A cybersecurity expert reveals North Korean hackers targeted 1,640 organizations worldwide, compromising systems and seeking cryptocurrency.
A recent investigation by Greek cybersecurity expert Vangelis Stikas has revealed that North Korean hackers have targeted 1,640 organizations across 57 countries over the last 22 months. The findings, shared with WIRED, indicate that these cyberattacks have led to serious breaches in 700 to 800 instances.
Among the organizations believed to be affected are Coinbase, Uniswap Labs, Boston Children’s Hospital, Japan's AEON Smart Technology, and several others. While some companies have acknowledged isolated incidents, both Coinbase and Boston Children’s Hospital have confirmed that their internal systems remain secure.
Access to Hackers' Infrastructure
Stikas, who is also the Chief Technology Officer and co-founder of Kumio, managed to gain access to several command-and-control servers used by the hackers, which allowed him to analyze approximately 5 TB of data. He discovered potential victims through developer keys and other digital traces, subsequently notifying these organizations about possible security breaches.
“This is access to companies, root access to servers and AWS. For crypto companies, it means keys and access to blockchain infrastructure,” Stikas remarked.
Limited Confirmation from Targets
The Japanese Computer Security Incident Response Team confirmed Stikas's findings regarding AEON Smart Technology and assisted in addressing the aftermath of the attack. Meanwhile, the Flemish government acted upon Stikas's alert, isolating an affected workstation and revoking exposed credentials.
Boston Children’s Hospital clarified that the incident involved a personal device of a former contractor, stating that their internal systems were not compromised. Coinbase also reported detecting unusual activity tied to a contractor, although they found no direct connection to North Korean operations.
Uniswap Labs, Oppo, and other organizations did not respond to requests for comment from WIRED.
Attack Methods and Targets
Stikas noted that the attackers often initiated contact through fake job offers, posing as recruiters from cryptocurrency and AI firms. Victims were tricked into running malicious software disguised as legitimate packages. The tactics have evolved, with recent attacks utilizing Visual Studio Code workflows to execute harmful code.
Microsoft has been monitoring these activities since December 2022, noting that the tools used by the hackers can collect sensitive information, including cryptocurrency wallet details and API tokens. Stikas emphasized the heightened risk posed by contractors who have access to multiple organizations' systems.
Focus on Cryptocurrency Theft
The primary aim of these cyberattacks appears to be the acquisition of cryptocurrency wallets and associated keys. Threat analyst Marcus Hutchins pointed out that while the focus remains on digital assets, access could also be leveraged for espionage or data theft.
In March, the U.S. Treasury sanctioned several individuals and entities linked to North Korean IT workers involved in such schemes, which reportedly generated nearly $800 million for the regime in 2024. Furthermore, researchers have identified a new trojan named PylangGhost, which North Korean hackers are using to target cryptocurrency professionals through deceptive job interviews.
Despite these allegations, the North Korean Foreign Ministry has dismissed claims of involvement in cryptocurrency theft as "absurd slander."
