31st May - Threat Intelligence Report · 2021-05-31
A threat group dubbed CryptoCore has stolen hundreds of millions of dollars from the US, Israel, Europe, and Japan entities over the past three years, by breaching cryptocurrency exchanges and collecting funds. Researchers have linked the campaign to the Korean state-sponsored group Lazarus.
Attributing CryptoCore Attacks Against Crypto Exchanges to LAZARUS (North Korea) · May 24, 2021
CryptoCore is an attack campaign against crypto-exchange companies that has been ongoing for three years and was discovered by ClearSky researchers. This cybercrime campaign is focused mainly on the theft of cryptocurrency wallets, and we estimate that the attackers have already made off with hundreds of millions of dollars. This campaign was also reported by additional companies and organizations, including JPCERT/CC[1], NTT Security[2] and F-SECURE[3]. The campaign is also known as CryptoMimic, Dangerous Password and Leery Turtle. In this report we attributed this campaign to a specific actor – North Korea’s LAZARUS APT Group, known also as Hidden Cobra.