CryptoCore-Lazarus-Clearsky.pdf (1000 KB)

ClearSky assesses with medium-high confidence that the CryptoCore campaign targeting cryptocurrency exchanges is linked to North Korea’s Lazarus group. The activity, also tracked as CryptoMimic or Dangerous Password, targeted exchanges in Israel, the United States, Europe, and Japan over roughly three years and was associated with theft of cryptocurrency wallets worth hundreds of millions of dollars. The report connects ClearSky, F-Secure, JPCERT/CC, and NTT Security findings by comparing victimology, social-engineering tradecraft, VBS scripts, RAT and stealer tooling, and similarities to known Lazarus operations. The source is careful to frame the attribution as a research-backed likelihood rather than certainty.