TraderTraitor
Aliases: Jade Sleet, UNC4899, Pukchong
- First seen
- 2022-04-01 00:00:00
- Origin
- KP
- Primary motivation
- financial-gain
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 12:07:27
Targeted industries: technology-and-telecommunications financial-services
Targeted regions: country_code:us country_code:kr country_code:jp
Context
TraderTraitor targets blockchain companies through spear-phishing messages. The group sends these messages to employees, particularly those in system administration or software development roles, on various communication platforms, intended to gain access to these start-up and high-tech companies. TraderTraitor may be the work of operators previously responsible for APT38 activity.
Related threat objects
- Lazarus Group (threat-actor)
Reports & references
- Mandiant — North Korea Supply Chain (report)
- CISA — Aa22 108A (report)
- Mandiant — North Korea Cyber Structure Alignment 2023 (report)
- cloud.google.com — Cyber Threats Targeting Brazil (report)