Security researchers at Gendigital\u00a0warn that Russian and North Korean state-backed hackers \u2014 two of the world\u2019s most aggressive cyber actors \u2014 may be working together for the first time, after discovering that both groups used the same command-and-control server in separate cyberattacks.<\/p>\n
A Rare Sign Of Coordination Between Two Major APT Groups<\/strong><\/p>\n On July 24, 2025, Gen\u2019s monitoring systems detected an IP address \u2014 144[.]172[.]112[.]106 \u2014 while tracking Gamaredon\u2019s known command-and-control servers. Gamaredon, a notorious Russian espionage group known for rapid-fire intrusions, is associated with the Russian Federal Security Service (FSB) and is responsible for more than 5,000 attacks over the last year, mostly targeting Ukraine.<\/p>\n But what happened next surprised the security researchers.<\/p>\n Just four days later, the same server began delivering malware tied to Lazarus, North Korea\u2019s most dangerous hacking group. Researchers identified the payload as InvisibleFerret<\/em>, a Lazarus-linked backdoor being delivered through an identical server structure previously seen in ContagiousInterview<\/em>, a campaign that targeted job seekers with fake recruitment messages.<\/p>\n While it\u2019s possible the server was a proxy or VPN endpoint, the temporal proximity of both groups\u2019 activity and the timing and identical delivery setup raise the likelihood of shared or sequential control by both groups \u2014 pointing to potential collaboration rather than coincidence.<\/p>\n Why This Discovery Matters<\/strong>\u00a0<\/strong><\/p>\n If confirmed, this would be the first known instance of Russian\u2013North\u00a0Korean cyber cooperation in active campaigns. Such partnerships are extremely rare; the most famous past example was Regin, believed to have been co-developed by the U.S. and U.K. intelligence agencies.<\/p>\n If Russia and North Korea are indeed collaborating in cyberspace, it would mark a major shift in how global cyberattacks are conducted, as each group brings powerful strengths:<\/p>\n Together, they could blend intelligence gathering, financial theft, and global disruption \u2014 making it harder to understand who is behind an attack or what the objective is.<\/p>\n A Broader Trend Of Hacking Alliances<\/strong><\/p>\n While cross-border APT collaboration is rare, the Gamaredon\u2013Lazarus overlap reflects a growing trend of cooperation within national cyber ecosystems.<\/p>\n These cases suggest the cyber world may be shifting toward more cooperation or shared resources \u2014 either intentionally or out of operational convenience.<\/p>\n What Security Teams Need To Prepare For<\/strong><\/p>\n Researchers say defenders must rethink how they identify and classify threats. Instead of assuming a single actor behind an attack, security teams should:<\/p>\n A New Phase Of Cyber Warfare?<\/strong><\/p>\n The discovery is alarming, as alliances between powerful nation-state hacking groups are exceptionally rare. As Russia and North Korea grow closer politically and militarily, researchers say this new pattern could be the first signal that the partnership now extends into cyberspace.<\/p>\n If so, experts warn, the era of isolated hacking groups may be coming to an end \u2014 paving the way for a new wave of cyber threats that could be far more coordinated than before.<\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" Security researchers at Gendigital\u00a0warn that Russian and North Korean state-backed hackers \u2014 two of the world\u2019s most aggressive cyber actors \u2014 may be working together for the first time, after discovering that both groups used the same command-and-control server in separate cyberattacks. A Rare Sign Of Coordination Between Two Major APT Groups On July 24, […]<\/p>\n","protected":false},"author":20,"featured_media":128090,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[48520,3141],"tags":[832,64682,64683,64680,12898,64678,63936,64679,6772,6846,64681,6770],"class_list":{"0":"post-128082","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-cyber-security","8":"category-news","9":"tag-apt","10":"tag-command-and-control","11":"tag-command-and-control-servers","12":"tag-contagiousinterview","13":"tag-cyberattacks","14":"tag-gamaredon","15":"tag-invisibleferret","16":"tag-lazarus","17":"tag-malware","18":"tag-north-korea","19":"tag-payload","20":"tag-russia"},"yoast_head":"\n\n
\n
\n