`https://jsonkeeper.com/b/XRGF3`

https://jsonkeeper.com/b/XRGF3 is a payload URL that 2 published sources report in connection with IT Worker Fraud, Contagious Interview and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from GitLab Threat Intelligence and SafeDep. The earliest of those reports is dated 2026-02-19 and the most recent 2026-07-09.

payload url IT Worker Fraud Contagious InterviewDPRK (cluster unattributed) MATCHED IN SOURCE

First seen 2026-02-19 · last seen 2026-07-09

Sources

Nearby text:

…malware dropper URL Year in Review https://jsonkeeper.com/b/WCXNT url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/XRGF3 url malware N/A N/A JavaScript malware dropper URL Year in Review https://jsonkeeper.com/b/XV3WO url malware N/A N/A JavaScript malware…
GitLab Threat Intelligence Team reveals North Korean tradecraft — GitLab Threat Intelligence · under “Appendix 2: Indicators of Compromise” · published 2026-02-19 · pulled 2026-10-02
…analysis records that this backdoor is byte identical to an earlier package, nodemon-node , that used the same Pinata CID and the same jsonkeeper.com/b/XRGF3 endpoint.…
nodemon-sudo: an npm Backdoor With No Install Script - Real-time Open Source Software Supply Chain Security — SafeDep · under “The dead drops tie the campaign together” · published 2026-07-09 · pulled 2026-10-12

Find this indicator in the index, or see every payload URL this site holds under Payload URLs in the browse listing.

Related indicators

Cited by the same report: GitLab Threat Intelligence Team reveals North Korean tradecraft

GitLab Threat Intelligence lists 733 other indicators in this source. 7 are shown, chosen across types.

All 734 indicators from this source

Cited by the same report: nodemon-sudo: an npm Backdoor With No Install Script - Real-time Open Source Software Supply Chain Security

SafeDep lists 2 other indicators in this source.