North Korean PurpleBravo Campaign Targets 3,136 IP Addresses via Job Scams

The PurpleBravo campaign, attributed to North Korean threat actors, has been identified as targeting 3,136 individual IP addresses. This activity, which spans from August 2024 to September 2025, has affected 20 organizations in sectors such as artificial intelligence, cryptocurrency, financial services, IT services, marketing, and software development. The identified victim organizations are located in Belgium, Bulgaria, Costa Rica, India, Italy, the Netherlands, Pakistan, Romania, the United Arab Emirates, and Vietnam.

Recorded Future’s Insikt Group reported that the campaign likely involves job-seeking candidates executing malicious code on corporate devices, thereby increasing organizational exposure. The campaign is part of a broader strategy that includes the use of malicious Microsoft Visual Studio Code projects to distribute backdoors, indicating a sophisticated approach to cyber espionage and financial theft.

Notably, four LinkedIn personas associated with PurpleBravo posed as developers and recruiters from Odesa, Ukraine, while several malicious GitHub repositories were identified as vehicles for delivering malware like BeaverTail. The campaign has also been linked to two sets of command-and-control servers for different malware types, including a JavaScript infostealer and a Go-based backdoor.

The dual nature of the PurpleBravo campaign, which complements another known as Wagemole, highlights the ongoing threat of North Korean actors seeking unauthorized employment for espionage and financial gain. Despite being treated as separate activities, there are significant overlaps in tactics and infrastructure.

Organizations should be aware that candidates approached by PurpleBravo may take coding assessments on company devices, which can lead to serious compromises. This underscores the vulnerability of the IT software supply chain to infiltration by adversaries beyond just IT workers.

Given that many targeted organizations serve large customer bases, the potential for supply-chain risks is acute. The PurpleBravo campaign emphasizes the need for organizations to prepare, defend, and prevent sensitive data leakage to North Korean threat actors.

• 3,136 individual IP addresses were targeted in the PurpleBravo campaign.
• The campaign affected 20 organizations across various sectors, including AI and financial services.
• Malicious Microsoft Visual Studio Code projects have been used to distribute backdoors.
• LinkedIn personas associated with PurpleBravo posed as developers and recruiters.
• The campaign has significant overlaps with another North Korean operation known as Wagemole.