LinkedIn Becomes Cybercrime Playground for Lazarus Hackers

• Lazarus hackers exploit LinkedIn to impersonate recruiters, targeting crypto professionals for phishing attacks.
• Their phishing scheme involves sending malware-laden coding challenges to gain remote access to victims’ systems.
• Lazarus’ cybercrime funds North Korea’s WMD programs, underscoring the geopolitical implications of their attacks.

A recent finding by blockchain security firm SlowMist has revealed a concerning pattern in cybercrime strategies, involving the Lazarus hacker group from North Korea. They’re utilizing LinkedIn for phishing attacks within the cryptocurrency sector. By impersonating recruiters and investors, Lazarus hackers employ clever tactics to deceive workers into downloading harmful software, enabling them to pilfer valuable information and assets.

SlowMist’s inquiry revealed that Lazarus hackers, known for their cyberattacks since 2009, have been pretending to be Fenbushi Capital partners on LinkedIn to attract cryptocurrency industry professionals. Once connected, the hackers would offer fake job or investment opportunities to gain access to victims’ systems.

Their phishing strategy included sending coding challenges as part of the hiring process. These seemingly harmless files actually contained malware that, upon execution, would install a Trojan allowing remote access to the victim’s computer. This method enabled Lazarus hackers to steal confidential information and assets from unsuspecting victims.

Furthermore, Lazarus has used LinkedIn in the past for focused assaults. They pretended to be a fake Meta recruiter in December 2023 in order to approach professionals in the cryptocurrency sector. These incidents reiterate the need for improved cybersecurity measures in the sector and show how sophisticated fraudsters are becoming.

The actions of Lazarus have sparked concerns among international security councils due to their ties to North Korea’s weapons of mass destruction (WMD) programs. According to a report by a U.N. panel of experts, roughly 40% of North Korea’s WMD funding originates from illicit cyber activities, including stolen cryptocurrency.

Despite being targeted by sanctions, Lazarus has continued its malicious activities, with estimates suggesting they have stolen over $3 billion in crypto assets. In a notable attack in August 2023, the group used fake job interviews to steal $37 million from crypto payment firm CoinPaid, highlighting the significant financial impact of their operations.