Researcher Exposes 1,640 Companies Hit by N. Korean Hackers

A significant global cyber threat has been revealed by security researcher Vangelis Stykas, who has spent 22 months inside North Korean hacking networks. His findings indicate that 1,640 companies across 57 countries have been infiltrated, with 700 to 800 experiencing severe breaches, including root access to servers and cloud services. The hackers primarily target cryptocurrency companies by luring software developers with lucrative fake job offers, a tactic part of the broader 'Contagious Interview' campaign since at least 2022. Successful recruits are tricked into downloading malware disguised as coding tests.

These operations have successfully pilfered billions in cryptocurrency, funding North Korea's regime and weapons programs. Among the disclosed victims are Boston Children's Hospital, AEON Smart Technology in Japan, Oppo, Coinbase, Uniswap Labs, Italy's Supreme Judicial Council, a subsidiary of Al Rajhi Bank, and Belgium's Flemish Government. While some organizations confirmed the incidents and remediation efforts, others, like Boston Children's Hospital, stated the breaches involved contractors' personal devices or publicly available data. Coinbase reported terminating a contractor due to security risks before receiving the researcher's notification.

The hackers' strategy often involves exploiting compromised external contractors who hold significant system access. Stykas noted instances where single contractors had access to up to 30 companies. Despite the potential for broader espionage, the primary focus remains on cryptocurrency theft. The fluidity and adaptive nature of North Korea's cyber operations, employing thousands of IT workers and hundreds of skilled operators, enable them to consistently pursue revenue and sanctions evasion.