25 April 2023

US sanctions North Korean, Chinese nationals linked to Lazarus APT


US sanctions North Korean, Chinese nationals linked to Lazarus APT

The US authorities have imposed sanctions on several people said to have been involved in laundering cryptocurrency stolen by North Korean government hackers to support Kim's regime.

“The DPRK [the Democratic People’s Republic of Korea] launders stolen virtual currency and deploys information technology (IT) workers to fraudulently obtain employment to generate revenue in virtual currency to support the regime and its unlawful weapons of mass destruction and ballistic missile programs,” the US Treasury said in a statement.

The Treasury alleges that China-based trader Wu Huihui facilitated the conversion of virtual currency stolen by North Korea's Lazarus Group, a cybercrime syndicate responsible for a series of high-profile cyberattacks on financial, manufacturing, healthcare, publishing, media, entertainment, and international shipping companies, as well as government and military and critical infrastructure. Previously, the US authorities blamed Lazarus for the $600 Axie Infinity theft and the $100M Harmony hack.

The Hong Kong-based trader, Cheng Hung Man, worked with Wu to remit payments in exchange for virtual currency. Cheng used front companies to enable DPRK threat actors to bypass countering illicit finance requirements at financial institutions and access the US financial system, the statement said.

The Treasury also added to its sanctions blacklist Sim Hyon Sop, a representative of North Korea's Korea Kwangson Banking Corp, who recently relocated to Dandong, China. In his position with KKBC, Sim has coordinated millions of dollars in financial transfers for the DPRK.

According to the US Department of Justice, Sim was allegedly involved in laundering funds generated by North Korean IT workers who obtained illegal employment in the tech and crypto industry.

“These IT workers used fake personas to get jobs, including jobs at U.S.-based companies, and then asked to be paid in cryptocurrencies, such as stablecoins like USD Tether (USDT) and USD Coin (USDC), which are pegged to the US dollar. After receiving payment, they funneled their earnings back to North Korea through Sim,” the DoJ said.

The US sanctions freeze any US assets of the individuals and make those who do business with them also liable to sanctions.

Back to the list

Latest Posts

Iranian hackers target critical infrastructure, selling network access data on cybercriminal forums

Iranian hackers target critical infrastructure, selling network access data on cybercriminal forums

The advisory details tactics and techniques used by Iranian hackers to breach networks and collect valuable data.
17 October 2024
US authorities charge Sudanese brothers linked to Anonymous Sudan DDoS operation

US authorities charge Sudanese brothers linked to Anonymous Sudan DDoS operation

Anonymous Sudan carried out numerous DDoS attacks targeting US and international organizations.
17 October 2024
Nation-state hackers increasingly collaborate with cybercrooks to gather intelligence

Nation-state hackers increasingly collaborate with cybercrooks to gather intelligence

Russian state-backed hackers have been outsourcing cyberespionage tasks to cybercriminals, particularly those targeting Ukraine.
16 October 2024