North Korean hackers made a phishing attempt on users of Upbit (a cryptocurrency exchange service) in South Korea.
News reporters in Korea reported this development on May 29, 2019, detailing the issue of Upbit users’ information being stolen. The hackers sent an email claiming that Upbit users needed to submit more information to become eligible for a prize.
When users open the email containing information about fake sweepstakes, the malware is activated, giving hackers access to users' information and control of their devices for later access.
“In analyzing the attack tools and malicious codes used by the hacker groups, we saw some unique features,” said Mun Chong Hyun, head of the ESRC Center at East Security, which discovered the attack, according to CoinDesk Korea.
These characteristics specifically point to the North Korean hacker group Kim Soo-Ki, which used similarly crafted malware to attempt to compromise South Korean government services.
North Korean hackers have been active in the South Korean crypto space for several years. The Lazarus Group, for example, stole more than $571 million in a little over a year and a half between 2017 and 2018, primarily targeting South Korean cryptocurrency exchanges. During this work, the Lazarus Group received direct material support from the North Korean government.
This latest hacking attempt, however, appears to have been thwarted by the efforts of the East Security team. Mun Chong Hyun claimed that so far "we have no reports of any damage.".
This isn't the first time Upbit has been implicated in fraudulent activity. Last December, executives at both Upbit and its parent company, Dunamu, were charged with fraud after creating false records for millions of dollars worth of bogus transactions, which were created to convince potential customers that Upbit had much higher business volume than it actually did.
