According to a new report from the security research firm FireEye, North Korean hackers target Bitcoin and Ethereum users in South Korea.
The FireEye report suggested that North Korean hackers are trying to breach South Korea's cryptocurrency exchanges and steal user funds in Bitcoin and Ethereum.
Since May 2017, FireEye researchers claimed that hackers from North Korea have consistently targeted South Korean exchanges such as Yapizon, which suffered significant security breaches.
The FireEye report said:
"Add to that the links between operators in North Korea and a commitment to a Bitcoin news site in 2016, as well as at least one example of using a surreptitious cryptocurrency miner, and we started to see a picture of interest from North Korea in an asset class in which Bitcoin has only increased more than 400 percent since the beginning of this year. "
"Spearfishing" the largest Bitcoin exchanges in South Korea
The research firm also emphasized that a method called "spearfishing" has been used against some of the largest Bitcoin exchanges in South Korea.
By targeting users with tax-related phishing attacks and deploying malware such as PEACHPIT, FireEye claimed that North Korean hackers were able to access the accounts of many South Korean Bitcoin and Ethereum users.
The report added:
"The spearphishing that we have observed in these cases often goes to personal email accounts of employees in digital currency exchanges, often using tax lures and malware deployment (PEACHPIT and similar variants) linked to North Korean actors suspected of being responsible for intrusions in global banks in 2016. "
Throughout their report, investigators and analysts of FireEye affirm that the initiation of hacking attacks to the cryptocurrency trading platforms of South Korea coincided with the application of greater economic sanctions against North Korea by the United States and the United States. international community.
The report revealed that the first spearfishing attacks against South Korea's trading platforms began in early May, pointing to a single exchange.
At the end of May, a second Bitcoin exchange was breached by North Korean hackers, compromising user funds.
In early July, FireEye researchers argued that a third major exchange in South Korea was targeted, with a method that directly allowed North Korean hackers to threaten personal accounts through spearfishing.
What was the purpose of the attacks?
All the aforementioned attacks came after the application of new sanctions against North Korea on April 24, which led analysts within the cryptocurrency sector to speculate on the purpose of the attacks on Korea's cryptocurrency exchanges. from the south.
The FireEye report said that amid tougher sanctions and the enforcement of new regulations against trade with North Korea, it is understandable that the North Korean government would target an emerging class of assets that is causing an exponential increase in demand in the region. China, South Korea and Japan.
The report concludes:
"It should come as no surprise that cryptocurrencies, as an emerging class of assets, are becoming a target of interest for a regime that operates in many ways as a criminal enterprise, while North Korea is somewhat distinctive in its disposition. to get involved in financial crimes, such as in their possession of cybernetic espionage capabilities, the uniqueness of this combination will probably not last long term, since the increase in cybernetic powers could see a similar potential. "
Because Bitcoin exchanges and trading platforms are centralized, the level of security of the Bitcoin and cryptocurrency portfolios depends entirely on the service provider.
Therefore, to prevent further attacks by North Korean hackers, South Korean exchanges should allocate more resources to secure their platforms with the necessary measures.
note: Any mistake with the text that I apologize, I do not speak English very well
