Greek Researcher Hacked North Korean Hackers: 1,640 Companies Across 57 Countries Breached
Greece based cybersecurity researcher Vangelis Stykas spent 22 months inside North Korean hackers' command and control servers and found evidence that 1,640 companies across 57 countries had been compromised.
Published byEdited with DeepSeek-V4-FlashImages generated with GPT Image 1.5
Greece based cybersecurity researcher Vangelis Stykas spent 22 months inside North Korean hackers' command and control servers and found evidence that 1,640 companies across 57 countries had been compromised.
What scale of global breaches did Greece-based cybersecurity researcher Vangelis Stykas uncover by infiltrating North Korean hackers' commanVangelis Stykas's investigation revealed 1,640 compromised organizations in 57 countries, linked by a single North Korean hacking operation.
AI Prompt
Create a landscape editorial hero image for this Studio Global article: What scale of global breaches did Greece-based cybersecurity researcher Vangelis Stykas uncover by infiltrating North Korean hackers' comman. Article summary: Here are the key findings from Vangelis Stykas's investigation, as presented at Black Hat 2026.. Topic tags: general, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers, clickbait thumbnails, icons, and tiny thumbnail layouts. Make it useful as an illustrative visual, not as factual
openai.com
For nearly two years, a single Greek researcher lived inside the infrastructure of one of the world's most prolific state-backed hacking operations. He didn't break in with a sophisticated zero-day exploit — the North Korean hackers infected themselves with their own malware, giving Vangelis Stykas a front-row seat to a global breach campaign of staggering scale.
At the Black Hat security conference in Las Vegas in August 2026, Stykas — CTO of cybersecurity firm Kumio — presented the most detailed public accounting of North Korea's global hacking campaign ever produced. Here is what he found.
The scale: 1,640 companies in 57 countries
Over 22 months, Stykas analyzed approximately 5 terabytes of data extracted from North Korean command-and-control servers . The evidence pointed to .
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
What is the short answer to "Greek Researcher Hacked North Korean Hackers: 1,640 Companies Across 57 Countries Breached"?
Greece based cybersecurity researcher Vangelis Stykas spent 22 months inside North Korean hackers' command and control servers and found evidence that 1,640 companies across 57 countries had been compromised.
Greek Researcher Hacked North Korean Hackers: 1,640 Companies Across 57 Countries Breached
Greece based cybersecurity researcher Vangelis Stykas spent 22 months inside North Korean hackers' command and control servers and found evidence that 1,640 companies across 57 countries had been compromised.
Published byEdited with DeepSeek-V4-FlashImages generated with GPT Image 1.5
Greece based cybersecurity researcher Vangelis Stykas spent 22 months inside North Korean hackers' command and control servers and found evidence that 1,640 companies across 57 countries had been compromised.
What scale of global breaches did Greece-based cybersecurity researcher Vangelis Stykas uncover by infiltrating North Korean hackers' commanVangelis Stykas's investigation revealed 1,640 compromised organizations in 57 countries, linked by a single North Korean hacking operation.
AI Prompt
Create a landscape editorial hero image for this Studio Global article: What scale of global breaches did Greece-based cybersecurity researcher Vangelis Stykas uncover by infiltrating North Korean hackers' comman. Article summary: Here are the key findings from Vangelis Stykas's investigation, as presented at Black Hat 2026.. Topic tags: general, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers, clickbait thumbnails, icons, and tiny thumbnail layouts. Make it useful as an illustrative visual, not as factual
openai.com
For nearly two years, a single Greek researcher lived inside the infrastructure of one of the world's most prolific state-backed hacking operations. He didn't break in with a sophisticated zero-day exploit — the North Korean hackers infected themselves with their own malware, giving Vangelis Stykas a front-row seat to a global breach campaign of staggering scale.
At the Black Hat security conference in Las Vegas in August 2026, Stykas — CTO of cybersecurity firm Kumio — presented the most detailed public accounting of North Korea's global hacking campaign ever produced. Here is what he found.
The scale: 1,640 companies in 57 countries
Over 22 months, Stykas analyzed approximately 5 terabytes of data extracted from North Korean command-and-control servers . The evidence pointed to .
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
What is the short answer to "Greek Researcher Hacked North Korean Hackers: 1,640 Companies Across 57 Countries Breached"?
Greece based cybersecurity researcher Vangelis Stykas spent 22 months inside North Korean hackers' command and control servers and found evidence that 1,640 companies across 57 countries had been compromised.
1,640 compromised organizations across 57 countries
Not all breaches were equal. Stykas estimated that 700 to 800 of those victims suffered what he described as "really damaging" intrusions . In those severe cases, attackers gained:
Root-level access to corporate servers
Full control of Amazon Web Services (AWS) environments
Exfiltration of master cryptographic keys, including cryptocurrency private wallet keys
Named victims: crypto, healthcare, and consumer electronics
Stykas publicly named roughly a dozen organizations that handled the disclosure process well or had already independently discovered the breach . Among them:
Coinbase and Uniswap Labs (cryptocurrency / finance)
Oppo (Chinese smartphone manufacturer)
Boston Children's Hospital (healthcare)
Italy's Supreme Council of the Judiciary
AEON Smart Technology (Japan)
The campaign was broad-based, hitting technology firms, financial institutions, healthcare providers, and government bodies across dozens of countries .
The attack vector: fake job interviews
The primary initial-access method was a social engineering campaign Stykas identified as "Contagious Interview". North Korean hackers posed as corporate recruiters on professional networks like LinkedIn. They targeted software developers with enticing job offers and, during sham interviews, tricked victims into downloading malware-laced coding tests, PDFs, or other files .
Once a single contractor or employee's device was compromised, the attackers pivoted into the corporate network. In some cases, North Korean IT workers also infiltrated companies directly through fraudulent remote employment .
How Stykas got in — and stayed
Stykas gained access not through a sophisticated intrusion but because the North Korean hackers accidentally infected their own workstations with their own malware. This operational security failure gave Stykas a foothold into their command-and-control servers. From there, he accessed their internal Slack and Discord channels, combed through stolen data, and extracted developer keys, source code, and internal communications .
He spent 22 months quietly monitoring their operations without being detected .
What Stykas presented at Black Hat 2026
At Black Hat, Stykas disclosed :
The full scope of 1,640 victim organizations across 57 countries.
That the hackers were increasingly using AI tools to scale their operations .
A partial victim list including Coinbase, Oppo, and Boston Children's Hospital .
Evidence that hundreds of victims suffered severe compromise — root-level server access, AWS control, and cryptographic key exfiltration .
The details of the Contagious Interview campaign as the main initial-access vector .
Implications
Stykas's findings underscore a critical vulnerability in modern corporate security: the reliance on remote contractors and the hiring process itself as an attack surface. They also highlight how state-backed hacking groups can conceal a staggering number of breaches — far more than previously known — for years.
The fact that an individual researcher could infiltrate and monitor a nation-state's hacking apparatus for nearly two years also suggests significant operational security gaps within North Korean cyber units .
1,640 compromised organizations across 57 countries
Not all breaches were equal. Stykas estimated that 700 to 800 of those victims suffered what he described as "really damaging" intrusions . In those severe cases, attackers gained:
Root-level access to corporate servers
Full control of Amazon Web Services (AWS) environments
Exfiltration of master cryptographic keys, including cryptocurrency private wallet keys
Named victims: crypto, healthcare, and consumer electronics
Stykas publicly named roughly a dozen organizations that handled the disclosure process well or had already independently discovered the breach . Among them:
Coinbase and Uniswap Labs (cryptocurrency / finance)
Oppo (Chinese smartphone manufacturer)
Boston Children's Hospital (healthcare)
Italy's Supreme Council of the Judiciary
AEON Smart Technology (Japan)
The campaign was broad-based, hitting technology firms, financial institutions, healthcare providers, and government bodies across dozens of countries .
The attack vector: fake job interviews
The primary initial-access method was a social engineering campaign Stykas identified as "Contagious Interview". North Korean hackers posed as corporate recruiters on professional networks like LinkedIn. They targeted software developers with enticing job offers and, during sham interviews, tricked victims into downloading malware-laced coding tests, PDFs, or other files .
Once a single contractor or employee's device was compromised, the attackers pivoted into the corporate network. In some cases, North Korean IT workers also infiltrated companies directly through fraudulent remote employment .
How Stykas got in — and stayed
Stykas gained access not through a sophisticated intrusion but because the North Korean hackers accidentally infected their own workstations with their own malware. This operational security failure gave Stykas a foothold into their command-and-control servers. From there, he accessed their internal Slack and Discord channels, combed through stolen data, and extracted developer keys, source code, and internal communications .
He spent 22 months quietly monitoring their operations without being detected .
What Stykas presented at Black Hat 2026
At Black Hat, Stykas disclosed :
The full scope of 1,640 victim organizations across 57 countries.
That the hackers were increasingly using AI tools to scale their operations .
A partial victim list including Coinbase, Oppo, and Boston Children's Hospital .
Evidence that hundreds of victims suffered severe compromise — root-level server access, AWS control, and cryptographic key exfiltration .
The details of the Contagious Interview campaign as the main initial-access vector .
Implications
Stykas's findings underscore a critical vulnerability in modern corporate security: the reliance on remote contractors and the hiring process itself as an attack surface. They also highlight how state-backed hacking groups can conceal a staggering number of breaches — far more than previously known — for years.
The fact that an individual researcher could infiltrate and monitor a nation-state's hacking apparatus for nearly two years also suggests significant operational security gaps within North Korean cyber units .
gate.comVangelis Stykas: North Korean hackers infiltrated 1,640 companies in 57 countries, using AI tools on a massive scale | Gate News
linkedin.comPrabh Nair's Post - LinkedIn
tradingkey.comAI-assisted North Korean hackers have become a bigger problem than people think
privacyguides.orgNorth Korean Hackers Breached Over 1,600 Organizations Worldwide