Adversary Intelligence — 2026-04-30
North Korean RGB-Linked Void Dokkaebi Campaign Infects 750 Code Repositories via Fake Job Interviews
Trend Micro identified a campaign by
Analysis
The 750-repository figure likely understates the true footprint: the self-replication mechanism, which leverages compromised developer credentials to fork and poison upstream projects, outruns vendor detection cycles. Per a single Trend Micro report with a strong DPRK attribution track record, RGB infrastructure overlap anchors the cluster to Famous Chollima with high confidence. Void Dokkaebi embeds operationally inside Western supply chains rather than attacking from outside, the same convergence visible in the Xu Zewei MSS case, complicating traditional network defense. Additional infections are likely within the coming weeks as credentials propagate through automated pipelines without further operator intervention. The fake-interview technique may be a Famous Chollima-specific workflow that other RGB units, lacking the specialized infrastructure and English-language capacity, cannot replicate.
The 750-repository figure likely understates the true footprint: the self-replication mechanism, which leverages compromised developer credentials to fork and poison upstream projects, outruns vendor detection cycles. Per a single Trend Micro report with a strong DPRK attribution track record, RGB infrastructure overlap anchors the cluster to Famous Chollima with high confidence. Void Dokkaebi embeds operationally inside Western supply chains rather than attacking from outside, the same convergence visible in the Xu Zewei MSS case, complicating traditional network defense. Additional infections are likely within the coming weeks as credentials propagate through automated pipelines without further operator intervention. The fake-interview technique may be a Famous Chollima-specific workflow that other RGB units, lacking the specialized infrastructure and English-language capacity, cannot replicate.