A new North Korean APT, Nirig99 has been responsible for turning industrial and IoT networks into its playground. From smart payment devices to factory controllers, the group exploits poorly secured systems for both financial gain and espionage. This threat actor takes its name from the mythological creature Girin, which is Nirig backwards. It is suspected that the team consists of 99 members.

Nirig99’s attacks are stealthy, using custom malware and supply chain tricks to move undetected across networks that rarely get proper security monitoring. The goal: steal money, harvest industrial intelligence and stay under the radar. Recently, they were seen using CVE-2025-29824, the Windows Common Log File System Driver for local privilege escalation. They have also been known to work directly with disgruntled insiders, who gladly help them get a foothold for payment.

As IoT and OT devices become more interconnected, Nirig99 shows that nation-state hackers aren’t just targeting computers—they’re targeting the machines that run our world. Their persistent techniques continue to cause issues with security teams, even when they thought they were safe within a Tabletop Exercise.