The FBI has officially linked the theft of over $6 billion in virtual assets to TraderTraitor, a North Korea-linked hacking group commonly referred to as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899 This article explores linked theft billion. . The FBI, in conjunction with the U.S. Secret Service and Internal Revenue Service Criminal Investigation, revealed they identified a threat actor converting stolen funds into Ethereum (ETH).
This includes a cross-platform implant called FLATROOF, which siphons sensitive data from the victim using a Python-based information stealer before ultimately dropping the ROOFDECK backdoor to obtain complete remote control. This activity once again highlights how North Korean threat actors continue to exploit trusted developer workflows through trojanized Terraform providers to deliver cross-platform malware across macOS, Linux, and Windows systems, and gain persistent access.
The modus operandi of TraderTraitor, similar to other North Korea-linked campaigns such as Lazarus Group's Operation Dream Job and Famous Chollima's Contagious Interview, relies on recruitment-themed lures to trick victims into running malicious code. "The actor used tailored domains, social media profiles, and industry-specific knowledge to impersonate a spoofed AI-powered blockchain intelligence company, posing as a software engineer recruiter to initiate contact and schedule interviews with individuals who engaged with the outreach.
Within a short period, Jade Sleet conducted similar job-themed targeting using two additional front companies, supported by comparable infrastructure and relevant domain knowledge."
