers operated by a North Korean hacking group, allowing him to observe their activities in real time. His investigation uncovered attacks targeting 1,640 organizations across 57 countries, highlighting the extraordinary scale of the campaign.

According to Stykas, the compromised organizations ranged from cryptocurrency firms and technology companies to hospitals, financial institutions, universities, and government-related organizations. Among the victims were well-known companies including Coinbase, Uniswap Labs, and Boston Children’s Hospital. The researcher said the hackers systematically stole credentials, moved laterally across networks, and maintained long-term access to victims’ systems, enabling both cyber espionage and financially motivated attacks.

The investigation also provided rare insight into how North Korean cyber operators conduct their campaigns. Stykas said the hackers relied on a network of compromised servers, custom malware, and carefully coordinated infrastructure to manage attacks while attempting to conceal their identities. By remaining inside their systems for almost two years, he was able to document their methods, identify victims, and alert affected organizations before additional damage could occur. The findings offer security experts an unprecedented look into the day-to-day operations of one of the world’s most active state-linked cyber groups.

Security analysts say the discoveries reinforce growing concerns about the increasing sophistication of North Korean cyber operations. The country has long been accused of using cyberattacks to gather intelligence and generate revenue through cryptocurrency theft, ransomware, and attacks on financial institutions. Stykas’ research suggests these operations are broader and more persistent than previously understood, with attackers maintaining access to compromised networks for extended periods while expanding their list of targets.

The revelations underscore the growing importance of proactive cybersecurity and international cooperation in defending against state-sponsored hacking. By exposing the scale of the campaign and helping organizations identify compromised systems, Stykas’ work provides valuable intelligence for governments, businesses, and security professionals. Experts believe the findings will influence future cyber defense strategies and further strengthen efforts to detect, monitor, and disrupt sophisticated hacking operations linked to nation-state actors.