The malware is designed to bypass traditional detection methods and this shift towards simpler phishing tactics contrasts with BlueNoroff’s previous campaign which involved prolonged social engineering and “grooming” on social media. The attackers use email phishing with fake cryptocurrency news headlines and exploit legitimate infrastructure such as Namecheap for domain registration and hosting providers like Quickpacket and Hostwinds. In addition to BlueNoroff’s campaign, North Korean threat actors actively pursue job opportunities in Western firms, employing tactics like social engineering through fake job offers and malware-laden assignments. These campaigns illustrate North Korea’s increasingly varied and persistent efforts to acquire funds from the cryptocurrency sector, bypassing financial sanctions.