North Korean hackers may be laundering cryptocurrency via cloud mining services, according to a report released today.
Google-owned cybersecurity firm Mandiant said on Tuesday that a Pyongyang-baed hacking group known as APT43 “steals and launders enough cryptocurrency to buy operational infrastructure in a manner aligned with North Korea’s juche state ideology.”
Juche is the state ideology of North Korea and the official ideology of the Workers’ Party of Korea, attributed to founder Kim Il-sung.
Mandiant added that APT43—also known as Kimuski—likely makes use of hash rental and cloud mining services to wash the stolen cryptocurrency “clean.”
Cloud mining services allow users to rent a computer system owned by someone else and use that computer’s hash power to mine cryptocurrencies. This saves miners from having to buy and set up their own local mining rigs.
Tornado Cash Contributor Builds New Privacy Tool—And Hopes It Won’t Trigger the Feds
U.S. authorities last year controversially banned citizens from using the “coin mixer” Tornado Cash. But Ethereum developers have been working hard on a solution they hope Feds will stay away from: Privacy Pools. A demo to be released tomorrow of the new coin mixing app lets people send and receive Ethereum, the second-biggest cryptocurrency, anonymously. Though this time round, there’s a feature that proves the user is not a North Korean bad actor or some other type of criminal. The U.S. Trea...
Even as APT43 benefits from crypto infrastructure, “APT43 has targeted cryptocurrency and cryptocurrency-related services,” the report said, adding that it uses profits to fund its operations.
Mandiant said it has been observing APT43 since 2018. It is a “moderately-sophisticated” group of hackers working to support North Korea’s regime by “collecting strategic intelligence.”
North Korean hackers have long been operating in the crypto sphere—hacking protocols, stealing digital assets, or using special apps to hide criminal trails. They’ve stolen at least $1.2 billion over the last five years, some of it by pretending to be venture capital firms and investors that back crypto startups.
In a widely publicized move last year, the U.S. Treasury Department sanctioned “coin mixer” app Tornado Cash because North Korean hackers were using it to launder funds.
Edward Snowden Talks Tornado Cash Sanctions, Ethereum Merge, DAOs and NFTs at Camp Decrypt 2022
In an extensive talk with Decrypt's Dan Roberts at Camp Decrypt in Napa CA in October, Edward Snowden gave his candid views on the Ethereum merge, the sanctioning of Ethereum mixer Tornado Cash by the U.S. government, the privacy shortcomings of Bitcoin and Ethereum, and his view on using DAOs to source tips from whistleblowers.
State-sponsored Lazarus Group used Tornado Cash to launder over $96 million after it hacked blockchain protocol Harmony Bridge, blockchain analysts said.
