Greek Researcher Hacked North Korean Hackers: 1,640 Companies Across 57 Countries Breached

Not all breaches were equal. Stykas estimated that 700 to 800 of those victims suffered what he described as "really damaging" intrusions . In those severe cases, attackers gained:

• Root-level access to corporate servers
• Full control of Amazon Web Services (AWS) environments
• Exfiltration of master cryptographic keys, including cryptocurrency private wallet keys

Named victims: crypto, healthcare, and consumer electronics

Stykas publicly named roughly a dozen organizations that handled the disclosure process well or had already independently discovered the breach . Among them:

• Coinbase and Uniswap Labs (cryptocurrency / finance)
• Oppo (Chinese smartphone manufacturer)
• Boston Children's Hospital (healthcare)
• Italy's Supreme Council of the Judiciary
• AEON Smart Technology (Japan)

The campaign was broad-based, hitting technology firms, financial institutions, healthcare providers, and government bodies across dozens of countries .

The attack vector: fake job interviews

The primary initial-access method was a social engineering campaign Stykas identified as "Contagious Interview" . North Korean hackers posed as corporate recruiters on professional networks like LinkedIn. They targeted software developers with enticing job offers and, during sham interviews, tricked victims into downloading malware-laced coding tests, PDFs, or other files .

Once a single contractor or employee's device was compromised, the attackers pivoted into the corporate network. In some cases, North Korean IT workers also infiltrated companies directly through fraudulent remote employment .

How Stykas got in — and stayed

Stykas gained access not through a sophisticated intrusion but because the North Korean hackers accidentally infected their own workstations with their own malware . This operational security failure gave Stykas a foothold into their command-and-control servers. From there, he accessed their internal Slack and Discord channels, combed through stolen data, and extracted developer keys, source code, and internal communications .

He spent 22 months quietly monitoring their operations without being detected .

What Stykas presented at Black Hat 2026

At Black Hat, Stykas disclosed :

• The full scope of 1,640 victim organizations across 57 countries.
• That the hackers were increasingly using AI tools to scale their operations .
• A partial victim list including Coinbase, Oppo, and Boston Children's Hospital .
• Evidence that hundreds of victims suffered severe compromise — root-level server access, AWS control, and cryptographic key exfiltration .
• The details of the Contagious Interview campaign as the main initial-access vector .

Implications

Stykas's findings underscore a critical vulnerability in modern corporate security: the reliance on remote contractors and the hiring process itself as an attack surface. They also highlight how state-backed hacking groups can conceal a staggering number of breaches — far more than previously known — for years.

The fact that an individual researcher could infiltrate and monitor a nation-state's hacking apparatus for nearly two years also suggests significant operational security gaps within North Korean cyber units .