Since its initial appearance in 2009, the Lazarus organisation has mostly targeted cryptocurrency companies, pilfering assets valued at billions of dollars.

Using LinkedIn, the North Korean hacking collective Lazarus targets susceptible people with the intention of stealing their assets through deliberate virus attacks.

The issue came to light when the blockchain security analytics company SlowMist disclosed that hackers from the Lazarus group were using LinkedIn to pose as job seekers for positions as blockchain developers in the cryptocurrency sector.

According to SlowMist, hackers obtain employee credentials by granting access to their repository so they may execute pertinent code.

The hacker uses harmful code embedded in code snippets to steal assets and sensitive data.

Targeted attacks via LinkedIn is not a novel tactic; the North Korean hacker gang employed a similar tactic in December 2023, posing as a fake Meta recruiter.

After contacting victims via LinkedIn, the fake recruiter requested that the targeted “applicants” download two coding challenges as part of the hiring procedure.

These two coding files contained malware, and when they were run on a work computer, they released a Trojan that allowed remote access.

Lazarus has stolen over $3 billion in crypto assets. It is among the most notorious and organized hacking groups that first surfaced in 2009 and continues to target crypto firms despite numerous sanctions against it.

Lazarus is known for using innovative ways to target and steal funds. In August 2023, the group used fake job interviews to steal $37 million from crypto payment firm CoinPaid.

The hackers attempted to infiltrate CoinsPaid infrastructure by targeting individuals through fake high-salary job offers.

The group has been behind some of the biggest heists in the crypto industry. The 2022 Ronin Bridge hack is its biggest, with $625 million stolen.

The cyber organisation frequently launders its stolen money back to North Korea using cryptocurrency mixing services; the money is reportedly intended to finance the nation's military activities.

Despite the fact that hacking organisations frequently target cryptocurrency companies, the decentralised architecture of blockchain makes it challenging for them to transfer their assets.

Once found, they are frequently followed and stopped with the use of cryptocurrency platforms.

Huobi and Binance froze $1.4 million worth of cryptocurrency assets associated with North Korea in February 2023. Similarly, cryptocurrency exchanges seized assets worth $63 million connected to the Harmony Bridge attack.