Tag: North Korea

Justice Department says North Koreans have infiltrated dozens of U.S. companies

Posted on by faz_business


The U.S. Department of Justice is warning that hackers working for the North Korean regime are increasingly relying on Americans to facilitate the hacking of U.S. companies.

In an announcement on Tuesday, prosecutors said they have indicted and arrested at least two people, and conducted searches across dozens of suspected “laptop farms” in Texas. The computers were allegedly used by North Koreans to remotely hack into American companies and steal sensitive data.

According to the DOJ, federal authorities seized over 180 computers that they believe American companies had shipped out to their newly hired employees, not realizing that they were sanctioned North Korean spies who had used stolen identities of U.S. citizens to gain employment. The DOJ said that it raided over 40 laptop farms across Texas, the largest disclosed number of homes and residences used for facilitating North Korean hacks, which were owned by at least two American facilitators.

CrowdStrike, which helped the FBI investigate and disrupt the latest North Korean operations, said that laptop farms are “vital” to North Korea in helping its hackers overcome physical, financial, and legal challenges of not physically being in the United States.

The prosecutors said at least 70 U.S.-based companies had been infiltrated by the hackers, who are believed to have generated around $3 million in stolen funds. The DOJ did not name the affected companies, but described them as healthcare, cyber support, retail, communications, and manufacturing sectors across Ohio and 16 other states, including the District of Columbia.

“Increasingly, North Korean IT workers are turning to recruiting American facilitators to counter improved private sector detections and law enforcement actions. These workers are hiring facilitators to complete a wider variety of tasks, and in some cases subcontracting entire jobs to third-party foreign nationals,” the Justice Department said. 

Oftentimes, North Korean hackers use real-looking email addresses, spoofed LinkedIn profiles, and extensive online and social media accounts as cover for their activities.

In a separate public service announcement, the FBI said that there are “thousands” of North Korean-state controlled IT workers working at Western companies, which “pose a significant national security and intellectual property theft insider threat.”

This is the latest wave of arrests, indictments, and enforcement action targeting North Korean activities in the United States in recent years. The breakaway regime has used this “remote IT workers” scheme to allow North Koreans to gain employment with U.S. and European companies, earn a wage, and then steal sensitive information and intellectual property while as employees. The victim companies are then extorted into paying the hackers further. 

The remote IT workers’ scheme is one of several strands of illicit revenue that the North Korean regime aims to generate, including hacking crypto exchanges and open-source developer projects, with the aim of funding its internationally sanctioned nuclear weapons program. The regime is thought to have stolen at least $2 billion in crypto during 2025 alone.

Experts on North Korea have put the number of hacked companies and the amount of stolen crypto as likely much higher than reported.

Earlier this year, CrowdStrike said in a separate report that North Korean hackers were behind around half of all documented “hands-on-keyboard” intrusions over the past year, referring to hacks that are carried out by humans and not automated tools or AI. 

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Crypto Project Details Alleged 6-Month North Korean Intel Op Behind $285 Million Hack

Posted on by faz_business



Over the weekend, the team behind Drift, which is a crypto protocol for perpetual futures trading on Solana, provided an update on a hack of the project that occurred on April 1. In the report, a six-month intelligence operation run by a criminal hacking group connected to the North Korean regime is pointed to as the source of the attack. However, some observers are also pointing fingers at the Drift team for reasons of incompetence or worse.

The hack pulled roughly $285 million out of Drift’s storage pools, which held stablecoins like USDC, along with JLP, SOL, and other crypto assets. Two blockchain tracking firms, TRM Labs and Elliptic, pieced together the full sequence.

It began in mid-March 2026. The attackers first moved money through a mixing service called Tornado Cash to hide their tracks and set up special accounts that let them prepare certain transactions in advance. On March 27, Drift’s security team switched to a new approval system that needed only two out of five key holders to sign off on major changes and removed any built-in waiting period that might have triggered an alert. The hackers then created 750 million brand-new fake tokens called CarbonVote Token, or CVT. They manipulated trading activity so Drift’s price-checking tools treated these worthless tokens as legitimate, high-value collateral that could back huge withdrawals.

On April 1, they fired off the pre-prepared transactions. This let them add the fake token to the platform, raise borrowing limits, dump hundreds of millions of the phony tokens into the system, and drain real assets through 31 fast withdrawals. The entire process took around 12 minutes. They quickly swapped the stolen funds into USDC on a Solana exchange and moved everything over to the Ethereum network to cover their tracks.

Notably, this approach echoes a recent exploit on the Resolv protocol and its USR stablecoin. There, an attacker gained control of a privileged AWS signing key, minted nearly 80 million new USR tokens against only a few hundred thousand dollars in actual collateral, and cashed out about $25 million. Both cases hinged on private key access rather than a pure code vulnerability, combined with the ability to issue or collateralize assets far beyond normal limits.

TRM Labs and Elliptic flagged the North Korean connection within days of the April 1 incident. Indicators included on-chain staging that aligned with Pyongyang local time and behavioral patterns matching prior DPRK-linked activity.

Drift’s public update on X provided more details on how the operation allegedly unfolded over six months. In fall 2025, individuals posing as representatives of a quantitative trading firm approached Drift contributors at a major crypto conference. They continued the contact in person at events in multiple countries, established a Telegram group, discussed detailed trading strategies and vault integrations, and even onboarded their own Ecosystem Vault with over $1 million in deposits. The conversations and shared resources appeared routine for legitimate counterparties. After the hack, the group scrubbed their Telegram history and any associated software.

Forensics pointed to three potential vectors for the private key compromise involved in the attack: one contributor may have cloned a code repository that exploited a known VSCode or Cursor vulnerability allowing silent arbitrary code execution; a second was persuaded to download a TestFlight app framed as the firm’s wallet product; and a third vector remains under active review by law enforcement. With medium-to-high confidence, the SEAL 911 team attributed the effort to the same North Korean state-affiliated actors behind the October 2024 Radiant Capital hack. Additionally, the in-person individuals involved were not North Korean nationals but third-party intermediaries, a tactic consistent with DPRK tradecraft.

 

In terms of the Drift team’s culpability in the incident, some have questioned why a protocol managing hundreds of millions would allow downloads of unvetted apps like the TestFlight wallet onto hardware tied to multi-signature access. Others highlighted the lack of stricter compartmentalization between development environments and signing keys, arguing that basic operational security should have prevented the breach regardless of the attacker’s sophistication. “The more I sit on this, the more I can’t help but think we’re dealing with a civil negligence issue,” crypto attorney Ariel Givner wrote on X.

At the same time, security researchers have warned that a genuine six-month intelligence campaign of this caliber suggests similar operations could already be underway against other projects. The level of patience and resource investment implies the actors did not limit themselves to a single target.

North Korea has relied on cryptocurrency theft as a consistent funding mechanism for years. Past major incidents include the 2022 Ronin Network drain of more than $600 million and repeated exchange compromises. In 2025 the regime’s hackers set a new annual record by stealing $2.02 billion, according to a Chainalysis report.

The combination of smoke and mirrors, remote collaboration, and high financial stakes in crypto creates conditions where determined, sophisticated groups, including intelligence agencies, can invest months in building trust before striking. And when hundreds of millions or even billions are potentially available, actors will pursue attacks through extensive, exhaustive means. The data also clearly shows that criminal use of crypto is on the rise, as both illicit transfers and physical attacks on known crypto holders hit new all-time highs last year.



US indicts five individuals in crackdown on North Korea’s illicit IT workforce

Posted on by faz_business


U.S. authorities have indicted five people over their alleged involvement in a multi-year scheme that saw them obtain remote IT employment with dozens of American companies.

The Department of Justice on Thursday announced the indictment of North Korean citizens Jin Sung-Il and Pak Jin-Song; Pedro Ernesto Alonso De Los Reyes of Mexico, and U.S. nationals Erick Ntekereze Prince and Emanuel Ashtor.

The DOJ said the FBI arrested Ntekereze and Ashtor, and a search of Ashtor’s home in North Carolina found evidence of a “laptop farm” that hosted company-provided laptops to deceive organizations into thinking they had hired workers based in the U.S.

Alonso was also arrested in the Netherlands after a U.S. warrant was issued.

According to the indictment, Ntekereze and Ashtor allegedly installed remote access software, including Anydesk and TeamViewer, on the company-provided devices, allowing the North Koreans to conceal their locations. The two Americans also provided Jin and Pak with forged identity documents, including U.S. passports and U.S. bank accounts.

The indictment alleges that the defendants gained employment from at least 64 American organizations over the course of the multi-year scheme, which ran from April 2018 through August 2024. These included a U.S. financial institution, a San Francisco-based technology company, and a Palo Alto-headquartered IT organization.

According to the Justice Department, payments from ten of those companies generated at least $866,255 in revenue, most of which was laundered through a Chinese bank account. 

“The Department of Justice remains committed to disrupting North Korea’s cyber-enabled sanctions-evading schemes, which seek to trick U.S. companies into funding the North Korean regime’s priorities, including its weapons programs,” Devin DeBacker, supervisory official with the Justice Department’s National Security Division, said in a statement. 

Alongside Thursday’s indictments, which come just days after the Treasury Department sanctioned two individuals and four entities for allegedly engaging in similar behavior, the FBI released an advisory warning that North Korean IT workers are increasingly engaging in malicious activity, including data extortion.

The agency said it has observed North Korean IT workers leveraging unlawful access to company networks to “exfiltrate proprietary and sensitive data, facilitate cyber-criminal activities, and conduct revenue-generating activity on behalf of the regime.”