The revelations were highlighted during the recent Cyberwarcon cybersecurity conference, where researchers unveiled details about two hacker groups linked to the North Korean regime, dubbed Sapphire Sleet and Ruby Sleet.

Sapphire Sleet deceives job seekers with false recruitment schemes. Posing as recruiters from reputable companies, they entice victims into interviews and job offers, during which they install malware disguised as PDF documents or harmful URLs. These malicious payloads infect the victim’s computer systems, granting hackers illegal access to sensitive data.

Meanwhile, Ruby Sleet has infiltrated aerospace and defense contractors in the United States, United Kingdom, and South Korea. Their objective is the theft of military intelligence and proprietary technologies, posing significant threats to national security.

Persistent Targeting of Cryptocurrency Companies

Beyond the IT and defense sectors, North Korean hackers have repeatedly targeted the Bitcoin business, employing similar social engineering techniques. The Federal Bureau of Investigation (FBI) issued warnings in September about spyware disguised as job offers. Victims who downloaded these malicious files risked losing important data, such as private keys to their cryptocurrency wallets.

In August, blockchain investigator ZackXBT identified 21 suspected North Korean developers working covertly on crypto projects using fabricated identities. The hackers exploited these roles to embed vulnerabilities or steal assets.

In October, suspicions about the Liquid Staking Module (LSM) brought the Cosmos blockchain ecosystem to the forefront of cybersecurity worries. According to reports, North Korean developers helped create the module, raising concerns about possible backdoors or harmful programming. Jacob Gadikian, a Cosmos ecosystem developer, referred to these hackers as “the world’s most skilled and prolific crypto thieves.” These concerns prompted extensive security audits to safeguard the module’s integrity.

Thefts of Crypto assets in November 2024. Source: BecauseBitcoin

North Korea’s cyberattacks are part of a bigger attempt to get over international restrictions and fund state operations. The Lazarus Group, North Korea’s most prominent hacker gang, has been tied to a number of high-profile cryptocurrency heists, collecting billions of dollars in stolen assets over time.

Social engineering has become a cornerstone of these operations, allowing hackers to exploit human trust to gain entry into secure systems. According to cybersecurity experts, North Korean hackers are continuously refining their tactics to remain steps ahead of detection systems.

The Growing Threat Landscape

The increased sophistication of North Korean cyberattacks has frightened cybersecurity professionals and law enforcement authorities throughout the world. The regime’s deployment of modern technology, including AI-generated identities and voice-modifying tools, demonstrates its commitment to cyber warfare as a crucial strategy.

Addressing these concerns necessitates a worldwide response. Companies are recommended to install strict cybersecurity safeguards, conduct frequent audits, and educate personnel on how to identify social engineering techniques. Governments and private entities must work together more closely to combat the rising wave of North Korean cybercrime.

As cybersecurity firm ESET highlighted, “The combination of state-backed resources and advanced technology makes North Korean hackers among the most dangerous adversaries in the digital landscape today.”