North Korean Hackers Target Crypto Firms with New Phishing Tactics

BlueNoroff has long been linked to cybercrimes aimed at funding North Korea’s nuclear and weapons programs. Their latest campaign, named Hidden Risk, highlights a new approach. Instead of using social media to build trust, the hackers now rely on phishing emails.

The emails used in the Hidden Risk campaign were tailored to look like crypto news updates, such as Bitcoin price alerts or news related to DeFi. Victims would be tricked into clicking on links within the email messages, which download malware without realizing it. Once clicked, the malware installs applications that give the hackers access to sensitive company data.

The malware is sophisticated, even bypassing the security features of Apple. It uses valid Apple Developer IDs that bypass macOS’s Gatekeeper system, something that deeply concerns cybersecurity experts.

Traditionally, North Korean hackers used social media to groom targets on platforms like LinkedIn and Twitter. They built fake professional relationships with employees at crypto firms. While effective, this method took time. The switch to phishing emails is a faster, more direct tactic.

As the cryptocurrency market grows, now valued at over $2.6 trillion, it has become a prime target for hackers. The rapid expansion of the crypto space makes it especially vulnerable to these types of attacks.

A Growing Threat to the Crypto Industry

North Korean hackers have been focusing on DeFi platforms and exchange-traded fund (ETF) firms. Using social engineering, they target employees directly with phishing attacks. The FBI has warned crypto firms to strengthen security and crosscheck wallet addresses against known hacker-linked ones.

In response, the US government has taken action. The Treasury Department imposed sanctions on the crypto mixing service Tornado Cash for helping North Korean hackers hide illicit transactions. Similar to RailGun, Tornado Cash allows anonymous transactions, which aid money laundering.

To protect against these attacks, SentinelLabs advises companies, especially in the crypto sector, to strengthen their security. They recommend scanning for malware, cross-checking developer IDs, and avoiding suspicious email attachments.