APT Groups and Ransomware Groups Collaborate to Mask Cyber Espionage Campaigns

Summary: Financially motivated cyber operations linked to North Korea, particularly through the Democratic People’s Republic of Korea (DPRK) and its affiliated groups, focus on stealing cryptocurrencies and exploiting blockchain platforms. A range of groups, including APT38, UNC1069, and APT43, engage in operations that blend financial crime with espionage, targeting various global institutions. Recent reports highlight the significant scale of North Korean cryptocurrency thefts, totaling around billion from 2017 to 2023, with operations extending globally through sophisticated tactics.

Affected: Global financial institutions, cryptocurrency platforms, and organizations worldwide

Keypoints :

• APT38, linked to North Korean intelligence, has attempted to steal over .1 billion from financial institutions worldwide.
• Groups like UNC1069 (CryptoCore) and UNC4899 (TraderTraitor) have emerged as successors to APT38, targeting cryptocurrency entities with significant thefts.
• DPRK IT workers are infiltrating global organizations under false identities to fund the regime and evade sanctions while engaging in malicious activities.