Inside Lazarus: How North Korea uses AI to industrialize attacks on developers
Expel is actively tracking an APT group that we assess with high confidence to be North Korean (DPRK) state-sponsored. We suspect that the threat actor is a subgroup or spin-off of a larger organization, potentially starting out as fraudulent IT workers before pivoting to malware.
The group is extremely active in targeting Web3 developers and is primarily focused on stealing high-value digital assets such as cryptocurrency and NFTs.
As much as $12M worth of cryptocurrency wallets were exfiltrated by the threat actor in 3 months, though hardware security tokens may limit damage.
Whilst this specific group is financially motivated, many of their techniques overlap with other DPRK APTs, including those engaged in espionage.
The group makes heavy use of Generative AI, often abusing tools like Cursor and ChatGPT.
full #article: expel.com/blog/inside-lazarus-…
by #MarcusHutchins #Lazarus #NorthKorea #AI #attacks
Expel is tracking a North Korean (DPRK) state-sponsored APT group. This group is targeting Web3 developers to steal cryptocurrency and NFTs.
Marcus Hutchins (Expel)
