“The North Korean Hacker Group of Tradertraitor used Frilalens Vacancy to access the IT companies and the kidnapping of cryptoactives. This is evidenced by Google Cloud and Wiz reports. A group of malefactors, also known as UNC4899, broke at least two unnamed companies from July 2024 to January 2025. Hackers gave themselves for the candidates for Frilalens and through social networks convinced […]”, – WRITE: Businessua.com.ua
The North Korean Hacker Group of Tradertraitor used Frilalens Vacancy to access the IT companies and the kidnapping of cryptoactives. This is evidenced by Google Cloud and Wiz reports.
A group of malefactors, also known as UNC4899, broke at least two unnamed companies from July 2024 to January 2025. The hackers issued themselves for candidates for freelancing and through social networks convinced the employees of targeted organizations to launch harmful software on working computers.
In this way, the attackers were accessed to the Google Cloud and Amazon Web Services and identified hosts that processed cryptocurrency.
As a result, cryptocurrency was stolen on a few million dollars.
Google noted that attacks under the guise of employment have become widespread among the hackers from the DPRK.
“They often develop themselves as recruiters, journalists, sectoral experts or college teachers when they are in touch with potential victims,” experts said.
The attackers are used to create convincing letters and write scripts. Attacks on cloud systems make it possible to cover a wide range of targets and increase potential profit.
According to WIZ, the TRADERTRAITOR campaign began in 2020. The Lazarus Group, APT38, Bluenoroff and Stardust Collima units are vulnerable. In the first two years, hackers managed to break a number of organizations, including Sidchin Ronin Network of Axie Infinity Games of $ 620 million.
In 2024, the activity of the group increased due to the distribution of fake summary candidates for work in bitcoin papers. Tradertraitor is considered to be involved in the fracture of the Japanese Exchange of the DMM Bitcoin at $ 305 million and attacks on Bybit with potential losses of $ 1.5 billion.
According to TRM Labs estimates, in the first half of 2025, the DPRK of the group stole $ 1.6 billion, which is 70% of the total losses in the industry.
Recall that cybercriminals accelerated the pace of laundering of stolen assets – a record rate of transfer was 4 seconds.
The gun
Please wait …