- North Korean Lazarus Group registered US shell companies Blocknovas LLC and Softglide LLC using false identities to target crypto developers with malware.
- This marks a rare instance of North Korean hackers legally registering US firms to launch cyberattacks, successfully compromising multiple victims.
- The registration by the RGB, which manages North Korea’s cyber warfare, violates US and UN sanctions aimed at restricting Pyongyang’s financial activities.
Lazarus, North Korea’s notorious hacker group, has spread its tentacles once again. According to Reuters, the group has set up two shell companies, Blocknovas LLC and Softglide LLC, in New Mexico and New York using false identities. They also opened a third business, called Angeloper Agency, which does not appear to be registered in the United States.
By posing as recruiters, the duo target job applicants, especially crypto developers, and spread malware into their software. Cybersecurity firm Silent Push called it a rare case of North Korean hackers legally registering U.S. firms to launch cyberattacks, successfully compromising multiple victims.
The Lazarus Group is a part of the Reconnaissance General Bureau (RGB), which belongs to the Korean People’s Army (KPA). The RGB oversees all North Korean cyber warfare, including the hacks in the cryptocurrency industry. Besides Lazarus, RGB has other threat actors like AppleJeus, APT38, DangerousPassword, and TraderTraitor.
Such activity shows the technical evolution of North Korean efforts in targeting the cryptocurrency sectors and funding the North Korean government. Besides stealing foreign currency via hacks, North Korea has reportedly dispatched thousands of IT workers abroad to bring in millions to finance Pyongyang’s nuclear missile programme, according to the United States, South Korea, and the United Nations.
Lazarus Exploiting Registration Loopholes for Illicit Activity
However, the presence of a North Korean-controlled company, registered by the RGB, in the United States is a gross violation of Office of Foreign Assets Control sanctions. It also violates United Nations sanctions that ban North Korean commercial activity designed to assist the isolated country’s government or military.
It shows how the current system allows for the easy formation of LLCs at the state level with minimal scrutiny of the true owners and their potential links to problematic foreign actors. This could easily be exploited for illicit activities, sanctions evasion, or other purposes detrimental to national security.
The FBI, on its part, has formed a separate unit to track and prevent these intrusions and has been conducting victim notifications for years now. Security experts like Samczsun, part of the SEAL 911 emergency response team, have actively worked with federal agents to identify and protect potential DPRK targets.