NORTH KOREA: North Korean cyber spies created U.S. firms to dupe crypto developers

North Korean cyber spies created two businesses in the U.S., in violation of Treasury sanctions, to infect developers working in the cryptocurrency industry with malicious software, according to cybersecurity researchers and documents reviewed by Reuters.

The companies, Blocknovas LLC and Softglide LLC were set up in the states of New Mexico and New York using fake personas and addresses, researchers at Silent Push, a U.S. cybersecurity firm, told Reuters. A third business, Angeloper Agency, is linked to the campaign, but does not appear to be registered in the United States.

“This is a rare example of North Korean hackers actually managing to set up legal corporate entities in the U.S. in order to create corporate fronts used to attack unsuspecting job applicants,” said Kasey Best, director of threat intelligence at Silent Push.
The hackers are part of a subgroup within the Lazarus Group, an elite team of North Korean hackers which is part of the Reconnaissance General Bureau, Pyongyang’s main foreign intelligence agency, Silent Push said.

Silent Push was able to confirm multiple victims of the campaign, “specifically via Blocknovas, which is by far the most active of the three front companies,” the researchers said in a report, opens new tab shared with Reuters ahead of publication.
SANCTIONS
Reuters reviewed registration documents for Blocknovas and Softglide filed in New Mexico and New York, respectively. Reuters was unable to locate the persons named in the registration documents.

Blocknovas’ registration listed a physical address in Warrenville, South Carolina, that appears on Google Maps to be an empty lot. Softglide appears to have been registered by a small tax office in Buffalo, New York.
The activity represents the continuing evolution in the sprawling North Korean efforts to target the cryptocurrency sectors in a bid to raise cash for the North Korean government.
In addition to stealing foreign currency via hacks, North Korea has dispatched thousands of IT workers overseas to bring in millions to finance Pyongyang’s nuclear missile programme, according to the United States, South Korea and the United Nations.
The presence of a North Korean-controlled company, registered by the RGB, in the United States is a violation of Office of Foreign Assets Control sanctions. OFAC is part of the Treasury Department. It also violates United Nations sanctions that prohibit North Korean commercial activity designed to assist the isolated country’s government or military.

The New York Department of State told Reuters it does not comment on companies registered in the state. The New Mexico secretary of state’s office told Reuters in an email on Thursday that the company was registered in the state’s online Domestic LLC system. “The filing was in compliance with state statute, using a registered agent, and there would be no way our office would know its connection to North Korea,” an office representative said.
The hackers sought to infect applicants for fake jobs with at least three strains of known malware previously linked to North Korean cyber operations. The malware linked to the campaign by Silent Push can be used to steal information, facilitate access to networks and load additional forms of malware.