North Korean hacking group RedEyes utilizes a new info-stealer called “FadeStealer”

With the ever-increasing threat of cyberattacks from various state-sponsored hacking groups, security researchers have identified a new info-stealer being used by the North Korean hacking group RedEyes. The group, also known as APT37, ScarCruft, and Reaper, has been active for nearly a decade and is affiliated with North Korea’s Ministry of State Security (MSS).

New Info-Stealer “FadeStealer”

AhnLab Security, a South Korean cybersecurity company, recently identified a new info-stealer being used by the North Korean hacking group RedEyes. Dubbed “FadeStealer,” this malware has exceptional features that allow threat actors to eavesdrop and capture audio through victims’ microphones. This new capability adds to the already extensive set of tools RedEyes employs for cyber espionage attacks.

Active since 2012, RedEyes is believed to be a state-sponsored APT group affiliated with North Korea’s Ministry of State Security (MSS). The group has been implicated in numerous cyber espionage attacks aligned with North Korea’s interests. Its focus areas include North Korean traitors and EU-based organizations.

Reported Incident

According to Cyber Security News, RedEyes recently carried out another cyber espionage attack. The group has been known for their long-standing involvement in cyber espionage attacks and this particular incident is believed to align with North Korea’s interests. The report did not disclose the targeted organization or the specifics of the attack.

The first breach in this particular cyber espionage attack was executed by the threat actor through the use of a CHM file. The file was probably part of a phishing email campaign that urged people to open it to obtain a document password, which ultimately infected their Windows computer with malware.

Backdoor Deployment

Later phases of the attack involved the deployment of an additional GoLang backdoor through another backdoor that was initially breached. This backdoor serves the purpose of allowing the threat actor access to the victim’s system and providing persistence for future attacks.

The North Korean hacking group utilized DLL sideloading, a technique that involves injecting malicious code into an already running legitimate process. In this case, the attackers used the legitimate Internet Explorer process called “ieinstal.exe,” and with the help of DLL sideloading, they injected the FadeStealer malware after installation.

Multiple threat actors utilize CHM files. While RedEyes (also known as APT37, ScarCruft, and Reaper) is one of the North Korean threat actors to use CHM files to distribute malware, it is not alone. Other North Korean threat actors also use this method. This technique is particularly effective, as CHM files are often considered trusted files and are not usually flagged by antivirus software.

As state-sponsored hacking groups continue to develop new and more potent malware, it is critical for organizations to stay vigilant and up-to-date on the latest threats. The deployment of unique malware like FadeStealer by RedEyes highlights the group’s growing capabilities and emphasizes the need for robust cybersecurity measures to keep sensitive data and systems secure.

Explore more

Rocket CRM Unveils Advanced Marketing Automation Upgrades

What if marketing teams could cut through the clutter of repetitive tasks and deliver campaigns that hit the mark every time? In a world where digital engagement moves at lightning speed, businesses are scrambling to keep up without losing the personal touch, and Rocket CRM has stepped into this challenge with a groundbreaking announcement on October 8, 2025, unveiling a

Turning ERP Failures into Success: Key Strategies Unveiled

Enterprise Resource Planning (ERP) systems are often hailed as the backbone of modern business operations, yet a staggering number of implementations end in failure, costing companies millions in lost revenue and productivity. Imagine a mid-sized manufacturing firm investing heavily in an ERP solution, only to face delayed timelines, frustrated employees, and a system that fails to deliver promised efficiencies. This

How Can Add-Ons Boost Microsoft Dynamics 365 Project Success?

In an era where project-based organizations face relentless pressure to deliver on time and within budget, the stakes have never been higher to overcome persistent challenges like revenue leakage and missed deadlines, which can severely impact outcomes. Picture a scenario where a critical project slips through the cracks due to poor visibility, eroding client trust and costing thousands in lost

Dynamics 365 AP Automation – Review

Imagine a finance team drowning in a sea of paper invoices, spending countless hours on manual data entry and chasing approvals across departments, only to face costly errors and missed deadlines. This scenario, all too common in many organizations, highlights the urgent need for streamlined accounts payable processes. Dynamics 365 AP Automation emerges as a transformative solution within Microsoft’s ERP

Digital Payments Innovation – Review

Imagine a world where a small exporter in a remote region completes a cross-border transaction in mere minutes, bypassing the delays and hefty fees that once plagued international trade, thanks to a transformative collaboration between DP World, a global leader in logistics and supply chain solutions, and PayPal, a dominant force in digital payments. This partnership, forged through a strategic