Northern South Korea Launches Company in the United States for Cryptocurrency Developers, Deceiving Them into Installing Malware

Silent Push, a cybersecurity company, has reported three companies in the United States that have been targeted by North Korean-operated operations. These operations lure job applicants in the cryptocurrency development field and deceive them into installing malware, allowing malicious actors to remotely access victim’s devices or steal sensitive information.

Referred to as the Contagious Interview, Silent Push identifies three companies in the United States – Block Novas, Angeloper Agency, and SoftGlide – as the fronts for job recruitment. The malware used in these operations is categorized into three groups – BeaverTail, InvisibleFerret, and OtterCookie.

The malicious individuals create fake companies and identities to apply for jobs on various websites using stolen images. Interestingly, they use slightly altered images downloaded from the internet, possibly utilizing AI to manipulate these images. These individuals fabricate identities on platforms like LinkedIn, GitHub, and HuggingFace to establish credibility in their job applications.

It is unclear why these malicious actors are attempting to obtain information from victims. However, once they have acquired this data, they can pose a threat to both the applicants themselves and the organizations where the victims are currently employed.

Source: Silent Push

TLDR: Cybersecurity company, Silent Push, reports on North Korean-affiliated operations targeting U.S. companies by deceiving job applicants into installing malware, posing a risk to both individuals and organizations.