SlowMist: Investigation of North Korean APT’s Large-Scale Phishing Attack on NFT Users · 2022-09
SlowMist: Investigation of North Korean APT’s Large-Scale Phishing Attack on NFT Users
https://slowmist.medium.com/slowmist-our-in-depth-investigation-of-north-korean-apts-large-scale-phishing-attack-on-nft-users-362117600519
Targeting of non-fungible token (NFT) owners · Dec 2022
Lazarus Group targeted the owners of non-fungible tokens in a phishing campaign. The phishing sites allowed Lazarus to drain victims’ accounts of both NFTs and cryptocurrencies.
Phishing attacks on NFT users · December
Annex 76: List of DPRK cyberthreat actors' malicious activities in 2022 monitored by the Panel. RGB Unit: Lazarus Group; Case Name: Phishing attacks on NFT users; SPH √; VAS √; VAS Value: N/A; Publicized Month: December. (SPH Significant Phishing, KAC knowledge acquisition and espionage, VAS virtual asset seizures)
Crypto users · 23/12/2022
Researchers from SlowMist reveal that the North Korean Lazarus Group set up hundreds of phishing websites, impersonating popular non-fungible token (NFT) platforms and decentralized finance (DeFi) marketplaces. [Date Occurred: SInce at least early September 2022; Date Discovered: Early September 2022]
Nearly 500 phishing domains targeting NFT investors
Para 169: “The deployment of nearly 500 phishing domains, most notably websites disguised as legitimate NFT-affiliated projects and platforms, has been attributed to the Lazarus Group by a cybersecurity firm. Aimed at defrauding NFT investors directly through NFT transfers, the perpetrators also obtained data that could lead directly to their victims’ crypto wallets.” (footnote 158: SlowMist)