North Korean hackers have been found to be using a novel approach to infiltrate the cryptocurrency industry in the United States, according to cybersecurity firm Silent Push. The group, linked to the notorious Lazarus Group hacking collective, quietly established companies in New York and New Mexico under false identities as part of an elaborate campaign targeting crypto developers.

Silent Push revealed on Thursday that the North Korean-backed unit had registered two businesses, Blocknovas and Softglide, to create legitimate-seeming fronts for their operations. These companies were set up with fictitious names and addresses to lend credibility to their fraudulent activities. Notably, Blocknovas was reportedly the most active, while its listed address in South Carolina turned out to be an empty lot. Softglide was registered at a tax office in Buffalo, New York, further illustrating the deceptive nature of these entities.

The hacking group employed a sophisticated recruitment strategy designed to ensnare victims within the crypto community. By creating fake Linkedin-style profiles and job advertisements, the hackers invited potential targets to participate in seemingly genuine interviews. However, the recruitment process was a ruse to trick candidates into downloading malware disguised as tools necessary for job applications. This malware has been linked to at least three different virus strains previously associated with North Korean cyber operations, capable of stealing data, granting remote access, and facilitating further cyberattacks such as spyware or ransomware deployment.

Kasey Best, director of threat intelligence at Silent Push, remarked to Coindesk, “This is a rare example of North Korean hackers actually managing to set up legal corporate entities in the US in order to create corporate fronts used to attack unsuspecting job applicants.” The implications of this strategy highlight the evolving tactics used by nation-state cyber threat actors to exploit the growing interest and talent pool within the cryptocurrency sector.

The United States Federal Bureau of Investigation (FBI) has responded to these activities by seizing the domain for Blocknovas. According to a notice posted on the site, the domain was taken down “as part of a law enforcement action against North Korean cyber actors who utilised this domain to deceive individuals with fake job postings and distribute malware.”

North Korean hacking groups have a documented history of stealing billions in cryptocurrency through various cyberattack methods, and the discovery of these front companies represents a significant expansion in their operational tactics. The use of legitimate-appearing corporate fronts in the US marks a new level of sophistication and underscores the persistent threat posed by state-backed cybercriminal actors within the crypto ecosystem.

Source: Noah Wire Services