DEV-0139 targeted attacks against the cryptocurrency industry via Telegram chat groups

Date (as written): 2022-12-06T17:00:00+00:00 (published_time)
Year: 2022
Actors (as written): DEV-0139 (now Citrine Sleet)
Actor pages: DEV-0139
Tags (as written): sectors: cryptocurrency investment companies; financial

Source entries (2)

Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025

Telegram group impersonating OKX employees; weaponized Excel file · 2022

(MSMT/2025/2, report p. 33) “In a 2022 compromise, according to Microsoft, Citrine Sleet threat actors similarly sought out cryptocurrency industry employees on Telegram. They created a telegram group and invited three employees, two of which were fake user profiles based on real identities of employees at cryptocurrency exchange OKX. ... before ultimately sending a weaponized Excel file that deployed malware.”

https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/pdfs/2025-10-22_MSMT-Report.pdf

Microsoft Threat Intelligence (Microsoft Security Blog)

DEV-0139 targeted attacks against the cryptocurrency industry via Telegram chat groups · 2022-12-06T17:00:00+00:00 (published_time)

DEV-0139 is now tracked as Citrine Sleet. ... Microsoft recently investigated an attack where the threat actor, tracked as DEV-0139, took advantage of Telegram chat groups to target cryptocurrency investment companies. ... in October 2022 invited the target to a different chat group and pretended to ask for feedback on the fee structure used by cryptocurrency exchange platforms.

https://www.microsoft.com/en-us/security/blog/2022/12/06/dev-0139-launches-targeted-attacks-against-the-cryptocurrency-industry/

Suggest a correction on GitHub