TraderTraitor

Also known as: Jade Sleet, UNC4899, Pukchong, TraderTraitor

TraderTraitor targets blockchain companies through spear-phishing messages. The group sends these messages to employees, particularly those in system administration or software development roles, on various communication platforms, intended to gain access to these start-up and high-tech companies. TraderTraitor may be the work of operators previously responsible for APT38 activity.

🌍 Country North Korea

Introduction

TraderTraitor targets blockchain companies through spear-phishing messages. The group sends these messages to employees, particularly those in system administration or software development roles, on various communication platforms, intended to gain access to these start-up and high-tech companies. TraderTraitor may be the work of operators previously responsible for APT38 activity.

Activities and Tactics

Country of Origin: 🇰🇵 North Korea

Notable Campaigns

  • JumpCloud (July 2023; UNC4899 (DPRK APT))
  • CircleCI (January 2023; Jade Sleet (DPRK APT))

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

Information pending cataloguing.

Attribution and Evidence

Country of Origin: North Korea Additional attribution information pending cataloguing.

References

[1] BushidoToken Breach Report Collection - JumpCloud breach report (July 2023) via jumpcloud.com Source index: https://github.com/BushidoUK/Breach-Report-Collection; adversary label: UNC4899 (DPRK APT). [2] BushidoToken Breach Report Collection - CircleCI breach report (January 2023) via circleci.com Source index: https://github.com/BushidoUK/Breach-Report-Collection; adversary label: Jade Sleet (DPRK APT).

Recent News

Latest articles from security news feeds mentioning this actor.