Overview

• North Korean state-sponsored hackers set up U.S.-registered shell companies, Blocknovas LLC and Softglide LLC, to target cryptocurrency developers with malware.
• The FBI seized the Blocknovas domain, citing its use in fake job postings to distribute malware and compromise cryptocurrency wallets and credentials.
• The operation was orchestrated by a subgroup of the Lazarus Group under North Korea’s Reconnaissance General Bureau to fund the regime’s nuclear and missile programs.
• Silent Push researchers confirmed multiple victims of the campaign, with Blocknovas being the most active of the identified front companies.
• Authorities are intensifying efforts to disrupt related operations, including investigations into Softglide and a third unregistered entity, Angeloper Agency.