North Korean Hackers to Target DeFi, Crypto Employees, FBI Warns

When North Korea is in the news you probably have come to expect something nefarious is going on, and you wouldn’t be disappointed with this latest development. 

The United States Federal Bureau of Investigation (FBI) has issued a warning to the crypto industry and employees of “decentralized finance (“DeFi”), cryptocurrency, and similar businesses”, over North Korea.

In the warning, the FBI said sophisticated social engineering campaigns orchestrated by North Korea targeting employees within these sectors.

Related: Bank Of Japan Could Raise Interest Rates, Sparking Further Crypto Market Fears

The campaigns are designed to deploy malware and steal cryptocurrency by using highly tailored approaches that are difficult to detect. 

North Korean actors conduct extensive research on their targets, often creating personalised fake scenarios. These usually leverage personal information to build trust and rapport, ultimately facilitating malware deployment.

Malicious Actors Aim to Infiltrate DeFi, Crypto Networks

North Korean cyber actors begin by identifying specific companies in the DeFi or crypto sector as targets. They conduct thorough research on potential victims, scrutinising their social media activities and profiles on professional networking sites.

They then use the information gathered to create highly personalised scenarios designed to appeal uniquely to each target. These scenarios may involve fictitious job offers or investment opportunities. These often include details pulled from the target’s personal and professional life to make the offers seem legitimate and attractive.

The actors then engage in prolonged interactions with their targets to build trust.

The actors usually communicate with victims in fluent or nearly fluent English and are well versed in the technical aspects of the cryptocurrency field.

FBI

They then impersonate either contacts of the victims or well-known figures in the tech sector, often using stolen or fabricated images and setting up professional-looking websites to support their fake identities.

To increase the credibility of their impersonations, the actors leverage realistic imagery, including pictures stolen from open social media profiles of the impersonated individual. These actors may also use fake images of time sensitive events to induce immediate action from intended victims.

FBI

As the relationship develops, the actors find opportunities to ask the targets to execute certain codes or download applications under the guise of pre-employment tests or software necessary for communication. 

However, this usually only serves the purpose to introduce malware into the target’s system.

Related: Details on Handheld Crypto Gaming Device SuiPlay0x1 Emerge as Pre-Orders Open for 2025 Release

If initial contact is successful, other team members might join the conversation to maintain the illusion and continue manipulating the victim. This helps solidify the trust and increases the chances of successful exploitation.

North Korean cyberattacks have long been a problem and especially its neighbour to the south has been a target. As CNA reported, attacks on South Korea have intensified, with the notorious Lazarus Group previously stealing around US$309 million (AU$461.6 million) in 2023, about one-sixth of all cybercrime losses.