According to ChainCatcher news reported by Cointelegraph, North Korean hackers appear to have developed malware that can evade Apple's security checks. Researchers at Jamf Threat Labs, who focus on Apple, indicate that these applications seem to be experimental. This is the first time they have seen such technology used to infiltrate Apple's macOS operating system, but it does not run on the latest systems.Researchers found that Microsoft's VirusTotal online scanning service reported these applications as harmless, but they are actually malicious. Variants of these applications are written in Go and Python, utilizing Google Flutter applications. Flutter is an open-source development toolkit used for creating cross-platform applications.Out of six malicious applications, five are signed with developer accounts and have been temporarily notarized by Apple. Researchers wrote, "The domains and techniques in the malware are very similar to those used in other North Korean hacker malware, with indications that the malware was once signed and even temporarily passed Apple's notarization process."

ChainCatcher news, according to The Block, the Federal Bureau of Investigation (FBI) has indicated that North Korean cybercriminals are "actively targeting" employees in the Web3 industry to steal cryptocurrency funds.In a press release issued on Tuesday, the FBI noted that North Korean criminals have deployed sophisticated social engineering strategies to deceive individuals at cryptocurrency and decentralized finance (DeFi) companies, thereby "compromising networks associated with cryptocurrency assets." Such schemes pose a "persistent threat" to entities holding significant amounts of cryptocurrency or related products.The FBI further stated: "In recent months, North Korean malicious cyber actors have researched various targets related to cryptocurrency exchange-traded funds (ETFs). This research includes preparatory work before actions, indicating that North Korean attackers may conduct malicious cyber activities targeting companies associated with cryptocurrency ETFs or other cryptocurrency-related financial products."In addition to researching potential targets, North Korean cybercriminals also impersonate well-known members within companies or fabricate false scenarios (tailored to the victim's background, skills, or business interests) to gain and exploit their trust.

ChainCatcher message, Microsoft cybersecurity researchers have discovered a zero-day vulnerability in the Chromium engine, which powers browsers like Chrome. This vulnerability has been exploited by a North Korean hacker group known as Citrine Sleet, specifically targeting cryptocurrency users. Citrine Sleet has used a rootkit malware called FudModule to create fake cryptocurrency trading platform websites, luring users into downloading malware or weaponized cryptocurrency wallets, thereby gaining remote code execution access to steal the victims' crypto assets. This vulnerability was patched on August 21, and users are urged to update their browsers as soon as possible to ensure safety. This is the third exploited Chromium zero-day vulnerability this year.

ChainCatcher news, blockchain analysis provider Elliptic stated that a hacker group linked to North Korea may be behind the "$235 million WAZIRX hack incident."

ChainCatcher news, according to DLNews, a United Nations report states that North Korean hackers are infiltrating the cryptocurrency industry by impersonating job seekers. These fraudulent recruitment schemes have reportedly earned North Korea up to $600 million annually, with around 4,000 North Koreans attempting to enter the Western tech industry, including the cryptocurrency sector, by concealing their identities. Over the past seven years, North Korean hackers have stolen $3 billion worth of cryptocurrency assets through 58 cyber theft cases. Experts warn that this trend may just be beginning, posing new security challenges for the cryptocurrency industry.MetaMask Chief Security Researcher Taylor Monahan pointed out that North Korea generates revenue through the illegal sale of resources, IT jobs, manual labor, and hacking activities. With the launch of Bitcoin ETFs, Wall Street has begun to view cryptocurrencies as an asset class, leading to a surge in recruitment demand within the cryptocurrency industry. However, the influx of fraudulent job seekers has made hiring increasingly difficult.

ChainCatcher message, Railgun responded to the accusation of "North Korean hackers using the system" by stating that the hacker group "has been banned from using the Railgun system" and described this as a false and erroneous accusation.

ChainCatcher news, according to Nikkei, the United Nations Security Council has released the final report of the expert group reviewing the implementation of sanctions against North Korea. The report indicates that approximately 50% of North Korea's foreign exchange income comes from cyberattacks. North Korea is under investigation for allegedly participating in cyberattacks against companies related to crypto assets (virtual currencies), which have caused losses of about $3 billion.It is reported that the expert group investigated the implementation of sanctions against North Korea from July 2023 to January 2024, revealing methods used to evade sanctions. The report is not legally binding, but the Security Council or member states may impose new sanctions on organizations or individuals that violate the rules based on the report.

ChainCatcher News, the Federal Bureau of Investigation (FBI) has identified the North Korean criminal group Lazarus Group as responsible for the attack on Stake.com, stating that they stole a total of $41 million worth of cryptocurrency. The FBI has pinpointed over 30 addresses related to this attack, including Ethereum, BNB Chain, Polygon, and Bitcoin addresses.

ChainCatcher news, according to a report by the Korea JoongAng Daily on Monday, South Korea plans to submit a bill to track and freeze cryptocurrencies and other virtual assets used by North Korea. Government insiders stated that South Korean President Yoon Suk-yeol instructed modifications to the bill before submission to include "practical measures to strengthen national security," adding that the bill is expected to enhance South Korea's existing sanctions against North Korea. The latest bill outlines measures to "track and eliminate virtual currencies and other cryptocurrency assets stolen by North Korea through hacking."It was reported that the National Intelligence Service of South Korea stated last month that North Korean hackers illegally accumulated $180 million in cryptocurrency in the first half of this year, having stolen $1.28 billion worth of Bitcoin and Ethereum through hacking last year alone.

ChainCatcher news, according to Asiatoday, the South Korean National Intelligence Service announced at a press conference that North Korean hackers were involved in a $180 million cryptocurrency attack in the first half of 2023. Since 2015, North Korea has illegally stolen over $1.5 billion in virtual assets. Among them, the North Korean hacker group Lazarus Group is one of the largest cryptocurrency hacking organizations.Entities related to the cryptocurrency payment processor Alphapo, CoinsPaid, stated that the company suffered a $37 million attack last month and suspects that the Lazarus Group orchestrated this attack. The U.S. government has listed Lazarus as the main perpetrator of the $600 million hack on Ronin last year. Chainalysis pointed out in a report in January 2022 that the Lazarus Group was also involved in the 2020 hack of the Kucoin cryptocurrency exchange, as well as a hack of another unlisted exchange in 2018.

ChainCatcher news, according to the monitoring by MistTrack, a Web3 security tool under SlowMist, North Korean hackers are laundering funds related to the Atomic Wallet attack. A hacker address starting with 0xad3 transferred 503.08 ETH to THORChain in the past two days and exchanged it for Bitcoin, which was then bridged to a BTC address (starting with bc1q).In addition, North Korean hackers also used SWFT Blockchain to bridge ETH to multiple BTC addresses. (Source link)

ChainCatcher news, according to The Wall Street Journal, blockchain analysis company Chainalysis data shows that North Korean hackers have stolen $3 billion in cryptocurrency assets through digital heists. U.S. officials state that 50% of these funds are used to finance North Korea's ballistic missile program, which is being developed alongside its nuclear weapons. U.S. Deputy National Security Advisor Anne Neuberger noted that about 50% of the foreign currency used by the regime to purchase components for its ballistic missile program comes from its cyber operations.It is reported that North Korean hackers began launching their first major attacks around 2018. Last year, North Korean hackers contacted Axie Infinity developer Sky Mavis engineers via LinkedIn and embedded malicious computer code in a document, allowing them to access the engineer's computer and infiltrate Sky Mavis, ultimately stealing over $600 million from Axie Infinity players.Additionally, U.S. officials state that North Korea has established a team of thousands of IT workers who operate in countries around the world, including Russia and China. They disguise themselves as Canadian IT workers, government officials, and freelance Japanese blockchain developers. They conduct video interviews to secure jobs or, as in the case of Sky Mavis, pose as potential employers. To be hired by cryptocurrency companies, they hire Westerners to participate in job interviews to conceal the fact that North Koreans are the actual hires. According to former victims and investigators, once hired, they sometimes make minor modifications to products to make them easier to hack. (source link)

ChainCatcher news, according to an annual report from the U.S. National Security Council, the virtual assets stolen by North Korean hackers range from $630 million to over $1 billion, a figure that is double the amount stolen in 2021. The group noted in the report: "North Korea is using increasingly sophisticated cyber techniques to access digital networks involving cyber finance and steal potentially valuable information, including its weapons programs."While crypto hackers can sometimes be tracked, depending on whether they leave a criminal trail, the report states that the fundamental characteristics of cryptocurrencies and blockchain make tracking more difficult. The report adds: "Illegally obtained virtual assets are protected by the anonymity of blockchain and the obfuscation of asset flows through cryptocurrency exchanges." The report also encourages member states to adhere to FATF guidelines to curb the growing amounts of stolen cryptocurrency funds. (source link)

ChainCatcher news, according to a report by blockchain security company SlowMist, a wallet address linked to a suspected North Korean APT organization has stolen over 1,000 NFTs from victims of phishing attacks, profiting 300 ETH (approximately $365,000).It is reported that the North Korean APT organization has been leading a large-scale NFT phishing campaign. They are using nearly 500 different domain names to deceive cryptocurrency and NFT users into losing their assets. (source link)

According to ChainCatcher news, data disclosed by the South Korean National Intelligence Service shows that since 2017, state-sponsored North Korean hackers have stolen approximately $1.2 billion in cryptocurrency assets worldwide. Of this, about $626 million was stolen just this year. The National Intelligence Service believes that Pyongyang's ability to steal digital assets is now considered the strongest in the world, and states that North Korea has been focusing on cybercrime since the United Nations intensified economic sanctions in 2017. (Source link)

ChainCatcher news, cryptocurrency detective ZachXBT tweeted that Gate.io was hacked by North Korean hackers on April 21, 2018, resulting in a theft of $230 million, which has not been disclosed to customers to this day. (Source link)