U.S. Offers $10 Million Reward for Information on North Korean Hackers

The U.S. State Department has announced rewards of up to $10
million for any information that could help disrupt North Korea’s
cryptocurrency theft, cyber-espionage, and other illicit
state-backed activities.

“If you have information on any individuals associated with the
North Korean government-linked malicious cyber groups (such as
Andariel, APT38, Bluenoroff, Guardians of Peace, Kimsuky, or
Lazarus Group) and who are involved in targeting U.S. critical
infrastructure in violation of the Computer Fraud and Abuse Act,
you may be eligible for a reward,” the department said^[1]
in a tweet.

The amount is double the bounty the agency publicized^[2]
in March 2022 for specifics regarding the financial mechanisms
employed by state-sponsored actors working on behalf of the North
Korean government.

The development comes a week after the Justice Department
disclosed^[3]
the seizure of $500,000 worth of Bitcoin from North Korean hackers
who extorted digital payments by using a new ransomware strain
known as Maui.

The threat actor, tracked under the umbrella moniker Lazarus
Group (aka Hidden Cobra or APT38), is known to target blockchain companies^[4] and conduct
financially-driven crime through rogue cryptocurrency wallet apps^[5]. Andariel and Bluenoroff
are said to be subgroups within the larger Lazarus cluster.

Blockchain analytics firm Chainalysis in a report^[6]
earlier this year linked the Lazarus Group to seven attacks
directed against cryptocurrency platforms in 2021, stealing roughly
$400 million worth of virtual assets in the process.

It has also been implicated in the hacks of Axie Infinity’s
Ronin Network Bridge^[7]
and Harmony Horizon Bridge^[8]
in recent months, resulting in the theft of hundreds of millions of
dollars in digital currencies.

Earlier this month, Microsoft warned that a North Korean
activity cluster it calls DEV-0530^[9]
has been using a custom ransomware strain dubbed H0lyGh0st to
successfully compromise small businesses in multiple countries.

Cyber-enabled financial theft and money laundering, ransomware,
cryptojacking, and extortion operations are part of
Pyongyang-aligned hackers’ tactical playbook^[10] to generate illegal
revenue while mitigating the impact of sanctions.

“The North Korean government — officially known as the
Democratic People’s Republic of Korea (DPRK) — employs malicious
cyber activity to collect intelligence, conduct attacks, and
generate revenue,” the U.S. Cybersecurity and Infrastructure
Security Agency (CISA) notes^[11] in its advisory.

“North Korea has conducted cyber theft against financial
institutions and cryptocurrency exchanges worldwide, potentially
stealing hundreds of millions of dollars, probably to fund
government priorities, such as its nuclear and missile
programs.”