PurpleAlpha

A North Korea state-linked cluster tracked by Recorded Future and related to the broader Kimsuky ecosystem. It conducts high-volume credential harvesting and malware operations against Korean Peninsula government, defense, education, finance, cryptocurrency, and media targets, using tools including XenoRAT and QuasarRAT.