Russian Infrastructure Plays Crucial Role in North Korean Cybercrime Operations
Essential information
- Published
- 24/04/2025 18:01
- Modified
- 24/04/2025 18:13
- Tags
- 2025-04-24 anonymization networks beavertail blocknovas cryptocurrency frostyferret invisible ferret social engineering
- Related entities
- 45 observables, 1 intrusion sets (apt), 12 techniques (mitre), 6 others
Description
North Korean cybercrime activities heavily rely on Russian IP ranges in Khasan and Khabarovsk, utilizing extensive anonymization networks. The Void Dokkaebi group, linked to North Korea, employs fictitious companies like BlockNovas to target IT professionals through fraudulent job interviews, aiming to steal cryptocurrency and potentially engage in espionage. Their tactics involve using VPNs, proxies, and RDP connections to obscure their origins. Instruction videos suggest the involvement of less-skilled foreign conspirators. The primary focus remains cryptocurrency theft, but there's potential for expanded espionage activities and possible cooperation between North Korean and Russian entities.