pwn.watch: North Korea incident updates

[critical] Bybit loses ~$1.5B in ETH after Safe{Wallet} frontend is trojanized (North Korea)

Thu, 06 Mar 2025 00:00:00 GMT

North Korean TraderTraitor/Lazarus hackers compromised a Safe{Wallet} developer's Mac, took over AWS session tokens and injected JavaScript into Safe's S3-hosted frontend. Bybit's signers approved what looked like a routine transfer but was a malicious transaction. It is the largest crypto theft on record; the FBI attributed it to North Korea.

Status: closed · Patch: no-fix-needed

Latest updates:

2025-03-06: Safe{Wallet} confirms a developer machine compromise by TraderTraitor (source)
2025-02-26: FBI attributes the theft to North Korea ('TraderTraitor') (source)
2025-02-21: About $1.5B in ETH drained from a Bybit cold wallet

[critical] TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)

Wed, 13 Dec 2023 00:00:00 GMT

An authentication bypass in JetBrains TeamCity On-Premises gave unauthenticated attackers remote code execution on the CI server. Microsoft saw two North Korean groups exploit it, and US and allied agencies later said Russia's SVR (APT29) mass-exploited it. That's a direct path into build pipelines.

Status: closed · Patch: patched · Fixed in: 2023.05.4

Latest updates:

2023-12-13: CISA, FBI, NSA and partners: Russia's SVR exploiting TeamCity at scale (AA23-347A) (source)
2023-10-18: Microsoft: North Korean actors Diamond Sleet and Onyx Sleet are exploiting it (source)
2023-10-04: CISA adds CVE-2023-42793 to the KEV catalog

CVEs: CVE-2023-42793

[high] JumpCloud breached by North Korean hackers to reach crypto customers

Thu, 20 Jul 2023 00:00:00 GMT

A spear-phishing attack let a nation-state actor into JumpCloud's infrastructure. The attacker abused its command framework to target a small set of customers. JumpCloud force-rotated all customer API keys, and researchers tied the attack to North Korea, aimed at crypto companies.

Status: closed · Patch: no-fix-needed

Latest updates:

2023-07-20: SentinelOne links the intrusion infrastructure to North Korean APT activity (source)
2023-07-12: JumpCloud publishes incident details and indicators (source)
2023-07-05: JumpCloud rotates all customer API keys (source)

[critical] 3CX DesktopApp supply-chain attack (trojanized signed builds)

Thu, 20 Apr 2023 00:00:00 GMT

Signed 3CX DesktopApp builds for Windows and macOS shipped with embedded malicious code. Mandiant traced it to a North Korea-linked actor (UNC4736) who first got in through a trojanized X_TRADER install from Trading Technologies: a supply-chain attack caused by another supply-chain attack.

Status: closed · Patch: patched · Fixed in: See vendor advisory

Latest updates:

2023-04-20: Mandiant: the 3CX breach began with a trojanized X_TRADER package, the first software supply-chain attack it had seen caused by another (source)
2023-03-30: 3CX confirms the compromise and tells customers to uninstall the Electron desktop app (source)
2023-03-29: CrowdStrike reports malicious activity from the signed 3CXDesktopApp on customer machines (source)

CVEs: CVE-2023-29059