North Korean Hackers Launch Sophisticated Malware Campaign Targeting Crypto Developers

North Korean Hackers Establish Fake Crypto Firms for Malware Distribution

A group of North Korean hackers, linked to the notorious Lazarus Group, has launched a sophisticated malware campaign targeting cryptocurrency developers. The operation, known as "Contagious Interview," involves setting up front companies in the cryptocurrency consulting industry to spread malware through fake job interview processes 1

1

2

2

.

Shell Companies and Malware Distribution

Three shell companies have been identified as part of this operation:

1. BlockNovas LLC (blocknovas[.]com)
2. Angeloper Agency (angeloper[.]com)
3. SoftGlide LLC (softglide[.]com)

These companies are being used to distribute three known malware families: BeaverTail, InvisibleFerret, and OtterCookie 1

1

. The malware is designed to steal sensitive information, including crypto wallet keys and clipboard data 2

2

.

Sophisticated Social Engineering Tactics

The hackers have employed various tactics to make their operation appear legitimate:

1. Creating fake employee profiles using AI-generated images 2

   2

   3

   3

2. Setting up fraudulent accounts on social media platforms and professional networks 1

   1

3. Using services like Astrill VPN and residential proxies to obfuscate their infrastructure 1

   1

The attackers lure victims by posting job listings on various platforms, including GitHub, job boards, and freelancer websites 2

2

.

Malware Deployment Process

During the fake job application process, applicants are presented with an error message when trying to record an introduction video. The "solution" involves a simple click-fix that, when executed, leads to the deployment of malware 2

2

3

3

.

Known Victims and Potential Impact

At least one developer has reportedly had their MetaMask wallet compromised as a result of this campaign 1

1

2

2

. The stolen credentials can potentially be used to launch further attacks on legitimate businesses in the cryptocurrency sector 3

3

.

Law Enforcement Response

The FBI has taken action against this threat by seizing the domain of BlockNovas, one of the fake companies involved in the operation 1

1

2

2

. An FBI official described North Korean cyber operations as "one of the most advanced persistent threats" facing the United States 3

3

.

Broader Context of North Korean Cyber Threats

This campaign is part of a larger pattern of North Korean cyber activities targeting the cryptocurrency sector. Other known tactics include:

1. The "Wagemole" threat, where fake personas are created to get remote IT jobs at major companies 1

   1

2. Attempts to steal sensitive data through fake Zoom calls 2

   2

3. Major hacks attributed to groups like Lazarus, including the $1.4 billion Bybit hack and the $600 million Ronin network hack 2

   2

Cybersecurity Recommendations

Experts advise cryptocurrency developers and companies to exercise caution when engaging in online job applications or video interviews. Verifying the legitimacy of potential employers and being wary of unexpected software installations during the application process are crucial steps in protecting against these sophisticated attacks 1

1

2

2

3

3

.