Sapphire

Long

United

Cosmos

Hackers with ties to the North Korean government have reportedly expanded social engineering scams designed to steal cryptocurrencies by infiltrating “hundreds” of large, multinational information technology firms.
According to an <a data-ct-non-breakable="null" href="https://techcrunch.com/2024/11/28/north-korean-hackers-have-stolen-billions-in-crypto-by-posing-as-vcs-recruiters-and-it-workers/" rel="null" target="null" text="null" title="null">article</a> from TechCrunch, researchers at the Cyberwarcon cybersecurity conference identified two North Korean hacker groups called “Sapphire Sleet” and “Ruby Sleet.”
Sapphire Sleet targeted individuals through fraudulent employment schemes by posing as legitimate recruiters and luring unsuspecting victims into interviews or other offers of employment. The hackers would then infect the users’ computers with malware disguised as picture-document files (PDFs) or malicious links at some point during the interview process.
Ruby Sleet managed to infiltrate aerospace and defense contractors in the United States, the United Kingdom, and South Korea to steal military secrets. 
Additionally, the report mentioned that North Korean IT workers were using fake identities crafted through AI, social media, and voice-changing technologies to infiltrate the companies and carry out recruitment scams.
<figure>
 <img alt="North Korean hackers expand social engineering operation to IT firms: Report" src="https://s3.cointelegraph.com/uploads/2024-11/01937486-5eff-7126-9339-4da5df31e3a9" title="">
 <figcaption style="text-align: center;">
 Crypto theft in November 2024. Source: Immunefi, <a data-ct-non-breakable="null" href="https://x.com/BecauseBitcoin/status/1862143650840383812" rel="nofollow noopener" target="_blank" text="null" title="https://x.com/BecauseBitcoin/status/1862143650840383812">Because Bitcoin</a>
 </figcaption>
</figure>
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/upbit-hack-lazarus-south-korea-police" rel="null" target="null" text="null" title="null">South Korea confirms North Korea behind $50M Upbit hack</a>
<h2 id="north-korean-hackers-target-crypto-industry">North Korean hackers target crypto industry</h2>
Long before the researchers at Cyberwarcon issued a warning about North Korean hacking groups targeting information technology companies, hackers associated with the DPRK regime were targeting cryptocurrency firms using the same tactics.
In August, onchain sleuth ZackXBT claimed to have <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/zachxbt-claims-21-north-korea-crypto-devs-making-500k-month" rel="null" target="null" text="null" title="null">identified 21 developers</a>, believed to be North Koreans, working on various crypto projects using fake identities.
Later, in September, the Federal Bureau of Investigation (FBI) <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/fbi-warning-north-korea-scheme-steal-cryptocurrency" rel="null" target="null" text="null" title="null">issued a warning</a> about North Korean hackers targeting crypto companies and decentralized finance projects with malware disguised as employment offers. Once the user downloaded the malware or clicked a malicious link, their private keys would be stolen.
More recently, in October, the Cosmos ecosystem faced concerns over its Liquid Staking Module, which was allegedly <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/cosmos-lsm-built-north-korean-developers-security-concerns" rel="null" target="null" text="null" title="null">built by North Korean developers</a>.
At the time, Cosmos ecosystem developer Jacob Gadikian said, “The people who built the LSM are the world’s most skilled and prolific crypto thieves.” The threat of backdoors and other malicious lines of code prompted several security audits of the Cosmos Liquid Staking Module.
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/north-korean-hackers-private-keys-flash-loan-attacks/" rel="null" target="null" text="null" title="null">Lazarus Group’s favorite exploit revealed — Crypto hacks analysis</a>

North Korean hackers expand social engineering operation to IT firms: Report

Table of Contents

Cointelegraph

Other articles published on Nov 28, 2024

Bybit’s Super6 Celebration: Supercharge bbSOL with $1.2M in Rewards

GoldenCat Has Officially Renounced Contract! 🐾✨

Ethereum (ETH) Good News from CryptoQuant! "The Second Bull Market Has Started!"

Why Whales Are Cashing Out Dogwifhat, What Does This Mean For WIF Coin?

$15 – $20 Cycle Top Prediction for Dogecoin Emerges as Analyst Notice Continued Bullish Wave Patt...

XRP Ledger: RippleX Breaks Silence on Recent Bug Incident

Join our free newsletter for daily crypto updates!