Okay, so get this. You know those North Korean hackers, the Lazarus Group? The ones always trying to swipe crypto? Turns out they’ve been getting a bit creative lately. A new report from a cybersecurity firm called Silent Push says these folks set up fake companies. Like, actual registered companies. Two of them right here in the U.S.
- The Lazarus Group, a North Korean hacking entity, is using fake companies, including some registered in the U.S., to target crypto developers.
- These fake companies are used to lure developers with job offers, then infect their systems with malware to steal crypto and sensitive information.
- This tactic has been used in the past, including in the massive Axie Infinity hack, highlighting the need for caution in the crypto job market.
Imagine applying for a job, thinking you’re getting into some cool crypto gig, and bam. It’s a trap. That’s what these hackers were doing. They made three fake companies in total. Two were registered in the States – one called BlockNovas LLC in New Mexico and another, SoftGlide LLC, in New York. The third one, Angeloper Agency, wasn’t U.S.-based, but it was part of the same sneaky plan.
These weren’t just random fake names. They were fronts. A subgroup of Lazarus, apparently called Contagious Interview (a name that sounds less like hackers and more like a bad reality show), was behind it. They used these fake company names and websites – like lianxinxiao[.]com and blocknovas[.]com – to look real.
The whole point was to trick crypto developers. People who build the stuff, who might have access to important systems or wallets. They’d put out fake job listings, lure developers in for interviews, and then hit them with malware (bad software that messes up your computer or steals your info).
Think about it. You’re excited about a potential new job. You click on a link, maybe download a file they send you for a “test” or “application.” And just like that, your computer is compromised. Your crypto wallet could be at risk. Your login details for other places could be snagged. It’s a pretty low blow, really.
These hackers didn’t just make up company names. The researchers found they used fake people too. Fake names, fake addresses for the companies. And get this – they even used AI to generate fake employee profiles. Like creating digital puppets to make the fake companies seem more legit. It’s like something out of a spy movie, but way less glamorous and way more annoying for anyone trying to find an honest job.
This job interview trick isn’t new for the Lazarus Group. They’ve pulled this stunt before. It’s one of their favorite ways to get inside companies and steal money. They target crypto firms specifically because, well, that’s where the digital cash is.
Remember that massive hack on Axie Infinity back in 2021? The Ronin Bridge? That was Lazarus. And guess how they got in? A fake job offer. They tricked an employee at Sky Mavis, the company behind Axie, and ended up stealing a staggering $625 million in crypto. Just from one fake job offer. It makes you think twice about clicking on that LinkedIn message, doesn’t it?
And it wasn’t just Axie. In 2022, they hit the Horizon Bridge, which is part of the Harmony network. Same deal, similar tactics. They walked away with another $100 million from that one. These aren’t small scores. These are major heists, all starting with something as seemingly harmless as a job application.
The U.N. and other groups like Chainalysis have been tracking Lazarus for years. Their estimates say these North Korean hackers have stolen over $3 billion in cryptocurrency since 2017. Three billion. That’s a lot of digital cash. And a big chunk of that comes from these kinds of attacks – tricking people through job offers or other social engineering tricks.
Setting up fake companies, using AI for fake faces, sending malware through job interviews – it shows they’re always adapting. Always looking for new ways to get in. It’s a constant game of cat and mouse, and right now, the mouse is getting pretty sophisticated with its disguises.
It just goes to show you have to be careful out there. Especially if you’re in the crypto space. That amazing job offer that seems too good to be true? It just might be. And the person on the other end might not be looking to hire you, but to hack you.
Staying safe means being suspicious. Verifying who you’re talking to. Double-checking company details. Not downloading attachments from unknown sources, even if they look official. It’s a bit of a pain, sure, but it’s a lot less painful than losing everything you’ve worked for.
These hackers are persistent. They use whatever tools they can, whether it’s technical exploits or just plain old trickery. And setting up fake companies in the U.S. just adds another layer to their deception. It gives them a veneer of legitimacy that makes it harder to spot the scam.
So, next time you’re browsing job sites or getting contacted about an opportunity, especially in crypto, just take a deep breath. Do a little digging. See if the company is real, if the people are real. It might save you a world of trouble. Because the folks behind Contagious Interview are definitely not looking for new employees in the traditional sense.
They’re looking for targets. And they’re willing to go to some pretty elaborate lengths to find them, even setting up shop in New Mexico and New York. Who knew?
