Loading story…
North Korea-linked Lazarus Group, including the TraderTraitor cluster, targeted cryptocurrency exchanges, blockchain firms, and developers with social-engineering lures that delivered trojanized Python projects, fake code-evaluation repositories, malicious open-source packages, and compromised applications. Reporting tied the activity to campaigns that tricked victims into running files such as StockInvestSimulator-main.zip and MonteCarloStockInvestSimulator-main.zip, abusing unsafe PyYAML deserialization for remote code execution, while newer intrusion chains used heavily obfuscated Python and a six-stage flow that added TSUNAMI/TSUNAMIKit tooling beyond Lazarus’s previously observed Python-based payloads.
Once inside, the attackers backdoored systems, stole credentials, SSH keys, browser wallet data, cloud credentials, and AWS session tokens, then moved laterally into internal services and wallet infrastructure to transfer digital assets. The activity was also linked to deployment of AnyDesk, keylogging, and XMRig cryptominers, and to broader cloud and SaaS tampering that redirected cryptocurrency transactions; public attributions have connected the cluster to major thefts including the DMM Bitcoin and Bybit heists, underscoring an ongoing campaign against crypto-sector development and production environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
22 events from the most recent confirmed update back to the earliest known activity.
A later LinkedIn post said a previous Lazarus campaign in November 2024 used a compromised Bitbucket repository as the initial lure while keeping largely the same TTPs as the newer campaign.
SlowMist said the attackers scanned internal networks, exploited internal services, stole SSH keys, moved laterally using trusted server relationships, and ultimately transferred cryptocurrency assets from wallet infrastructure they controlled.
According to SlowMist, the attackers persuaded victims to enable privileged mode in docker-compose.yaml, allowing privilege escalation and full control of the target device.
SlowMist said the tampered project added a file named data_fetcher.py that abused yaml.load with attacker-controlled content, enabling remote code execution and backdoor deployment.
SlowMist reported that the campaign used malicious archives such as StockInvestSimulator-main.zip and MonteCarloStockInvestSimulator-main.zip, disguised as legitimate Python projects, to gain initial access to exchange employees’ systems.
SlowMist said it investigated multiple hacking incidents affecting cryptocurrency-related organizations beginning in June 2024 and attributed the campaign to the Lazarus Group.
In late May 2024, attackers diverted 4,502.9 BTC, worth about $308 million, in a fraudulent transaction affecting DMM Bitcoin.
The malware used in the Ginco intrusion was identified as RN Loader and RN Stealer, which harvested SSH keys, saved credentials, and cloud configuration data from the victim system.
In March 2024, a TraderTraitor operative posing as a recruiter tricked a Ginco developer into running a malicious Python script from a fake GitHub coding challenge.
The FBI and Japanese authorities formally attributed the DMM Bitcoin theft to TraderTraitor.
After the Ginco compromise, the attackers used stolen session cookies to access Ginco’s internal systems and an unencrypted communication channel linked to DMM Bitcoin.
In July 2023, TraderTraitor compromised JumpCloud and used the provider’s privileged access to push a malicious update to a small number of cryptocurrency-industry customers. JumpCloud later disclosed that fewer than five customers were impacted.
In late 2023, Elastic Security Labs discovered a novel intrusion targeting blockchain engineers at a prominent cryptocurrency exchange platform. The attackers used Discord social engineering and a fake cryptocurrency arbitrage bot to deliver the previously undisclosed KANDYKORN macOS backdoor through a multi-stage loader chain.
Mandiant attributed the JumpCloud intrusion to TraderTraitor after investigating one victim of the 2023 breach.
GitHub identified the actor behind the malicious npm and repository campaign as North Korea’s Jade Sleet or TraderTraitor and suspended the malicious accounts and repositories.
In early 2023, TraderTraitor expanded into open-source software supply-chain attacks using malicious npm dependencies in GitHub collaboration lures, primarily targeting developers at blockchain and fintech firms.
An April 2022 joint advisory by the FBI, CISA, and the U.S. Treasury linked TraderTraitor to Lazarus Group, APT38, BlueNoroff, and Stardust Chollima.
From 2020 through 2022, TraderTraitor used phishing messages on LinkedIn, Slack, and Telegram, often posing as recruiters to convince employees at crypto companies to download fake cryptocurrency applications.
Wiz reported that the North Korean TraderTraitor cluster had conducted campaigns targeting cryptocurrency organizations since at least 2020, using social engineering, trojanized software, and supply-chain compromise techniques.
Because it assessed the attacks on cryptocurrency exchanges as ongoing and escalating, SlowMist publicly released attacker infrastructure, GitHub accounts, and TTPs to help defenders.
The LinkedIn analysis said the campaign introduced TSUNAMI/TSUNAMIKit components that extended the infection chain beyond Lazarus’s previously known Python-based third stage into a six-stage chain.
A later LinkedIn post described Lazarus launching a new fraudulent campaign after the November 2024 activity, using fake personas and GitLab-hosted code-evaluation lures to target developers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
linkedin.com
Open sourcewiz.io
Open sourceslowmist.medium.com
Open sourcevirusbulletin.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. agencies and security researchers linked North Korea’s **Lazarus Group**—also tracked as **APT38**, **BlueNoroff**, **Stardust Chollima**, and **HIDDEN COBRA**—to a long-running campaign targeting cryptocurrency exchanges, DeFi platforms, trading firms, venture capital funds, gaming companies, and high-value holders. The operation used spearphishing, fake job offers, fraudulent trading firms, social networking, and even fake Telegram groups to lure victims into downloading trojanized cryptocurrency trading and wallet applications on **Windows** and **macOS**, with activity reported across more than 30 countries. Researchers described later activity as an evolution of the earlier **AppleJeus** campaign, while U.S. agencies said the broader effort continued under the **TraderTraitor** cluster. The malicious apps—including **Celas Trade Pro**, **JMT Trading**, **Union Crypto**, **Kupay Wallet**, **CoinGoTrade**, **Dorusio**, **Ants2Whale**, **DAFOM**, **TokenAIS**, **CryptAIS**, **AlticGO**, **Esilet**, and **CreAI Deck**—appeared legitimate but installed hidden updater components, persistence mechanisms, and remote-access payloads such as **Manuscrypt** variants. Analysis of **Union Crypto** showed the malware collecting host details, installing services or LaunchDaemons, contacting command-and-control infrastructure, downloading second-stage payloads, and enabling file operations, screenshots, command execution, lateral movement, theft of private keys, and fraudulent blockchain transactions. U.S. authorities said the campaign supports North Korea’s sanctions evasion and revenue generation, and warned that cryptocurrency and blockchain firms remain likely targets.
Jun 29, 2026
U.S. agencies and private researchers linked multiple cryptocurrency-focused malware campaigns to North Korea’s **Lazarus Group**/**HIDDEN COBRA**, including the **AppleJeus** family delivered through fake but functional trading and wallet applications for **Windows** and **macOS**. CISA reports said variants including **Celas Trade Pro**, **JMT Trading**, **Kupay Wallet**, and **CoinGoTrade** were distributed from spoofed or seemingly legitimate websites such as `celasllc.com`, `jmttrading.org`, and `kupaywallet.com`, often with GitHub-hosted installers. The applications presented benign trading interfaces while secretly installing updater, daemon, or backdoor components that collected host information, established persistence, and fetched encrypted second-stage payloads from attacker-controlled infrastructure. The malware gave operators remote access to victim systems in cryptocurrency exchanges, financial services firms, and related organizations, with capabilities including command execution, file upload and transfer, reconnaissance, and payload staging. CISA tied the campaigns to Lazarus through infrastructure and code overlap with known implants such as **FALLCHILL**, **HOPLIGHT/MANUSCRYPT**, and the **CrashReporter** backdoor, while Proofpoint documented related Lazarus activity using phishing documents, JavaScript downloaders, malicious `LNK` and `CHM` files, and backdoored cryptocurrency apps to deploy **PowerRatankba**, a custom **Gh0st RAT** variant, and **RatankbaPOS**. Together, the reporting shows a sustained Lazarus effort to steal cryptocurrency and gain access to crypto-sector networks by masquerading malware as legitimate trading software.
Aug 15, 2026
North Korea-linked **Velvet Chollima**—also tracked as **Kimsuky**, **APT43**, and Microsoft’s **Ruby Sleet**—ran a financially motivated campaign that used a trojanized cryptocurrency trading application named **Tralert FX** to compromise retail crypto traders. The operation reportedly began in June 2025 and relied on an **EV-signed installer** associated with **"AgilusTech LLC"** to make the lure appear legitimate, then deployed a multi-stage malware chain designed to harvest browser credentials and cryptocurrency wallet data from infected Windows systems. The intrusion chain established persistence through **Windows scheduled tasks** and ultimately delivered **MoonPeak**, a customized **.NET XenoRAT** variant. Operators used **GitLab** for both command-and-control and data exfiltration, with infected hosts polling roughly every 30 minutes. Reporting tied the campaign to more than **4,100 operator commits** and over **90 compromised hosts** at disclosure, indicating a sustained, scalable DPRK monetization effort focused on high-volume theft from individual cryptocurrency users rather than the exchange-focused intrusions more commonly associated with Lazarus.
Jun 29, 2026