North Korean hackers are at it again — phishing scheme targets hundreds of workers to try and steal crypto and more
In this news:
UNK_DeadDrop targets developers with email‑based fake job luresCampaign mirrors Lazarus tactics but uses new self‑contained payloadsProofpoint says shift to mass phishing shows industrialized NK ops
Lazarus is not the only North Korean threat actor that is luring software developers with fake jobs - there is also a hacking group called UNK_DeadDrop now doing a similar thing, but with notable differences.
Security researchers at Proofpoint published an in-depth report looking into an ongoing campaign not unlike the Contagious Interview one.
For those unaware of Contagious Interview, it is one of two major Lazarus campaigns, the second one being Operation DreamJob. The crooks would fake everything - a company, its employees, as well as projects, and then go to LinkedIn for a “hiring spree.” They would reach out to software developers working in high-profile AI and Web 3 organizations and would offer high-paying jobs and a chance to work on exciting new projects.
Similarities and differences
The hiring process, however, would include a trial assignment, which often required the victims to run malicious code from GitHub. After infecting their targets with infostealers, the crooks would access company profiles, exfiltrate crypto wallet information, and then steal as many tokens as possible.
According to some sources, Lazarus alone was able to steal billions of dollars in crypto throughout the years.
While UNK_DeadDrop is more-or-less doing the same thing, its approach is somewhat different. Instead of using LinkedIn for initial contact, these attackers rely mostly on email. They don’t arrange fake interviews, but rather just send unsolicited job offers or code review requests. And finally, they use a new, self-contained payload distinct from what was previously seen in Contagious Interview campaigns.
“UNK_DeadDrop activity suggests North Korea-aligned operations targeting developers for financial gain are maturing and evolving,” Proofpoint’s researchers concluded.
“The shift from active social engineering over social media platforms to conduct fake interviews to large campaigns of recruitment-themed phishing emails distributing links to malicious repositories could indicate an actor industrializing and scaling operations.”
Via The Register
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.
Share the article:
Trending News & Crypto World
.png)
Latest Crypto News
Top Trending Cryptocurrencies on The Market
Current Price
$0.05359
Market Cap
$407.4M -4.65%
24h Volume
$213.1M
Supplies
10.0B / 10.0B
Current Price
$0.05898
Market Cap
$397.9M -4.75%
24h Volume
$68.4M
Supplies
10.0B / ∞
Current Price
$0.3901
Market Cap
$389.9M 0.84%
24h Volume
$11.6M
Supplies
1.5B / 1.5B
Current Price
$0.006498
Market Cap
$384.4M -12.95%
24h Volume
$1.8K
Supplies
95.0B / 100.0B
Current Price
$1.041
Market Cap
$380.1M -0.71%
24h Volume
$17.5M
Supplies
365.0M / ∞
Current Price
$2.110
Market Cap
$367.0M -3.70%
24h Volume
$62.7M
Supplies
281.5M / ∞
Current Price
$0.04453
Market Cap
$365.1M 5.92%
24h Volume
$8.0M
Supplies
10.0B / 10.0B
Current Price
$0.000000377
Market Cap
$364.0M -2.76%
24h Volume
$10.8M
Supplies
990.0T / 990.0T
Current Price
$17.979
Market Cap
$361.4M -0.94%
24h Volume
$5.1M
Supplies
20.1M / 21.0M
Current Price
$0.07958
Market Cap
$361.2M -0.68%
24h Volume
$39.4M
Supplies
10.0B / ∞
Current Price
$0.9994
Market Cap
$357.4M 0.06%
24h Volume
$6.5M
Supplies
357.6M / ∞
Current Price
$0.1052
Market Cap
$351.9M -3.75%
24h Volume
$8.0M
Supplies
10.0B / 10.0B