North Korean cyber spies created U.S. firms to dupe crypto developers

The activity represents the continuing evolution in the sprawling North Korean efforts to target the cryptocurrency sectors in a bid to raise cash for the North Korean government. | REUTERS

by A.J. VICENS, ANTON ZVEREV AND JAMES PEAR SON
April 25, 2025

DETROIT - North Korean cyber spies created two businesses in the U.S., in violation of Treasury sanctions, to infect developers working in the cryptocurrency industry with malicious software, according to cybersecurity researchers and documents.

The companies, Blocknovas and Softglide were set up in the states of New Mexico and New York using fake personas and addresses, researchers at Silent Push, a U.S. cybersecurity firm, said. A third business, Angeloper Agency, is linked to the campaign, but does not appear to be registered in the United States.

"This is a rare example of North Korean hackers actually managing to set up legal corporate entities in the U.S. in order to create corporate fronts used to attack unsuspecting job applicants,” said Kasey Best, director of threat intelligence at Silent Push.