Inside Lazarus: How North Korea uses AI to industrialize attacks on developers

This research was also highlighted in WIRED. You can read the full article from Andy Greenberg and Matt Burgess here.

TL;DR

Expel is actively tracking an APT group that we assess with high confidence to be North Korean (DPRK) state-sponsored. We suspect that the threat actor is a subgroup or spin-off of a larger organization, potentially starting out as fraudulent IT workers before pivoting to malware.

The group is extremely active in targeting Web3 developers and is primarily focused on stealing high-value digital assets such as cryptocurrency and NFTs.

As much as $12M worth of cryptocurrency wallets were exfiltrated by th…