North Korean Hackers Set Up Fake US Firms to Lure Crypto Developers into Malware Traps

North Korean Hackers Set Up US Companies To Target Crypto Developers

North Korean hackers linked to the Lazarus Group have quietly established two companies in the United States as part of a campaign to infiltrate the cryptocurrency sector, cybersecurity firm Silent Push has revealed.

The firms, BlockNovas LLC and SoftGlide LLC, were registered in New Mexico and New York, respectively, and served as fronts to deliver malware to unsuspecting developers in the crypto industry.

Fake Firms, Real Threats Behind Corporate Fronts

Using forged identities and fake addresses, the attackers created the illusion of legitimate US-based businesses.

Silent Push researchers say the operation was led by a subgroup within Lazarus known as “Contagious Interview.”

The group set up a third fake company, Angeloper Agency, which was not registered in the US but was tied to the same malware distribution effort.

What makes the case especially alarming is that these entities weren’t just website facades — they were formally incorporated using fabricated data, with entire fake teams built using AI-generated employee profiles.

Source: Silent Push

"Mehmet Demir" is a fabricated persona created on LinkedIn, with his work experience listing two of the shell companies, adding a layer of legitimacy to the operation. (Source: Silent Push)

How Malware Was Spread Through Job Interview Traps

The campaign relied heavily on fraudulent job interview tactics.

Developers searching for roles in the crypto space were lured with fake job offers from these shell companies.

Once contact was established, malware was sent under the guise of job-related materials.

The goal was to steal wallet credentials and sensitive data that could allow follow-up attacks on crypto platforms.

Silent Push has linked domains such as `blocknovas[.]com`, `apply-blocknovas[.]site`, and `lianxinxiao[.]com` to the operation, suggesting a network of coordinated infrastructure designed to mimic legitimate recruitment sites.

Source: Silent Push

Source: Silent Push

A Familiar Playbook With Billion-Dollar Results

This latest campaign fits a pattern seen in previous high-profile breaches.

The Lazarus Group is known for targeting individuals through fake employment lures.

In 2021, a similar strategy was used to infiltrate Sky Mavis, resulting in the $625 million Ronin Bridge hack.

In 2022, another job-based deception led to a $100 million theft from Harmony’s Horizon Bridge.

Since 2017, Lazarus-linked operations have stolen over $3 billion in cryptocurrency, according to estimates from the United Nations and blockchain analytics firm Chainalysis.

These campaigns have become a go-to method for North Korea’s state-sponsored cyber units.

How Were These Companies Registered Without Detection?

The attackers used forged personal details and deepfake-style profile images to register the companies and build corporate websites.

According to Kasey Best, director of threat intelligence at Silent Push,

“This is a rare example of North Korean hackers actually managing to set up legal corporate entities in the US in order to create corporate fronts used to attack unsuspecting job applicants.”

The scale and ambition of this operation highlight the evolving tactics used by North Korean cyber units to stay ahead of detection and regulatory scrutiny, leveraging the credibility of US incorporation to gain trust from crypto professionals around the world.