Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025
CryptoCore fake-recruiter campaign contacting over 1,200 cryptocurrency company employees (Slack skill assessment tests) · Throughout 2024
(MSMT/2025/2, report p. 32) “Throughout 2024, CryptoCore actors, posing as recruiters and human resource managers, contacted over 1,200 employees of cryptocurrency companies in over a dozen countries. After inviting prospective victims to a Slack online messaging channel, the DPRK cyber actors sent skill assessment tests through which targets inadvertently ran malware hidden within the test code. Employees of M2 Exchange (based in UAE), Ripio (based in Cayman Islands), and Alex Lab (based in Singapore) were among the compromised victims, leading to major cryptocurrency losses at all three companies.”