A Security Pro Hacked North Korean Hackers. He Found They’d Breached Hundreds of Networks Worldwide

Key Points:

• North Korean hackers have infiltrated 1,640 companies across 57 countries over nearly two years, with around 700 to 800 organizations experiencing severe breaches involving root access to critical systems and cryptocurrency wallets.
• Researcher Vangelis Stykas gained covert access to North Korean hacker systems, uncovering extensive data and communication channels, and has disclosed incidents to affected companies, naming some that responded effectively, including Boston Children’s Hospital, AEON Smart Technology, Oppo, Coinbase, and others.
• The primary hacking tactic involves fake job offers targeting software developers, tricking them into installing malware during supposed coding tests, a method known as the Contagious Interview campaign, which has been active since at least 2022.
• Many breaches exploited compromised external contractors who had access to multiple companies, significantly expanding the scope of potential damage, while the hackers mainly focused on stealing cryptocurrency rather than other sensitive data.
• Experts warn that persistent access by North Korean hackers poses ongoing risks beyond crypto theft, including espionage, and emphasize the widespread nature of these attacks, urging companies to improve their response to breaches to prevent further harm.