North Korean Hackers Create Fake US Firms to Target Crypto Developers
The post North Korean Hackers Create Fake US Firms to Target Crypto Developers appeared on BitcoinEthereumNews.com.
North Korean hackers created two US-registered companies (Blocknovas LLC and Softglide LLC) to target cryptocurrency developers with malware through fake job opportunities. The operation has been linked to the Lazarus Group, an elite North Korean hacking team operated by the country’s main foreign intelligence agency. U.S. cybersecurity firm, Silent Push, reported that North Korean hackers used legitimate US business entities to deploy malware against cryptocurrency developers. These hackers developed an advanced scheme that used false job advertisements to trick developers into falling victim to their cyber attacks. Three front organizations participated in the operation. Blocknovas LLC with New Mexico registration and Softglide LLC based in New York along with Angeloper Agency which lacks US registration. The entities used fake personas and addresses to create their presence while evading international sanctions. “This represents a rare case where North Korean operatives successfully established legal corporate entities on US soil to create convincing fronts for targeting job applicants,” explained Kasey Best, director of threat intelligence at Silent Push. The FBI has since taken action, seizing at least one domain associated with Blocknovas as part of enforcement measures against North Korean cyber actors. Links to Lazarus Group A North Korean hacking team known as Lazarus Group operates under the Reconnaissance General Bureau, handles these types of scams. But this operation was carried out by a specific subgroup within this elite hacking team. The group’s evolution represents an increase in their operational methods since they traditionally conducted direct network intrusions. The hackers used at least three known malware strains to execute their campaign against crypto specialists by conducting fake job interview attacks. Attack victims experienced compromised digital wallet access, which enabled the hackers to steal wallet credentials for additional business attacks. Sanctions Violations The establishment of North Korean-controlled companies in the United States constitutes a…
