North Korean Hackers Steal $10.7M via Fake Job Interviews
30,000 devices compromised in global crypto wallet theft campaign
1Global crypto heist operation
North Korean hackers compromised 30,000 devices across 100+ countries, stealing from 7,000 crypto wallets totaling $10.71 million. The campaign specifically targets web designers, blockchain specialists, and IT professionals. Cybersecurity agencies from Japan, the U.S., Australia, and Germany jointly issued the alert about this operation tracked under multiple codenames including DEV#POPPER and Gwisin Gang.
2Fake recruitment tactics
Hackers pose as recruiters on LinkedIn, offering lucrative jobs to developers. After establishing contact, they send coding tests that deploy malware like BeaverTail and InvisibleFerret. The multi-stage infection provides backdoor access for data theft and persistent network control. Palo Alto Networks first exposed this campaign called Contagious Interview in 2022.
3North Korean IT worker scheme
Hackers operate under North Korea's 313 General Bureau, using IT workers (codenamed PurpleDelta) to generate foreign currency. These workers create fake identities to infiltrate Western companies. A Japanese laptop farm used in operations was recently dismantled. The scheme adapts North Korea's historical practice of sending workers abroad for currency earnings.
4Proxy hiring scam
Hackers recruit U.S. and EU citizens via Discord to act as proxies in job interviews, offering $3,000-$5,000 per placement. Proxies handle communications while hackers complete technical tasks remotely. This bypasses sanctions and identity checks, with profits split 65% to North Korean operatives. Fake job ads use AI to create convincing identities.
5Malware arsenal
The campaign deploys 10+ malware families including GolangGhost and RATatouille. These tools enable remote access, credential theft, and lateral movement in corporate networks. Stolen identities allow North Korean IT workers to impersonate victims. The operation also uses VPN services like Astrill to mask locations in target countries.
6Corporate espionage risk
Compromised developer credentials enable hackers to infiltrate their employers' systems for intellectual property theft. The operation has targeted Japanese crypto exchanges specifically. Kudelski Security found the U.S. and Japan are primary targets, with hackers using Mullvad VPN for local exit nodes.
7AI-powered threats
Attackers increasingly use AI to create fake identities and craft convincing job ads. Security teams lack visibility into AI agent access within systems. The operation demonstrates how AI can accelerate reconnaissance and identity compromise at scale, outpacing current defense capabilities.
8Security implications
This campaign highlights advanced persistent threats from nation-state actors using social engineering. Developers should verify recruiter identities and avoid executing untrusted code. Organizations need stricter vetting of remote workers and better monitoring of AI system access. The operation continues evolving with new tactics.
Original article: The Hacker News — North Korean Hackers Steal $10.7M via Fake Job Interviews