North Korean hackers, known as UNC4899, are suspected of a sophisticated cloud breach campaignthat targeted a crypto organization in 2025 to steal millions of dollars (in cryptocurrency). This activity is attributed with moderate confidence to the state-backed adversary, who is also tracked under the names Jade Sleet, PUKCHONG, Slow Pisces, and TraderTraitor.
“This incident is notable due to the combination of social engineering, exploitation of peer-to-peer (P2P) data transfer mechanisms from personal to corporate devices, workflows, and the eventual move to the cloud to implement living-off-the-cloud (LOTC) techniques,” the tech giant noted in its H1 2026 Cloud Threat Horizons.
How did the North Korean hackers UNC4899 operate?
After gaining access to the cloud environment, the attackers allegedly exploited legitimate DevOps workflows to harvest credentials, escape container boundaries , and tamper with Cloud SQL databases to facilitate cryptocurrency theft.
See also: Netherlands: Russian hackers breach Signal, WhatsApp accounts of officials
The attack chain, according to Google Cloud, represents a progression that began with a breach of a developer's personal device and ended up on his corporate workstation, before jumping to the cloud to make unauthorized modifications to financial logic.
It all started with the threat actors using social engineering tricks to trick the developer into downloading an archive file as part of a supposed collaboration on an open source project.
The developer then transferred the same file to his company's device via AirDrop.
“Using the AI-assisted Integrated Development Environment (IDE), the victim interacted with the file’s contents, ultimately executing the embedded malicious Python code, which created and executed a binary that pretended to be the Kubernetes command-line tool,” Google said.
The binary then contacted a domain controlled by the attacker and acted as a backdoor to the victim's company machine. The attackers then jumped into the Google Cloud environment, likely using authenticated sessions and available credentials. This step came after an initial reconnaissance aimed at gathering information about various services and projects.
The attack progressed to the next phase with the discovery of a bastion host, with the adversary policy multi-factor authentication to gain access and perform additional reconnaissance, including navigating to specific pods within the Kubernetes environment.
See also: Chrome Extensions became malicious after change of ownership
UNC4899 then adopted a living-off-the-cloud (LotC) approach to configure persistence by changing Kubernetes deployment configurations (so that a bash command is automatically executed when new pods are created). The command, in turn, downloaded a backdoor. Some of the other steps the threat actor performed include modifying Kubernetes resources connected to the victim’s CI/CD platform solution to insert commands that exposed service account tokens in the logs.
The attacker obtained a token for a highly privileged CI/CD service account, which allowed him to escalate his privileges and perform lateral movement, specifically targeting a pod that handled network policies and load balancing. The stolen service account token was used to authenticate to the sensitive infrastructure pod that was running in privileged mode, to escape the container and deploy a backdoor for persistent access.
Another reconnaissance phase was performed by the threat actor before turning its attention to a workload responsible for managing customer information, such as user identities, account security, and cryptocurrency wallet information. The attacker used this to extract static database credentials stored in the pod's environment variables.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The attackers then misused the credentials to access the production database via the Cloud SQL Auth Proxy and execute SQL commands (to make modifications to user accounts, including password resets).
The attack culminated in the use of the compromised accounts to successfully steal several million dollars in crypto.
The incident “highlights the critical risks posed by personal-to-enterprise P2P data transfer methods and other data bridges, privileged container modes, and insecure handling of secrets in the cloud,” Google said. “Organizations should adopt a defense-in-depth strategy that strongly validates identity, restricts data transfer to endpoints, and enforces strict isolation within cloud execution environments to limit the blast radius of an attack.”
See also: Velvet Tempest: Distribution of DonutLoader and CastleRAT via ClickFix techniques
Protection
To address the threat, organizations are urged to implement context-aware access and phishing-resistant MFA, ensure that only trusted images are deployed, isolate compromised nodes from establishing connectivity to external hosts, monitor for unexpected container processes, adopt strong secrets management, and enforce policies to disable or restrict peer-to-peer file sharing using AirDrop or Bluetooth.
