Investigating North Korean IT Worker Infiltration Driven by OSINT & HUMINT | Founded by @0xfigo
◾◾◾
Joined May 2021
- Tweets99
- Following60
- Followers239
- Likes308
NorthScan retweeted
🙂↕️
注意安全
We owe you an apology.
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe.
Exposed: names, contact details, shipping addresses, and order details (items and prices).
Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords.
We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.
Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us.
NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself.
A detailed report is coming soon.
Until then, trust only our official channels. If anything feels off, email [email protected]. We'd rather hear from you than have you take a chance.
Again, we're truly sorry to everyone affected.
NorthScan retweeted
What should we prioritize funding in the ETHSecurity Initiatives Round?
Join us this Thursday for an X Space with ETHSecurity Badge holders as we go through the initiatives and hear what they think Ethereum security needs most right now.
↓
xitter.cf/i/spaces/1nxeLMRampNJX…
NorthScan retweeted
The initiatives page is live with 50+ Ethereum security initiatives looking for support.
TheDAO is putting 400 ETH into the round.
If you know a team that should be backing this work, send them the page.
initiatives.thedao.fund/
Glad to share what we have been building: a GitHub intel platform for tracking DPRK IT workers in open source
We now have 26k+ GitHub records, ~30k linked emails/URLs/handles, and 90k+ follow relationships mapped as a graph
Red flags come from username patterns, behavioral rules and more, each with its source attached It surfaces signals for analysts, it doesn't attribute.
There is still more to build!!
And remember that we are participating in the @thedaofund, and any contribution helps keep this work going.
NorthScan retweeted
Been building a GitHub intel platform at @north_scan for tracking DPRK IT workers in open source
26k+ GitHub records, ~30k linked emails/URLs/handles, and 90k+ follow relationships mapped as a graph
Red flags come from username patterns, behavioral rules and more, each with its source attached
It surfaces signals for analysts, it doesn't attribute. Still more to build
NorthScan is participating in the @thedaofund and any contribution helps keep this work going.
Link in the coments
NorthScan retweeted
@north_scan is part of @TheDAOfund’s ETHSecurity Initiatives Round!
We’re building GitHub screening to help Ethereum teams identify behavioral, identity and network signals associated with DPRK IT workers
Support our pilot: initiatives.thedao.fund
The ETHSecurity Initiatives Round now has 45 initiatives live.
Browse the board. Find the work your team wants to see exist. Help push it forward.
initiatives.thedao.fund/
NorthScan retweeted
We’re starting in 1 hour!
Formal verification can get technical fast, so we brought the right people to unpack it.
Joining us:
@RaoulSaffron and Everett from @rv_inc
@Fricoben from @veritylab
@bennylada from @vyperlang
@zoep_42 and @clonker3141 from @argotorg
@vilhelm_sjoberg from @CertiK
Come listen in ↓
xitter.cf/i/spaces/1YGNrbXQkQyGw…
NorthScan retweeted
Ethereum security cannot only depend on finding bugs after the fact.
This Thursday, TheDAO’s Ethereum Security Space is back to talk formal verification, and how proving critical code behaves as intended can help make Ethereum safer.
Join us ↓
xitter.cf/i/spaces/1YGNrbXQkQyGw…
NorthScan retweeted
Found a project on Giveth that you really believe in?
Stick with them. 💜
Set up a recurring donation and keep supporting their work every month.
docs.giveth.io/recurringdona…
The DAO is back again! Participate and check out the proposals currently under consideration
Onchain security is everyone’s problem and nobody’s job.
ETHSecurity Initiatives is how we are changing that.
Propose the work. Fund the work. Build the work.
initiatives.thedao.fund/
NorthScan retweeted
⚠️ Giveth community, please be careful.
We’ve been made aware of a phishing email pretending to be from Giveth.
The email says your “donation wallet needs attention” and prompts you to confirm your wallet. This message is not from Giveth.
If you receive an email like this, do not click the button, connect your wallet, or sign any transactions.
Please stay alert, and if a Giveth email ever looks suspicious, reach out to us through our official channels before interacting with it.
NorthScan retweeted
North Korea fired an unidentified projectile toward the East Sea on Saturday, South Korea's military said.
It marks the North's fourth test since early last month, a day after the US, South Korea and Japan wrapped up the Freedom Edge exercise.
nknews.org/?p=979543
An interview into our research, an remember to do a good background check🎉
What happens after a company hires a North Korean operative? Two researchers built a fake company to find out, hired three of them and published it all.
#cybersecurity #northkorea
NorthScan retweeted
Long before the world knew him as Kim Jong Il, the former North Korean leader had a Russian name
nknews.org/?p=978883
NorthScan retweeted
🎬 "Are you living two lives, Mr. Anderson?"
Time to meet Mr. Benito and watch the Famous Chollima team fall apart — in the video he confronts Mr. Anderson directly about forged documents.
⚠️ Read the full investigation → any.run/cybersecurity-blog/l…
If you want to check our talk here is a great shortcut to watch it on youtube 👀!!
this wild defcon talk is finally out
researchers created a fake defi startup, hired lazarus it workers, put them into a sandbox and recorded their tooling, workflows, and faces from inside the operation
starts at 5:46:09
youtube.com/live/_uYQr8hfpbI…
NorthScan retweeted
Full story:
cointelegraph.com/magazine/f…
NorthScan retweeted
朝鲜知名黑客组织Lazarus居然被网络安全公司“钓鱼”执法了！
ANY RUN开了家假DeFi公司"招聘"，成功“雇佣”Lazarus旗下分支Famous Chollima的黑客们。三个人成功入职：前端、后端、智能合约开发，全齐了。
这些黑客们以为自己成功混进了一家科技公司，殊不知螳螂捕蝉黄雀在后，其实他们早已被“做局”。
ANY RUN通过沙箱环境全程录屏数周活动，随后曝光了Lazarus的完整“作案”工具。包。
🫡安全公司"雇佣"朝鲜黑客组织 Lazarus，全程录屏曝光工具包和作案手法
ANY.RUN 安全研究员伪装成创业公司招聘远程 IT 工作者，成功"雇佣"朝鲜 APT 组织 Lazarus（又名 Chollima）成员，并通过沙箱环境全程录屏数周活动，曝光其完整工具包。
Lazarus 使用窃取或 AI 合成的身份（虚假简历、照片、LinkedIn）应聘美英科技公司远程岗位，入职后窃取敏感数据、部署恶意软件或为朝鲜创收。研究员捕获了招聘人员"Aaron"（又名 Blaze）的完整通信记录、虚假面试流程和入侵工具。
这暴露了朝鲜 IT 渗透计划的工业化规模，不是零星个案，而是有组织、有流程的长期行动，且已渗透多家美英科技公司。
ANY.RUN 称这是首次实时捕获 Lazarus 远程工作者计划的完整证据链，包括视频录像。
NorthScan retweeted
In June, Cointelegraph was invited by @0xfigo, @MauroEldritch and @anyrun_app to take part in an investigation into suspected North Korean IT workers operating inside a fake crypto startup created by the researchers.
Our reporter posed as a VC, discussed funding and even offered them a shot at Cointelegraph coverage.
They didn’t know who they were pitching to.