They are no longer content with theft: they are recruiting, organizing, penetrating, and building networks. GitHub, Upwork, Freelancer - all platforms have been turned into hunting grounds.
North Korean hackers have already extracted millions in bitcoin and ether, becoming one of the biggest nightmares for the crypto community. Hunted and cursed, they nevertheless continue to evade every security net.
And they are no longer content with theft: they are recruiting, organizing, penetrating, and building networks. GitHub, Upwork, Freelancer - all platforms have been turned into hunting grounds. Their goal is no longer just quick profit, but the very architecture of the decentralized economy.
When fake recruiters and artificial intelligence flood technology platforms
In 2024, Pyongyang, with more than 60 developers on crypto platforms, is moving to the next stage in its digital war. The regime's hackers are not just applying for jobs; they are creating the job postings themselves. On Upwork, Freelancer, and GitHub, they upload offers targeting developers specialized in cryptocurrency technology. Behind these seemingly innocent postings lies a well-organized plan: the candidate is asked to download a "project" from GitHub, supposedly as a technical test. The code contains malware, often of the BeaverTail type. To remain invisible, the operatives use artificial intelligence to generate faces, falsify voices, and create highly convincing official documents. This is how they fool identification systems. The appearance, the sound, every detail is optimized not to arouse suspicion. Heiner García Pérez from SEAL Intel explains that now even KYC systems are being transformed into a camouflaging tool, rather than an obstacle.
Military organization
Their success is based not only on technology but also on human manipulation. North Korean operatives target vulnerable groups: isolated freelancers, Ukrainians experiencing crisis, women seeking financial independence. The approach starts gently on forums like InterPals or AbleHere: friendly conversation, promises of income, a "small test." Then the trap begins: a demand for personal documents, installation of remote control software like AnyDesk, and taking over the freelancers' accounts. The "recruits" are turned into fronts. The division: 20% for them, 80% for the handler. Documents found in a hacker's file reveal military organization: approach scripts, onboarding procedures, and even detailed PowerPoint presentations. The fraud becomes digital subcontracting.
Ghost networks, cryptocurrencies, and AI
The system set up resembles an industrial model, according to Cointribune. Payments first pass through the platforms and then into bank accounts or crypto wallets under "proxies." The money is subsequently transferred as crypto-assets towards North Korea or its collaborators.
Artificial Intelligence enhances every stage: generated identities, activity histories, "fake" live Zoom calls. Recruits are often asked to bring in relatives or friends, creating a pyramid network that is difficult to trace. The crypto economy becomes the ideal conduit: no banks, no regulators, no borders. The platforms, unable to keep up with the pace, struggle with accounts that close and reopen under different names, different faces.
In 2024, North Korean hackers are bleeding the crypto ecosystem: $1.3 billion was illegally extracted, the highest toll to date. Their strategy is evolving. Their power is too.
www.bankingnews.gr
Σχόλια αναγνωστών