[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVW6_TtZi-4IZA5mQ6Pl6MNxNsjEPbzDvjf19XPnAagU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":18,"created_at":19,"published_at":20,"article":21,"tags":25,"podcasts":38,"controls":45},"eba5a149-3299-419b-96cc-a4ddf081d789","six-month-social-engineering-campaign-leads-to-285m-crypto-theft","b7701eb3-9f72-456d-b6cf-16bfd18ca394","Six-Month Social Engineering Campaign Leads to $285M Crypto Theft","North Korean hackers successfully executed a sophisticated six-month social engineering campaign by impersonating a legitimate trading firm, building trust through face-to-face meetings and financial deposits before launching their attack. The attackers compromised developer devices using malicious TestFlight apps, poisoned code repositories, and exploited development tool vulnerabilities to gain persistent access. This incident demonstrates how advanced persistent threats combine social engineering with supply chain attacks to bypass traditional security controls. Organizations in high-value sectors like cryptocurrency must implement rigorous verification procedures and assume that determined state-sponsored actors will invest significant time and resources to build credible false identities.","**Immediate actions:**\n- Implement mandatory multi-person verification for all new business partnerships and vendor relationships\n- Audit all developer devices and development environments for signs of compromise\n- Review and validate the integrity of all code repositories and development tools\n\n**Long-term improvements:**\n- Establish comprehensive background verification procedures for potential partners that go beyond surface-level checks\n- Implement code signing and repository integrity monitoring to detect unauthorized changes\n- Create network segmentation between development environments and production systems\n\n**Detection measures:**\n- Deploy behavioral monitoring on developer workstations to detect unusual activity patterns\n- Implement automated scanning of development tools and IDE plugins for malicious code\n- Establish regular security assessments of the entire software development lifecycle",[12,13,14,15,16],"CIS Control 14 (Controlled Access Based on the Need to Know)","NIST SP 800-161 (Supply Chain Risk Management)","NIST SC-30 (Concealment and Misdirection)","CIS Control 16 (Application Software Security)","OWASP SAMM (Software Assurance Maturity Model)",{},"published","2026-04-06T12:08:18.731584+00:00","2026-04-06T12:08:18.627+00:00",{"id":7,"url":22,"slug":23,"title":24},"https:\u002F\u002Fhackread.com\u002Fnorth-korean-hackers-trading-firm-drift-protocol\u002F","north-korean-hackers-pose-as-trading-firm-to-steal-285m-from-drift","North Korean Hackers Pose as Trading Firm to Steal $285M from Drift",[26,32],{"id":27,"name":28,"slug":29,"description":30,"color":31},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":33,"name":34,"slug":35,"description":36,"color":37},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[39],{"id":40,"date":41,"edition":42,"title":43,"audio_url":44},"5e08eadf-931e-4311-b6dd-cfa20a0e8447","2026-04-06","afternoon","ThreatNoir Afternoon Brief — April 6","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-04-06\u002Fthreatnoir-afternoon-brief-2026-04-06.mp3",[46,50,54],{"slug":47,"name":48,"problem":49},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",{"slug":51,"name":52,"problem":53},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":55,"name":56,"problem":57},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]