Security Agency: Suspected North Korean hacker group collaborates to attack cryptocurrency companies, stealing keys and cloud assets

2026-03-09 03:19:10

Abstract generation in progress

Mars Finance reports that security research organization Ctrl-Alt-Intel has disclosed a group of suspected North Korea-linked hackers targeting staking platforms, exchange software vendors, and crypto exchanges. The attackers exploited the React2Shell vulnerability (CVE-2025-55182) and compromised AWS access credentials to infiltrate cloud environments, enumerate resources such as S3, EC2, RDS, EKS, and ECR, and extract keys and credentials from Secrets Manager, Terraform files, Kubernetes configurations, and Docker containers. Researchers stated that the attackers downloaded five Docker images and stole source code, including software components related to ChainUp clients. The attack infrastructure involved Korean servers at 64.176.226[.]36 and the domain itemnania[.]com. The report indicates that the activity exhibits characteristics consistent with North Korean attacks, but attribution confidence is medium, and the source of AWS credentials remains unclear.

View Original

This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.

1 Likes