A North Korea-linked hacking group, Sapphire Sleet, has stolen more than $10 million in cryptocurrency over six months through LinkedIn scams and AI-driven malware. The group, active since 2020, exploits fake profiles to execute sophisticated social engineering campaigns targeting professionals worldwide.

According to TheHackerNews, Sapphire Sleet overlaps with other North Korean threat actors like APT38 and BlueNoroff. They leverage fraudulent LinkedIn profiles, posing as recruiters. Another common tactic involves masquerading as a venture capitalist showing interest in the target’s company.

Victims are invited to virtual meetings that are plagued with fake error messages. The threat actors then ask the user to download malicious files under the guise of fixing the supposed technical issues. These files — AppleScript (.scpt) or Visual Basic Script (.vbs), depending on the target’s device — deploy malware to steal credentials and cryptocurrency wallets.

Another strategy includes impersonating recruiters from financial firms like Goldman Sachs, luring targets into completing fake skills assessments. Victims are given login credentials for fraudulent websites, where downloading a code associated with their skill assessment instead infects their device with malware.

Microsoft notes that North Korea also supports thousands of IT workers abroad who generate revenue for the regime through legitimate work, while exploiting their access to their company’s sensitive information. These workers rely on intermediaries to create fake profiles on platforms like GitHub and LinkedIn, helping them secure remote jobs.

North Korean hackers also use AI tools to enhance their schemes. For instance, AI-generated images, voice-altering software, and tools like Faceswap help create convincing fake identities for resumes and job applications. These AI-driven methods have enabled them to deploy hundreds of personas across platforms, maximizing their reach.

A few months prior to this incident, several similar occurrences took place. The first ensued when a group of North Korean hackers under the name of Citrine Sleet tricked victims into visiting attacker-controlled sites, eventually infecting their device and siphoning off cryptocurrency. In another case, North Korean cybercriminal groups Kimsuky (APT43) and Andariel (APT45) distributed malware via a VPN software update flaw.