# PolinRider

> As of 2026-09-20, PolinRider is a North Korea (DPRK)-nexus threat actor tracked by Threadlinqs Intelligence across 5 threats spanning supply chain. Also known as UNC5342, JADESNOW, Contagious Interview, TasksJacker. ATT&CK coverage spans 67 techniques across 11 tactics in 5 of 5 tracked threats. Most-observed techniques: T1027 (Obfuscated Files or Information), T1199 (Trusted Relationship), T1041 (Exfiltration Over C2 Channel).

- **Nation:** North Korea (DPRK)
- **Tracked threats:** 5
- **Categories:** SUPPLY_CHAIN
- **Also known as:** UNC5342, JADESNOW, Contagious Interview, TasksJacker, WaterPlum, Nickel Alley, Lazarus Group, DeceptiveDevelopment
- **As of:** 2026-09-20

## ATT&CK techniques observed

67 techniques observed across 5 of 5 tracked threats. Tactics: Command and Control (15), Stealth (formerly Defense Evasion) (12), Resource Development (10), Initial Access (7), Persistence (7), Execution (6).

- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 5 of 5 tracked threats
- [T1199](https://intel.threadlinqs.com/technique/T1199) Trusted Relationship — Initial Access — observed in 5 of 5 tracked threats
- [T1041](https://intel.threadlinqs.com/technique/T1041) Exfiltration Over C2 Channel — Exfiltration — observed in 4 of 5 tracked threats
- [T1140](https://intel.threadlinqs.com/technique/T1140) Deobfuscate/Decode Files or Information — Stealth (formerly Defense Evasion) — observed in 4 of 5 tracked threats
- [T1555](https://intel.threadlinqs.com/technique/T1555) Credentials from Password Stores — Credential Access — observed in 4 of 5 tracked threats
- [T1585](https://intel.threadlinqs.com/technique/T1585) Establish Accounts — Resource Development — observed in 4 of 5 tracked threats
- [T1005](https://intel.threadlinqs.com/technique/T1005) Data from Local System — Collection — observed in 3 of 5 tracked threats
- [T1059.007](https://intel.threadlinqs.com/technique/T1059.007) JavaScript — Execution — observed in 3 of 5 tracked threats
- [T1071.001](https://intel.threadlinqs.com/technique/T1071.001) Web Protocols — Command and Control — observed in 3 of 5 tracked threats
- [T1105](https://intel.threadlinqs.com/technique/T1105) Ingress Tool Transfer — Command and Control — observed in 3 of 5 tracked threats
- [T1195.002](https://intel.threadlinqs.com/technique/T1195.002) Compromise Software Supply Chain — Initial Access — observed in 3 of 5 tracked threats
- [T1552.001](https://intel.threadlinqs.com/technique/T1552.001) Unsecured Credentials — Credential Access — observed in 3 of 5 tracked threats
- [T1587.001](https://intel.threadlinqs.com/technique/T1587.001) Malware — Resource Development — observed in 3 of 5 tracked threats
- [T1608](https://intel.threadlinqs.com/technique/T1608) Stage Capabilities — Resource Development — observed in 3 of 5 tracked threats
- [T1036](https://intel.threadlinqs.com/technique/T1036) Masquerading — Stealth (formerly Defense Evasion) — observed in 2 of 5 tracked threats

## Tracked threats

- [GHAPPIER Loader: npm Supply-Chain Compromise of @dforge-core/dforge-mcp Linked to DPRK PolinRider Campaign](https://intel.threadlinqs.com/threat/TL-2026-2588) — HIGH
- [Joyfill npm Packages Compromised with Blockchain C2 Loader](https://intel.threadlinqs.com/threat/TL-2026-1771) — MEDIUM
- [ChainVeil and ViteVenom Malware Linked to DPRK PolinRider Supply-Chain Campaign](https://intel.threadlinqs.com/threat/TL-2026-1570) — HIGH
- [astro.config.mjs Supply Chain Attack via Blockchain Dead-Drop C2 (PolinRider / js.jadesnow)](https://intel.threadlinqs.com/threat/TL-2026-0846) — HIGH
- [PolinRider — DPRK Supply-Chain Campaign Compromises 1,951 GitHub Repos via Malicious npm Packages, VS Code tasks.json Auto-Run, and TRON/Aptos/BSC Blockchain Dead-Drop C2](https://intel.threadlinqs.com/threat/TL-2026-0437) — CRITICAL

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/PolinRider