North Korean hackers stole millions of dollars in cryptocurrencies. Their work was impeccable

A North Korean threat actor known as UNC4899 is suspected of carrying out a cloud compromise campaign targeting a cryptocurrency organization in 2025, with the aim of stealing millions of dollars. This activity, moderately attributed to a state-sponsored adversary, is also tracked under the codenames Jade Sleet, PUKCHONG, Slow Pisces, and TraderTraitor. Ocean’s 14 According to Google’s Cloud Threat Horizons Report, this incident stands out for its complex combination of social engineering and exploitation of data transfer mechanisms between personal and corporate devices. The […]

A North Korean threat actor known as UNC4899 is suspected of carrying out a cloud compromise campaign that targeted a cryptocurrency organization in 2025, with the aim of stealing millions of dollars.

This activity, moderately attributed to a state-sponsored adversary, is also tracked under the cryptonyms Jade Sleet, PUKCHONG, Slow Pisces, and TraderTraitor.

Ocean’s 14

According to Google’s Cloud Threat Horizons Report, this incident stands out for its complex combination of social engineering and exploitation of data transfer mechanisms between personal and corporate devices. The attackers tricked a developer into downloading a malicious file under the guise of a supposed open-source collaboration, which then allowed unauthorized access to their corporate machine and, subsequently, to the cloud infrastructure.

Once inside the cloud environment, attackers abused legitimate DevOps workflows to steal credentials and manipulate Cloud SQL databases, thereby facilitating cryptocurrency theft. Through modifications to Kubernetes configurations and the execution of malicious commands, the attackers managed to establish a persistent presence in the environment, employing techniques known as “living-off-the-cloud” (LoTC).

This incident highlights the critical risks associated with data transfer methods between personal and corporate devices, as well as the unsecured handling of secrets in a cloud environment. In response, organizations are advised to implement a defense-in-depth strategy that includes rigorous identity validation, restrictions on data transfer, and isolation within cloud execution environments to mitigate damage in the event of an intrusion event.

Experts warn about the importance of adopting policies that discourage the use of external devices and insecure connections, such as file sharing via AirDrop or Bluetooth, to protect the critical infrastructure of organizations against increasingly sophisticated threats.

Author: Chema Carvajal Sarabia

{ "de-DE": "Journalist, spezialisiert auf Technologie, Unterhaltung und Videospiele. Über das zu schreiben, was mich begeistert (Gadgets, Spiele und Filme), ermöglicht es mir, bei Verstand zu bleiben und mit einem Lächeln im Gesicht aufzuwachen, wenn der Wecker klingelt. PS: Das stimmt nicht 100% der Zeit.", "en-US": "Journalist specialized in technology, entertainment and video games. Writing about what I'm passionate about (gadgets, games and movies) allows me to stay sane and wake up with a smile on my face when the alarm clock goes off. PS: this is not true 100% of the time.", "es-ES": "Content Manager - Periodista especializado en tecnología, entretenimiento y videojuegos. Escribir sobre lo que me apasiona (cacharros, juegos y cine) me permite seguir cuerdo y despertarme con una sonrisa cuando suena el despertador. PD: esto no es cierto el 100 % de las veces.", "fr-FR": "Journaliste spécialisé dans la technologie, le divertissement et les jeux vidéo. Écrire sur ce qui me passionne (gadgets, jeux et films) me permet de rester sain d'esprit et de me réveiller avec le sourire aux lèvres quand le réveil sonne. PS : cela n'est pas vrai 100 % du temps.", "it-IT": "Giornalista specializzato in tecnologia, intrattenimento e videogiochi. Scrivere di ciò che mi appassiona (gadget, giochi e film) mi permette di mantenere la sanità mentale e di svegliarmi con un sorriso sul viso quando suona la sveglia. PS: questo non è vero al 100% del tempo.", "ja-JP": "", "nl-NL": "", "pl-PL": "", "pt-BR": "Jornalista especializado em tecnologia, entretenimento e videogames. Escrever sobre o que me apaixona (gadgets, jogos e filmes) me permite manter a sanidade e acordar com um sorriso no rosto quando o despertador toca. PS: isso não é verdade 100% do tempo.", "social": { "email": "chemacs91@gmail.com", "facebook": "", "twitter": "https://twitter.com/chematopetazo", "linkedin": "" } }