North Korean hackers "Sapphire Sleet" disguised as recruiters and investors, stealing $10 million in cryptocurrency within six months

ChainCatcher news, Microsoft detailed a group of North Korean hackers in a blog post, known as "Sapphire Sleet," who disguise themselves as recruiters and venture capitalists with the aim of stealing cryptocurrency from individuals and companies. After contacting targets with bait or initial outreach, the North Korean hackers would arrange a virtual meeting, but the meeting is actually designed to load abnormally.

In the scenario of impersonating VCs, victims are forced to download malware disguised as a fix for the virtual meeting tool. In the activities of impersonating recruiters, potential candidates are asked to download and complete a skills assessment, which actually contains malware. Once installed, the malware can access other information on the computer, including cryptocurrency wallets. Microsoft stated that within just six months, the hackers stole at least $10 million in cryptocurrency, and have stolen billions of dollars in cryptocurrency over the past decade.