North Korean hackers set up U.S. firms to target crypto developers

25/4/2025 6:26

North Korean cyber

spies created two businesses in the U.S., in violation of

Treasury sanctions, to infect developers working in the

cryptocurrency industry with malicious software, according to

cybersecurity researchers and documents reviewed by Reuters.



The companies, Blocknovas LLC and Softglide LLC were set up

in the states of New Mexico and New York using fake personas and

addresses, researchers at Silent Push, a U.S. cybersecurity

firm, told Reuters. A third business, Angeloper Agency, is

linked to the campaign, but does not appear to be registered in

the United States.



“This is a rare example of North Korean hackers actually

managing to set up legal corporate entities in the U.S. in order

to create corporate fronts used to attack unsuspecting job

applicants,” said Kasey Best, director of threat intelligence at

Silent Push.



The hackers are part of a subgroup within the Lazarus Group,

an elite team of North Korean hackers which is part of the

Reconnaissance General Bureau, Pyongyang’s main foreign

intelligence agency, Silent Push said.



The FBI declined to comment specifically on Blocknovas or

Softglide. But on Thursday an FBI seizure notice posted to the

website for Blocknovas said the domain was seized “as part of a

law enforcement action against North Korean Cyber Actors who

utilized this domain to deceive individuals with fake job

postings and distribute malware.”

Ahead of the seizure FBI officials told Reuters that the bureau

continues “to focus on imposing risks and consequences, not only

on the DPRK actors themselves, but anybody who is facilitating

their ability to conduct these schemes.”



One FBI official said North Korean cyber operations are

“perhaps one of the most advanced persistent threats” facing the

United States.



North Korea's mission to the United Nations in New York did

not immediately respond to a request for comment.

“These attacks utilize fake personas offering job interviews,

which lead to sophisticated malware deployments in order to

compromise the cryptocurrency wallets of developers, and they

also target the developers' passwords and credentials which

could be used to further attacks on legitimate businesses,” Best

said.

Silent Push was able to confirm multiple victims of the

campaign, “specifically via Blocknovas, which is by far the most

active of the three front companies,” the researchers said in a

report shared with Reuters ahead of publication.







SANCTIONS



Reuters reviewed registration documents for Blocknovas and

Softglide filed in New Mexico and New York, respectively.

Reuters was unable to locate the persons named in the

registration documents.

Blocknovas' registration listed a physical address in

Warrenville, South Carolina, that appears on Google Maps to be

an empty lot. Softglide appears to have been registered by a

small tax office in Buffalo, New York.



The activity represents the continuing evolution in the

sprawling North Korean efforts to target the cryptocurrency

sectors in a bid to raise cash for the North Korean government.

In addition to stealing foreign currency via hacks, North Korea

has dispatched thousands of IT workers overseas to bring in

millions to finance Pyongyang's nuclear missile programme,

according to the United States, South Korea and the United

Nations.

The presence of a North Korean-controlled company, registered by

the RGB, in the United States is a violation of Office of

Foreign Assets Control sanctions. OFAC is part of the Treasury

Department. It also violates United Nations sanctions that

prohibit North Korean commercial activity designed to assist the

isolated country’s government or military.

The New York Department of State told Reuters it does not

comment on companies registered in the state. The New Mexico

secretary of state’s office told Reuters in an email on Thursday

that the company was registered in the state's online Domestic

LLC system. "The filing was in compliance with state statute,

using a registered agent, and there would be no way our office

would know its connection to North Korea," an office

representative said.



The hackers sought to infect applicants for fake jobs with

at least three strains of known malware previously linked to

North Korean cyber operations. The malware linked to the

campaign by Silent Push can be used to steal information,

facilitate access to networks and load additional forms of

malware.