← All actor clusters

vendor/run-update-hidden-launch.vbs

vendor/run-update-hidden-launch.vbs is a file name that one published source reports in connection with unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Proofpoint. The report is dated 2026-06-05.

filename DPRK (cluster unattributed) CURATED

First seen 2026-06-05 · last seen 2026-06-05

Source

• Lure-repository artifact in Proofpoint's UNK_DeadDrop campaign of April to May 2026: the VBScript used to launch the Windows stage without a visible window. The actor is assessed as very likely North Korea-aligned.

  Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency — Proofpoint · published 2026-06-05 · pulled 2026-09-21

Find this indicator in the index, or see every file name this site holds under File names in the browse listing.

Related indicators

Cited by the same report: Don't Fear the Repo: UNK_DeadDrop Phishing Campaign Targets Developers to Steal Cryptocurrency

Proofpoint lists 81 other indicators in this source. 12 are shown, chosen across types.

• alexsnow@hr.onoplanoai.ink email address
• alexsnow@hr.predicttocareer.space email address
• 2812e0847d472cb8870c94f463331dbe53b84135132b9bf5f6d84c2382be628f file hash
• d5e9288693aa745dc89368deac677e7ea1ec81e663283af30838cdae189b7a7e file hash
• vendor/run-update.cmd file name
• https://github.com/sr-werney GitHub account
• https://github.com/stomp47 GitHub account
• https://gitlab.com/pulsynk-org GitLab account
• https://gitlab.com/trixauvex-org GitLab account
• 170.205.30.227 IP address
• 23.137.105.75 IP address
• Trixauvex-org/trixauvex malicious repository

All 82 indicators from this source