North Korean Hackers Establish U.S. Shell Companies

North Korea’s Lazarus Group has set up two shell companies in the U.S., Blocknovas LLC in New Mexico and Softglide LLC in New York, leading to FBI intervention.

Blocknovas LLC and Softglide LLC

Blocknovas LLC and Softglide LLC were legally registered by North Korean hackers to spread malware via fake job postings. The operation underscores a sophisticated escalation in tactics. Members of the notorious Lazarus Group have been linked to setting up these entities in the U.S., using AI-generated identities to mask their operations. These entities are utilized for distributing malware, furthering their cyber objectives.

This is a rare example of North Korean hackers actually managing to set up legal corporate entities in the U.S. – Kasey Best, Director of Threat Intelligence, Silent Push

Authorities, including the FBI, have seized Blocknovas.com’s domain, signaling the severity of these activities. The U.S. business system saw an intricate penetration by state-sponsored entities, though no immediate systemic risk to DeFi or major price impact in significant cryptocurrencies like ETH or BTC was observed.

The repercussions of these shell companies are profound, affecting targeted developers. Malware strains such as BeaverTail and InvisibleFerret spread via fake interview assignments, bolstering concerns across developer platforms. Traders have largely not seen dramatic shifts in major crypto prices, but the threat of cybersecurity vulnerabilities remains high.

Historically, the Lazarus Group’s activities have led to price drops in affected projects, stressing the importance of robust security measures against further penetrations. Developer vigilance against such tactics is crucial, with communities on platforms like GitHub responding with increased security protocols.