- Gruppe
- Leaknet
- Erfassungsdatum
- Status
- Online / unverändert
Hinweise zur Einordnung
Dieser Eintrag dokumentiert eine Veröffentlichung der Gruppe. Ein Angriff oder Datenabfluss ist damit nicht unabhängig bestätigt.
- Land: nicht verfügbar
- Branche: nicht verfügbar
Konfidenz ist eine heuristische Einschätzung. Prüfzeitpunkte beziehen sich auf die Anreicherung, nicht auf unabhängige Verifikation. Herkunft und Korrekturen finden Sie unter „Firmeninformationen & Datenherkunft“.
Angaben der Ransomware-Gruppe
UnbestätigtQuellentext als öffentliche Metadaten wiedergegeben. Die Aussagen wurden nicht unabhängig geprüft; Links sind ausgeblendet.
The North Korea affiliated hacking group, known as Sapphire Sleet, has reportedly stolen over $10 million in cryptocurrency through elaborate social engineering campaigns conducted over six months, according to Microsoft.
These schemes involve creating fake LinkedIn profiles, often impersonating recruiters or venture capitalists, to lure victims into setting up online meetings. During these meetings, the targets encounter fake errors prompting them to contact a "support team," where they're tricked into downloading malicious files. Depending on the victim's operating system, these files AppleScript (.scpt) or Visual Basic Script (.vbs) install malware that compromises the system, enabling theft of credentials and cryptocurrency wallets.
Additionally, Sapphire Sleet has posed as recruiters for prestigious financial firms like Goldman Sachs, inviting targets to complete bogus skills assessments. Victims are provided with login credentials for fake websites, where downloading the assessment file infects their devices with malware.
Microsoft has highlighted the broader operations of North Korean IT workers, who generate revenue for the regime by blending legitimate work with illicit activities. These workers often rely on intermediaries to access freelance platforms or establish online profiles. Many use advanced AI tools like Faceswap to modify stolen photos, creating professional looking resumes and LinkedIn profiles to apply for jobs under false identities. Some have even experimented with AI-powered voice-changing software.
Since 2020, Sapphire Sleet linked to groups like APT38 and BlueNoroff has employed tactics such as impersonating skills assessment platforms and using fake GitHub profiles to target victims. These operations are highly organized, with Microsoft estimating that this network of IT workers has amassed at least $370,000 in payments for their efforts.
Microsoft continues to monitor these activities as part of broader North Korean cyber operations aimed at bypassing international sanctions and funding the regime.
