Loading story…
A 29-year-old Lithuanian national was arrested and extradited to South Korea for allegedly distributing malware-laden versions of the KMSAuto Windows activation tool, which infected approximately 2.8 million systems worldwide between 2020 and 2023. The malware, classified as clipper malware, monitored victims’ clipboards for cryptocurrency addresses and replaced them with attacker-controlled wallets, resulting in the theft of digital assets through fraudulent redirection of crypto transactions. Authorities report that the campaign led to at least 8,400 unauthorized transfers from 3,100 wallets, with total losses estimated at around ₩1.7 billion (approximately $1.8 million), including several South Korean victims.
The suspect’s arrest followed a multi-year, international investigation coordinated by Interpol, culminating in his extradition from Georgia to South Korea. Law enforcement agencies highlighted that the malware was distributed primarily through pirated software channels, exploiting users seeking illegal Windows and Office activators. The operation demonstrates the significant risks associated with downloading and using pirated software, as well as the global reach and financial impact of cybercriminal campaigns targeting cryptocurrency transactions.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
By late December 2025, South Korean authorities and media reports disclosed the suspect's arrest and the scale of the malware operation. Officials also warned users about the risks of downloading software from untrusted sources and said they would continue international cooperation against cybercrime.
South Korean authorities announced that the 29-year-old Lithuanian national had been extradited from Georgia to South Korea. The extradition followed the multinational investigation into the KMSAuto-based clipper malware campaign and alleged cryptocurrency thefts.
South Korea's National Office of Investigation, working with international partners and Interpol, conducted a five-year cross-border investigation that traced illicit cryptocurrency flows and identified the Lithuanian national as the alleged operator. The investigation ultimately led to action in Georgia and South Korea.
Over the 2020–2023 campaign, authorities said the malware infected about 2.8 million Windows and Office systems globally. Investigators linked it to roughly 8,400 fraudulent transactions from 3,100 compromised wallets, with losses estimated at about ₩1.7 billion to ₩1.8 million in digital assets.
Between April 2020 and January 2023, a Lithuanian suspect allegedly spread malware disguised as the illegal Windows activator KMSAuto. The malware replaced copied cryptocurrency wallet addresses with attacker-controlled ones, enabling theft from victims in South Korea and other countries.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
North Korea-linked **Velvet Chollima**—also tracked as **Kimsuky**, **APT43**, and Microsoft’s **Ruby Sleet**—ran a financially motivated campaign that used a trojanized cryptocurrency trading application named **Tralert FX** to compromise retail crypto traders. The operation reportedly began in June 2025 and relied on an **EV-signed installer** associated with **"AgilusTech LLC"** to make the lure appear legitimate, then deployed a multi-stage malware chain designed to harvest browser credentials and cryptocurrency wallet data from infected Windows systems. The intrusion chain established persistence through **Windows scheduled tasks** and ultimately delivered **MoonPeak**, a customized **.NET XenoRAT** variant. Operators used **GitLab** for both command-and-control and data exfiltration, with infected hosts polling roughly every 30 minutes. Reporting tied the campaign to more than **4,100 operator commits** and over **90 compromised hosts** at disclosure, indicating a sustained, scalable DPRK monetization effort focused on high-volume theft from individual cryptocurrency users rather than the exchange-focused intrusions more commonly associated with Lazarus.
Jun 29, 2026
Ukrainian authorities, working with law enforcement partners in the United States and South Korea, arrested six suspected members of the **Clop** ransomware operation and conducted 21 searches in Kyiv and surrounding areas. Investigators said they seized computers, smartphones, server equipment, cash, and luxury vehicles, and shut down infrastructure allegedly used in earlier attacks. The suspects were reported to face prison terms of up to eight years if convicted. The action targeted a group tied to ransomware and data-extortion attacks dating back to 2019, including incidents involving South Korean companies and the attack on retailer **E-Land**. Reporting also linked Clop to the exploitation of four zero-day vulnerabilities in **Accellion FTA**, intrusions that led to data theft and extortion affecting organizations including **Kroger, Jones Day, Qualys, Singtel, Stanford University Medical School, the University of California,** and **the University of Maryland**. Researchers and investigators have described Clop as a major double-extortion operation, though some assessments said the raids likely disrupted affiliates and money-laundering elements more than the group’s core leadership.
Aug 14, 2026
Microsoft disclosed an active Windows cryptocurrency theft campaign that spreads through malicious `.lnk` shortcut files, often delivered via USB devices, and combines worm-like propagation with a script-based clipper and stealer. The malware has been active since February 2026 and uses Windows Script Host, ActiveX, and a bundled Tor client to reach hidden-service command-and-control infrastructure through `localhost:9050`, avoiding conventional installer and IP-based infrastructure. Microsoft said the threat is detected as **Trojan:Win32/CryptoBandits.A** and related **CryptoBandits** signatures. Once installed, the malware monitors the clipboard roughly every 500 milliseconds for **BIP39 seed phrases**, Ethereum keys, Bitcoin WIF keys, and wallet addresses, then replaces copied cryptocurrency addresses with attacker-controlled ones while also stealing screenshots. Microsoft said the operators added persistence through scheduled tasks, Defender exclusions, layered obfuscation, and packaging with **PyArmor** and **PyInstaller**, while also terminating execution if Task Manager is detected. The campaign also supports remote code execution through an `EVAL` command from its C2, effectively giving the operators lightweight backdoor access; defenders were urged to block `.lnk` execution from removable media, restrict script hosts, and hunt for suspicious script activity, clipboard inspection, `curl`-based exfiltration, PowerShell screen capture, and Tor SOCKS5 traffic over `localhost:9050`.
Jul 12, 2026