FBI and CSIA issue alert over North Korean cyberattacks on crypto targets

The Cybersecurity and Infrastructure Security Agency (CISA) and FBI have issued an alert on North Korean state-sponsored cyber threats that target blockchain companies in response to the Ronin Bridge hack last month.

The alert was issued on April 18 in conjunction with the Federal Bureau of Investigation and the Treasury Department which had warnings and mitigation suggestions for blockchain and crypto firms to ensure their own operations remain safe from hackers.

With the @FBI, and @USTreasury, we released a new cybersecurity advisory on North Korean state-sponsored activity targeting blockchain technology and the cryptocurrency industry. Read the technical guidance and mitigation strategies: https://t.co/Oio478Ouv3 pic.twitter.com/VLa3HUrsPY
— Cybersecurity and Infrastructure Security Agency (@CISAgov) April 18, 2022

Lazarus is not the only hacker group listed by name as an advanced persistent threat (APT). Included among Lazarus are APT38, BlueNoroff, and Stardust Chollima. These groups and others like them have been observed targeting what the bulletin called “a variety of organizations in the blockchain technology and cryptocurrency industry,” such as exchanges, decentralized finance (DeFi) protocols, and play-to-earn games.

Their efforts filled their coffers with $400 million in stolen crypto funds in 2021 according to a report from Chainalysis. The regime has already topped that amount this year with the Ronin Bridge hack from which it extracted about $620 million in crypto in late March.

The CSIA does not believe the rate of thefts will see a downturn any time soon as it stated that groups are using spearphishing and malware to steal crypto. It added that:

“These actors will likely continue exploiting vulnerabilities of cryptocurrency technology firms, gaming companies, and exchanges to generate and launder funds to support the North Korean regime.”

Kim Jong Eun’s staunch refusal to dismantle his nuclear weapons program forced the U.S. to levy some of the harshest economic sanctions ever against his country. This has led him to turn to cryptocurrency to fund the nuclear weapons program since his cash flows through traditional means have been almost entirely sealed off.

While the alert goes into greater detail about exactly how these groups use malware such as AppleJeus to target blockchain and crypto firms, it also offers suggestions on how users can mitigate the risk to themselves and their users’ funds. Most of the recommendations are common sense security procedures such as using multi-factor authentication on private accounts, educating users on common social engineering threats, blocking newly registered domain emails, and endpoint protection.

The laundry list of mitigation strategies firms should take to ensure they are secure from harm include all sensible suggestions, however, the CSIA believes that education and awareness of the existent threat is one of the best strategies.

“A cybersecurity aware workforce is one of the best defenses against social engineering techniques like phishing,” it concluded.