Tradertraitor

TraderTraitor, a threat actor attributed to the North Korean government's APT38 hacking group also known as Lazarus, has been implicated in a series of cyberattacks targeting cryptocurrency platforms. The FBI has recently linked TraderTraitor to the theft of hundreds of millions of dollars in cryptocurrency, tracking blockchain activity associated with the Democratic People's Republic of Korea (DPRK). Over the last 24 hours, the agency has identified movement of approximately 1,580 bitcoin, worth more than $40 million, from several cryptocurrency heists carried out by TraderTraitor-affiliated actors. It is believed that DPRK may attempt to cash out this stolen cryptocurrency. The threat actor uses a malware, also named TraderTraitor, to infiltrate company networks and execute fraudulent blockchain transactions. The recent attacks share commonalities with another North Korean cyberattack detected in June 2022, also executed by TraderTraitor. The attack involved victims downloading the TraderTraitor malware after clicking on malicious links, enabling the hackers to gain control over their devices. In addition to these attacks, TraderTraitor was also implicated in the Harmony intrusion, where the same malware was utilized. In July 2023, GitHub disclosed details of an npm campaign in which adversaries tracked as TraderTraitor, also referred to as Jade Sleet or UNC4899, used fake personas to target the cybersecurity sector among others. This cluster has since been implicated in the JumpCloud hack that took place around the same time. The FBI had attributed three other attacks on cryptocurrency platforms to TraderTraitor back in August. These series of events highlight TraderTraitor's persistent and evolving threats to the cybersecurity landscape, particularly in the realm of cryptocurrency.