North Korean Hackers Use Crypto Gifts to Breach Firms

The Lazarus Group, a North Korean-linked cybercrime organization, has adopted a novel tactic to breach the security defenses of cryptocurrency firms. The group is now using cryptocurrency gifts as part of an elaborate social engineering scheme to gain the trust of their targets before deploying malicious code.

According to a pseudonymous Chief Information Security Officer (CISO) at Web3 security firm SlowMist, the tactic involves sending cryptocurrency, such as USDT, to employees of crypto firms. The amounts can range from hundreds to thousands of dollars, with the aim of making the attackers seem legitimate and increasing the likelihood of victims complying with their requests.

This approach differs from traditional cyberattacks that exploit technical vulnerabilities. Instead, it focuses on manipulating human behavior by identifying employees working for crypto firms, establishing contact, and sending them digital assets to gain credibility. Once trust is established, the attackers trick victims into executing malicious code embedded with backdoors, allowing unauthorized entry into company systems.

The interactions often occur through private GitHub repositories or live chat tools. To mitigate the risk of such deceptive tactics, the CISO warned that crypto firms must strengthen internal security measures and train employees to recognize and avoid falling for these schemes.

The incident highlights the evolving nature of crypto-related crimes as security concerns in the industry grow. It also suggests that the Lazarus Group may be preparing for a resurgence in activity after a decline in late 2024. In 2024, North Korean-backed hackers stole $1.34 billion of the total $2.2 billion pilfered from the crypto sector, marking a staggering 103% increase from the $660 million attributed to North Korea in 2023. However, their attack frequency declined significantly following a late June 2024 summit between Russian President Vladimir Putin and North Korean leader Kim Jong Un.