Loading story…
North Korea-linked Velvet Chollima—also tracked as Kimsuky, APT43, and Microsoft’s Ruby Sleet—ran a financially motivated campaign that used a trojanized cryptocurrency trading application named Tralert FX to compromise retail crypto traders. The operation reportedly began in June 2025 and relied on an EV-signed installer associated with "AgilusTech LLC" to make the lure appear legitimate, then deployed a multi-stage malware chain designed to harvest browser credentials and cryptocurrency wallet data from infected Windows systems.
The intrusion chain established persistence through Windows scheduled tasks and ultimately delivered MoonPeak, a customized .NET XenoRAT variant. Operators used GitLab for both command-and-control and data exfiltration, with infected hosts polling roughly every 30 minutes. Reporting tied the campaign to more than 4,100 operator commits and over 90 compromised hosts at disclosure, indicating a sustained, scalable DPRK monetization effort focused on high-volume theft from individual cryptocurrency users rather than the exchange-focused intrusions more commonly associated with Lazarus.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
By the time of public disclosure, researchers reported more than 4,100 operator commits and over 90 compromised hosts, indicating sustained operational scale. The activity was assessed as a DPRK monetization model distinct from Lazarus-style exchange intrusions, instead targeting individual cryptocurrency users at volume.
Over the course of the campaign, the threat actor used an EV-signed installer tied to "AgilusTech LLC," deployed multiple malware stages, established persistence with Windows scheduled tasks, and used GitLab for command-and-control and exfiltration on roughly 30-minute intervals. The final payload was MoonPeak, described as a customized .NET XenoRAT variant.
In June 2025, Velvet Chollima/Kimsuky began a financially motivated operation using a fake cryptocurrency trading application called Tralert FX to target retail crypto traders. The campaign focused on stealing browser credentials and cryptocurrency wallet data for large-scale account takeover.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
bsky.app
Open sourcegist.github.com
Open sourcehybrid-analysis.blogspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. agencies and security researchers linked North Korea’s **Lazarus Group**—also tracked as **APT38**, **BlueNoroff**, **Stardust Chollima**, and **HIDDEN COBRA**—to a long-running campaign targeting cryptocurrency exchanges, DeFi platforms, trading firms, venture capital funds, gaming companies, and high-value holders. The operation used spearphishing, fake job offers, fraudulent trading firms, social networking, and even fake Telegram groups to lure victims into downloading trojanized cryptocurrency trading and wallet applications on **Windows** and **macOS**, with activity reported across more than 30 countries. Researchers described later activity as an evolution of the earlier **AppleJeus** campaign, while U.S. agencies said the broader effort continued under the **TraderTraitor** cluster. The malicious apps—including **Celas Trade Pro**, **JMT Trading**, **Union Crypto**, **Kupay Wallet**, **CoinGoTrade**, **Dorusio**, **Ants2Whale**, **DAFOM**, **TokenAIS**, **CryptAIS**, **AlticGO**, **Esilet**, and **CreAI Deck**—appeared legitimate but installed hidden updater components, persistence mechanisms, and remote-access payloads such as **Manuscrypt** variants. Analysis of **Union Crypto** showed the malware collecting host details, installing services or LaunchDaemons, contacting command-and-control infrastructure, downloading second-stage payloads, and enabling file operations, screenshots, command execution, lateral movement, theft of private keys, and fraudulent blockchain transactions. U.S. authorities said the campaign supports North Korea’s sanctions evasion and revenue generation, and warned that cryptocurrency and blockchain firms remain likely targets.
Jun 29, 2026
Microsoft-linked reporting says **North Korean threat actors** are using **AI** to scale and refine long-running “fake IT worker” schemes, where operatives pose as legitimate remote hires to obtain *authorized* access inside victim organizations. The activity is attributed to DPRK-linked clusters **Jasper Sleet** and **Coral Sleet**, with AI used to improve identity fabrication and maintenance (including face/voice manipulation) and to sustain day-to-day communications that help keep fraudulent personas credible, enabling “sustained, large-scale misuse of legitimate access.” Separately, reporting on suspected DPRK-linked intrusions describes a coordinated campaign against **cryptocurrency organizations** spanning staking platforms, exchange software providers, and exchanges, with theft of **source code, private keys, and cloud secrets**. Investigators described two primary access paths: exploitation of `CVE-2025-55182` in the *React2Shell* framework (including mass scanning and WAF-bypass techniques) and the use of **pre-obtained valid AWS access tokens** to move directly into cloud enumeration; researchers also recovered artifacts from attacker infrastructure (e.g., shell history, archived code, and tool configurations) that provided visibility into post-compromise activity and C2 setup.
Jun 29, 2026
A North Korean state-sponsored threat actor was inadvertently exposed after a LummaC2 infostealer infection compromised a device used in the $1.4 billion Bybit cryptocurrency exchange heist. Analysis by Hudson Rock and Silent Push revealed that the infected machine, operated by a malware developer within North Korea’s cyber apparatus, contained credentials and infrastructure directly tied to the Bybit attack, including the registration of a phishing domain used in the operation. This rare insight into North Korean cyber operations highlights the shared use of development rigs, credential sets, and infrastructure among state-backed actors, providing a unique window into their methods and operational overlaps. In parallel, Windows systems have been targeted by the advanced KimJongRAT malware, attributed to North Korean APT group Kimsuky, through phishing campaigns leveraging malicious HTA files. Attackers distribute ZIP archives containing LNK files disguised as tax notice PDFs, which, when executed, use `mshta` to activate the HTA file and deploy KimJongRAT. The malware is capable of exfiltrating system data, browser credentials, cryptocurrency wallet information, and messaging app accounts, with its behavior adapting based on the presence of security software like Windows Defender. These incidents underscore the ongoing sophistication and adaptability of North Korean cyber operations targeting both financial and information assets globally.
Jun 29, 2026