北朝鮮ハッカー：サイバースパイの新しい顔

by

重要な洞察：

  • 米国政府は、サイバー暗号キャンペーンに関連する2人の個人と4つのロシアの事業体を認可しました。
  • 北朝鮮のサイバー攻撃工作員は、ブルートフォースハッキングにますます好まれています。
  • 彼らは今年だけで複数のイベントで暗号スペースから盗まれた数十億人の責任を負っています。

米国は、北朝鮮が支援する新しいサイバー作戦に新たな制裁を課しました。このグループは、盗まれた暗号資金をキム・ジョン国連の核兵器プログラムに集中させるために、遠隔の求人アプリケーションを使用していると言われています。 🚀💰

現在、最新の開発は、北朝鮮のサイバー攻撃がブルートフォースのサイバー攻撃から浸透し、内部から資金を盗むようにエスカレートしていることを示しています。ここに詳細があります。

暗号ハッキングだけでなく、雇用による浸透

北朝鮮のサイバー攻撃は、これまでで最大の暗号窃盗のいくつかへの悪名高いラザログループの関与を含む、ハッキングを損なうことで過去に何度も見出しを作りました。

しかし、米国財務省およびブロックチェーン分析会社TRM Labsによる最近の調査結果によると、政権は現在、他の方法に多額の投資を行っています。これらの中で最も不穏なものの1つは、遠隔請負業者を装った高度に熟練したIT労働者の使用です。 🕵🕵嫌い

今日、財務省の外国資産管理局は、韓国民主共和国（DPRK）IT労働者スキームを可能にしている個人や団体を止めるための行動を取っています。

DPRKは、WMDおよび弾道ミサイルプログラムの大幅な収益を生み出します…

– 財務省（@UstreAsury）

These contractors are used to secure employment in US-based blockchain and crypto companies and don’t just steal data: Instead, they pose as real employees by assuming the identities of US citizens. They exploit company access, plant malware and collect salaries that are funneled back to the North Korean government.

According to reports, their work reportedly spans across sectors including business software, health and fitness apps, social networking, sports, entertainment, and crypto exchanges. 🏋️‍♂️📱🎮

Sanctions Target Individuals and Front Companies

On July 8, the US Treasury’s Office of Foreign Assets Control (OFAC) announced sanctions against two individuals and four Russian entities linked to the crypto cyber campaign.

Among those named was Song Kum Hyok, a North Korean operative and a member of the Andariel hacking group. For context, the Andariel hacking group is part of Kim Jong Un’s military intelligence wing known as the Reconnaissance General Bureau. 🕵️‍♂️💥

Song is accused of masterminding a massive identity theft campaign as far back as 2022. Then, he stole names, Social Security numbers, and other personal information from American citizens.

These stolen identities were then used to disguise North Korean IT workers as real job applicants.

The workers, once hired, would share the income with Song and other operatives. In some cases, they would even go as far as inserting malware into company systems.

Another sanctioned individual was Gayk Asatryan, a Russian national who allegedly signed a 10-year agreement with North Korean trading firms in 2024.

This afternoon the sanctioned a key North Korean cyber actor for running an IT worker scheme using fake US IDs to funnel funds to the DPRK. For more check out our blogpost here:

— TRM Labs (@trmlabs)

He formed a network under this deal. It was called the “Asatryan IT Worker Network”, and would host up to 30 North Korean IT specialists in Russia. He helped them with several tasks, including helping them secure jobs in Western tech firms.

And so far, the four sanctioned individuals tied to Asatryan are now barred from accessing any assets within the US. They also face criminal penalties for any ongoing or future transactions with US companies. 🚫💰

All To Fund Weapons of Mass Destruction

US officials believe the ultimate goal of this cyber hacking scheme that has spanned years, is to support North Korea’s weapons development. Treasury Deputy Secretary Michael Faulkender stated that thousands of North Korean IT workers, mostly stationed in Russia and China are actively targeting crypto companies in wealthier nations.

Their income, often obtained under fake identities, is funneled back to the regime to pay for its arsenal and nuclear warheads. 🚀💥

“The Kim regime is determined to evade sanctions using every digital loophole it can find,” Faulkender emphasized. “From digital asset theft to fake job applications, their tactics are evolving. We are using all available tools to disrupt these networks.”

Massive Losses in the Crypto Sector

According to TRM Labs, North Korean bad actors were responsible for $1.6 billion in theft from crypto firms during the first half of the year alone. This accounts for over three-quarters of the total $2.1 billion stolen across 75 major crypto hacks in that timeframe. 💸🔒

While exchange hacks still remain a risk, other strategies like the IT worker infiltration are becoming more and more preferred. This is due to their lower visibility and high return.

Similarly, on June 30, four North Korean nationals were charged with wire fraud and money laundering. This is after allegedly posing as remote workers at blockchain firms in the US and Serbia. 🕵️‍♂️💻💰

Earlier on June 5, the DOJ moved to seize $7.74 million in frozen crypto tied to North Korean IT workers. According to the FBI, the entire moneymaking operation could be worth hundreds of millions of dollars. This is with funds being routed to the regime across Russia, China, and even the US. 🚀💥💰

2025-07-09 15:44