If you think that you're safe, think again. It never hurts to be careful. This takes on a whole new level when you're talking about APT 38. This group goes by quite a few names, so bear with me. The official name, found on Wikipedia, is the Lazarus Group. Other names they go by are the Guardians of Pease or Whois team. The names used on the other side of the coin are Hidden Cobra (US intelligence) and Zinc (Microsoft). There are some overlappings with the group names, but for the sake of clarity, we will be looking at the group named APT 38.
ATP stands for Advanced Persistent Threat, which is a stealthy computer network group. Usually state-sponsored, but not in all cases, these groups target large scale institutions. Their techniques are quite fascinating and well-planned. Instead of a simple bank robbery stereo, this kind of heist has a lengthy life cycle. The reason for this is that their motivations more than just monetary; they target organizations and organizations for infrastructure use. That being said, they are out for more than just money.
What makes APT 38 so different from just cyber thugs is that they are very patient, willing to wait longer amounts of time to ensure that they get in and out undetected. Unlike the movies, they don't sit down at a computer and hack. They start with the goal of understanding the environment of their target. After following the network layout, technologies, and even employee patterns, then they enter. Then they stay in as long as they need to accomplish their goal without being detected. They are so good that their dwell time averages 155days. The longest known of their dwell time was 678 days.
This elite group has believed to have been active since 2009 and is the backbone of the North Korean Cyber Squad. With all the sanctions on North Korea, this group has been funding North Korea's economy directly from their attacks. One of the more notorious jobs they have been credited with is the well-known Sony attack. The unique aspect of this attack is that it was out of revenge. The result caused some hefty damage to the company.
There was also a very real looking lucrative Vessel Token Offering. It was modeled after a South Korean Shipowner.io. Jonathan Foong's site. In this kind of investment, investors buy pieces of ships that they can trade with other investors and get a good cut of the shipping industry. It came with an elaborate 2-page business plan and a 2022 prediction that this platform would hold 5% of the global vessel transaction. It sounds like a winner, but the investments were funneled into the North Korean Nuke plan. According to reports, they had everything ready to go with a legitimate coin, then it disappeared with the funding going to North Korea's nuclear program.
How much damage have they done? Since this crime is stealthily performed, it's hard to know. We know that between January 2017 to September 2018, they stole around $571 million in cryptocurrency alone. In 2018, they funneled $1 billion into the DPRK economy. This was from a combination of cryptocurrency exchanges and banks.
In my article "For Who the Scam Tolls," I mention that scams and such malicious actions give the cryptoworld a lousy reputation. In this case, it creates an image in the minds of the general public that bitcoin, and the likes, are used mostly for illegal actions. Remember that in general, most people only know what the media shows them. Besides, it also will give governments more of a push for "government regulation of crypto," as it is seen as a way to get around sanctions.
