Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025
Takeover of the email account of an India-based cryptocurrency gaming company’s CEO; spear phishing of over 250 individuals · early 2025
(MSMT/2025/2, report p. 32) “In early 2025, CryptoCore actors, in another effort to widely target potential victims in the cryptocurrency industry, took over the email account of an India-based cryptocurrency gaming company’s CEO. ... Over the next month, the DPRK cyber actors masqueraded as the CEO and sent spear phishing messages to over 250 individuals, some including DPRK-controlled domains for fake virtual meetings: “us05web-zoom[.]xyz” and “us05web-zoom[.]cloud.””