North Korean Hackers Create Shell Companies in the US to Scam Crypto Devs

In a trailblazing cyber espionage (also cyber spying) campaign, North Korean hackers have set up shell companies within the United States to deceive cryptocurrency developers and infiltrate digital asset platforms.

Silent Push, a U.S.-based cybersecurity firm, revealed that two crypto firms, including Blocknovas LLC in New Mexico and Softglide LLC in New York, were attributed to a North Korean threat actors associated with the “Contagious Interview” subgroup.

Our team at Silent Push has been hard at work on the largest report we’ve ever made public – and along with Reuters – today we’re explaining how North Korean threat actors associated with the “Contagious Interview” subgroup created 3 front companies…🧵

— Zach Edwards (@thezedwards) April 24, 2025

Also, a third firm, Angeloper Agency, which is not registered in the United States is believed to be affiliated with the same network. The three front companies are used to deliver a trio of Malware: BeaverTail, InvisibleFerret, and OtterCookie.

These front companies pose as legitimate employers, offering remote job opportunities to unsuspecting crypto developers. In fact, the three companies were established using subtly falsified identities and addresses.

“During the job application process, an error message is displayed as someone tries to record an introduction video, and the “solution” is an easy “click fix” copy and paste trick, which leads to malware if the unsuspecting developer completes the process,”

Zach Edwards, Senior Threat Analyst at Silent Push said.

This malware enables the attackers to compromise systems, steal credentials, and access cryptocurrency wallets.

Luckily, the U.S. Federal Bureau of Investigation (FBI) has disrupted one of the group’s operations by seizing the domain associated with Blocknovas LLC.

North Korean Hackers Use Freelancing Websites to Steal Crypto Funds

North Korean advanced persistent threat (APT) group, Contagious Interview, is known to be persistent with its social engineering techniques.

In addition, some freelancing, hiring, or recruitment sites, like Upwork, CryptoJobsList, Freelancer, and CryptoTask, were found to be used by Contagious Interview to lure its victims into its network.

This action is part of the persistent attacks that are orchestrated by North Korean hackers against the crypto space, particularly against centralized exchanges (CEX).

In recent years, the Lazarus Group has been linked to several high-profile cryptocurrency thefts, including a $1.5 billion heist from Bybit in February 2025 and a $230 million loss from India’s WazirX exchange in July 2024, which is equivalent to 45% of the exchange’s user funds.

However, the global cybersecurity community continues to work tirelessly to unravel such cyber threats before they spread to an uncontrollable level.

Deribit Warns of Rising Job Scams Targeting Crypto Professionals

Similarly, in March 2025, Deribit warned of rising job scams targeting crypto professionals.

The Cryptocurrency Options & Futures Exchange stated that scammers impersonate recruiters on LinkedIn, targeting crypto developers/senior staff with fake high-paying job offers to steal data or funds.

🚨 Deribit Warns Against Recruitment Scams 🚨@DeribitOfficial, a leading crypto derivatives exchange, has reported a rise in scammers impersonating recruiters, targeting crypto professionals with fake job offers to steal personal data or funds.

🔹 Malware scams – Fake "online… pic.twitter.com/6FPXeR96M0

— Coinwaft (@coinwaft) March 19, 2025

It added that tactics that are being deployed by the bad actors include malware-laced “online assessments,” fake pre-hire perks (e.g., discounted shares), and in-person meetings to access work devices.