Threat Actor 🇰🇵 North Korea
TraderTraitor
Also known as: Jade Sleet · UNC4899 · Pukchong
TraderTraitor targets blockchain companies through spear-phishing messages. The group sends these messages to employees, particularly those in system administration or software development roles, on various communication platforms, intended to gain access to these start-up and high-tech companies. TraderTraitor may be the work of operators previously responsible for APT38 activity.
Indicators of Compromise 7
MITRE ATT&CK TTPs 12
T1055 T1078 T1082 T1090 T1105 T1204.002 T1543.003 T1558 T1566 T1573 T1574 T1588
Process Injection
Defense Evasion
Valid Accounts
Defense Evasion
System Information Discovery
Discovery
Proxy
Command And Control
Ingress Tool Transfer
Command And Control
Malicious File
Execution
Windows Service
Persistence
Steal or Forge Kerberos Tickets
Credential Access
Phishing
Initial Access
Encrypted Channel
Command And Control
Hijack Execution Flow
Persistence
Obtain Capabilities
Resource Development