TraderTraitor’s Tradecraft: North Korean Crypto Theft Through Social Engineering and Supply-Chain Attacks
Summary
Wiz examines TraderTraitor, a North Korean-linked cluster attributed to major crypto thefts, and details its use of social engineering, trojanized software, supply-chain compromises and cloud access to steal digital assets.
Key points
- The article describes TraderTraitor as financially motivated North Korean activity linked by authorities and researchers to Lazarus and associated groups.
- Earlier campaigns used fake job offers and trojanized cryptocurrency applications to deliver malware such as MANUSCRYPT, which could collect system information and execute commands.
- In 2023, operators used malicious npm packages and GitHub collaborations to target developers; GitHub suspended accounts and repositories associated with the campaign.
- In the JumpCloud compromise, attackers abused the provider’s privileged access to push a malicious update to fewer than five cryptocurrency-industry customers, according to JumpCloud.
- In the DMM Bitcoin theft, authorities attributed the diversion of 4,502.9 BTC, valued at about $308 million, to TraderTraitor; the article describes stolen credentials and session cookies as part of the access path.
- The article says the Bybit theft involved compromised developer access, stolen AWS session tokens, cloud reconnaissance and malicious JavaScript that altered transactions through Safe{Wallet}’s frontend; the FBI attributed the operation to TraderTraitor.
- Wiz recommends limiting developer privileges, segmenting identities and networks, monitoring cloud credentials and configurations, and checking dependencies for suspicious packages.
Article Details
- Attack Vectors
- Phishing and social engineering using fake recruiter messages, job offers, coding challenges, and malicious links or attachments.
- Trojanized cryptocurrency applications and malicious Python scripts used to execute malware on developer workstations.
- Malicious JavaScript packages distributed through npm and other open-source supply-chain lures involving GitHub repositories.
- Compromise of JumpCloud followed by abuse of its privileged access to push a malicious update to downstream customers.
- Stolen session cookies and AWS session tokens used to access internal and cloud environments.
- Malicious Docker image and cloud reconnaissance followed by JavaScript injection into Safe{Wallet}'s frontend to redirect cryptocurrency transactions.
- Defensive Notes
- Apply network and identity segmentation to limit lateral movement to privileged identities and sensitive resources.
- Use least-privilege permissions for developers, especially in production and CI/CD environments.
- Monitor cloud configurations and secrets, including AWS credentials and SSH keys, for anomalies or exposure.
- Track code dependencies and investigate suspicious packages and the cloud resources they may affect.
- Monitor for cloud asset enumeration, compromised cloud keys, suspicious MFA device registration, and connections to campaign-associated IP addresses.
- Investigate malware matching campaign indicators in the environment.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | getstockprice[.]com | Attacker-registered domain used as a command-and-control endpoint in the Bybit operation. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe second-stage payload delivered by the malicious applications was encrypted with AES-256.T1059.006 · PythonA Ginco developer was lured into running a malicious Python script from a fake coding challenge.T1059.007 · JavaScriptTraderTraitor applications used JavaScript and Node.js to execute malicious code.T1082 · System Information DiscoveryMANUSCRYPT collected system information from infected machines.T1105 · Ingress Tool TransferTraderTraitor applications retrieved encrypted second-stage payloads from hardcoded C2 URLs.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious JavaScript packages from npm were introduced through GitHub-based developer collaboration lures.T1195.002 · Compromise Software Supply ChainThe JumpCloud compromise was used to push a malicious update to downstream cryptocurrency-industry customers.T1204.002 · Malicious FileVictims were lured into running trojanized cryptocurrency applications or malicious scripts.T1550.004 · Web Session CookieStolen session cookies were used to access Ginco's internal systems and pivot toward DMM Bitcoin.T1552.004 · Private KeysRN Stealer harvested SSH keys, saved credentials, and cloud configurations from files.T1553.002 · Code SigningSome malicious applications were signed with compromised or fraudulent Apple code-signing certificates to appear trustworthy.T1566.001 · Spearphishing AttachmentFake job-offer PDF attachments were used to deliver malware, including in the Ronin Network incident.T1566.003 · Spearphishing via ServiceTraderTraitor sent recruiter-themed phishing messages through services including LinkedIn, Slack, and Telegram.T1578.005 · Modify Cloud Compute ConfigurationsThe attacker tampered with Safe{Wallet}'s statically hosted frontend by injecting JavaScript that altered Bybit transactions.T1580 · Cloud Infrastructure DiscoveryDuring the Bybit operation, the attacker enumerated IAM roles, S3 buckets, and other cloud assets.
Threat Actors
APT38Named in the 2022 joint advisory as a tracking name for entities behind TraderTraitor activity.BlueNoroffNamed in the 2022 joint advisory as a tracking name for entities behind TraderTraitor activity.Jade SleetNorth Korean cyber activity cluster attributed to cryptocurrency thefts and supply-chain compromises.Lazarus GroupThe article identifies TraderTraitor as a subgroup or operation under the Lazarus umbrella.
Malware
AGAMEMNONMalware AGAMEMNON Backdoor used in updated TraderTraitor campaigns.AppleJeusthrough 2020–2022, successfully breached multiple organizations. For instance, Lazarus used similar AppleJeus malware-laced apps in earlier operations to infiltrate crypto exchanges. By mid-2022, TraderTraitor’sGolangGhostMalware GolangGhost Go-based cross-platform RAT used in ClickFix campaign.GopherGrabberMalware GopherGrabber Go-based stealer/backdoor with credential theft and C2 via RC4/MD5.MANUSCRYPTdecrypt and execute on the victim’s machine. In this way, TraderTraitor apps delivered malware such as MANUSCRYPT (a remote access trojan) onto victims’ systems. MANUSCRYPT would then harvest system info [T1082],RN Loaderscript from a fake coding challenge hosted on GitHub [T1059.006,T1204.002]. The malware, identified as RN Loader and RN Stealer, harvested sensitive data including SSH keys, saved credentials, and cloud configurationsRN Stealerfake coding challenge hosted on GitHub [T1059.006,T1204.002]. The malware, identified as RN Loader and RN Stealer, harvested sensitive data including SSH keys, saved credentials, and cloud configurations [T1552.004].SIGNBTMalware SIGNBT Lazarus malware family reused in updated TraderTraitor operations.ThreatNeedleMalware ThreatNeedle Lazarus RAT used in espionage, reused by TraderTraitor in South Korea.wAgentMalware wAgent Known Lazarus backdoor reused in TraderTraitor activity.
Vendors
Products
AWSa malicious docker image [T1609] and contacted the attacker’s domain. The attacker then used stolen AWS session tokens to access Safe{Wallet}’s cloud environment and attempted to register a virtual MFA device toElectroncontain malicious payloads. These malicious apps – built on JavaScript [T1059.007] and Node.js using the Electron framework – are referred to collectively as "TraderTraitor" apps by U.S. authorities.Next.jsmoved to active C2 communication and tampered with Safe{Wallet}’s statically hosted frontend (built with Next.js) by injecting malicious JavaScript [T1578.005]. This payload was designed to detect Bybit transactionsSafe{Wallet}and contacted the attacker’s domain. The attacker then used stolen AWS session tokens to access Safe{Wallet}’s cloud environment and attempted to register a virtual MFA device to maintain persistence. Throughout
Tools
GitHubactors impersonated software developers and engaged targeted engineers in collaborative projects on GitHub. After establishing trust (often via LinkedIn or other social contact), the TraderTraitor operatorsnpmfocus on blockchain targets and its use of supply chain attacks using trojanized open-source packages (npm, PyPI) differentiates them from other Lazarus sub-groups. PyPIon blockchain targets and its use of supply chain attacks using trojanized open-source packages (npm, PyPI) differentiates them from other Lazarus sub-groups.
Countries
Japancryptocurrency thefts to TraderTraitor, while underscoring its Lazarus lineage. For example, the FBI and Japan’s NPA attributed a $308 million Bitcoin DMM exchange heist (May 2024) to TraderTraitor, calling it aNorth Koreaare tracked as Lazarus Group, APT38, BlueNoroff, and Stardust Chollima. These names refer to North Korea’s elite hacking units, and the TraderTraitor activity appears to be part of their financially-motivated
Industries
Blockchainand generate revenue to fund state programs. The TraderTraitor campaigns specifically target blockchain and cryptocurrency organizations – such as exchanges, DeFi platforms, crypto startups, venture funds,CryptocurrencySince its first public mention in 2022, TraderTraitor has been linked to major cryptocurrency thefts and has targeted cloud services and software development platforms in operations like the JumpCloud supply chainfintechThis operation primarily targeted developers working at blockchain and fintech firms. By compromising a developer’s machine or injecting code into a project, the attackers aimed to infiltrate the victim company’s