Multilateral Sanctions Monitoring Team (MSMT) report, 22 Oct 2025
Impersonation of Crypto.com with malicious job-description PDFs · February 2024
(MSMT/2025/2, report p. 98 (Annex 2)) Annex 2 (DPRK Spear Phishing Examples), TraderTraitor Example: “In February 2024, DPRK actors associated with TraderTraitor impersonated representatives of Crypto.com, a popular US-based cryptocurrency company, and distributed emails with malicious PDF files attached. The PDF files purported to contain a software developer job description and a test to assess candidates’ qualifications. ... The files were labeled “Senior Frontend Developer JobS Description.pdf” and “Question Sheet_Frontend (1).pdf.””