💰 DPRK Hackers Target Crypto Firms, Steal Private Keys and Cloud Assets in Coordinated Attacks
Cybersecurity researchers have uncovered a coordinated campaign targeting cryptocurrency firms that appears linked to North Korean threat actors.
The attacks combine web application exploitation, cloud credential abuse, and secrets extraction to gain access to digital asset infrastructure.
The campaign demonstrates a sophisticated multi-stage kill chain, beginning with exploitation of a critical web vulnerability and expanding into deep reconnaissance across AWS cloud environments and Kubernetes clusters.
The ultimate objective: steal cryptocurrency assets and proprietary exchange infrastructure.
🚨 Initial Entry Through React2Shell
The campaign begins with attackers scanning the internet for crypto platforms vulnerable to React2Shell (CVE-2025-55182).
React2Shell is a critical remote code execution vulnerability affecting React Server Components and Next.js applications, with a maximum CVSS score of 10.0.
This flaw allows attackers to execute commands on vulnerable servers without authentication.
Threat actors use automated scanning tools and web application firewall bypass techniques to identify exposed endpoints.
Once discovered, they exploit the vulnerability to run commands directly on server-side application components.
🔑 Private Keys and Source Code Exposure
During the investigation, analysts discovered that attackers had already compromised a USDT staking platform.
From the breached system, they recovered archived backend source code from a Next.js application.
Inside the codebase was an environment configuration file containing sensitive data, including:
Tron wallet addresses
private cryptographic keys
blockchain interaction scripts
One Python Web3 script reused the same private key to check balances on the blockchain.
Blockchain analysis detected at least one suspicious TRX transaction occurring during the timeframe of the exploitation.
While attribution of that specific transaction remains uncertain, the timing strongly suggests attacker involvement.
☁️ AWS Cloud Environment Compromise
In parallel with web exploitation, attackers also gained access to AWS cloud infrastructure belonging to another cryptocurrency organization.
Using previously obtained AWS access tokens, the attackers began systematically mapping the victim’s cloud environment.
Their activity followed a structured reconnaissance pattern.
First, they verified identity using the AWS Security Token Service (STS).
Next, they enumerated critical cloud resources, including:
S3 storage buckets
RDS databases
EC2 compute instances
Lambda serverless functions
EKS Kubernetes clusters
container registries (ECR)
This process allowed attackers to build a complete picture of the organization’s cloud architecture.
🧠 Infrastructure Mapping Through Terraform Files
A particularly valuable target was Terraform state files stored in S3 buckets.
Terraform state files often contain sensitive information about infrastructure deployments.
Attackers streamed these files and searched them for key data such as:
database credentials
public IP addresses
service endpoints
authentication secrets
These files effectively provided attackers with a blueprint of the victim’s entire cloud environment.
☸️ Kubernetes Cluster Takeover
Once attackers gathered sufficient AWS permissions, they pivoted into the organization’s Kubernetes infrastructure.
Using the command:
aws eks update-kubeconfig
they configured access to the victim’s Elastic Kubernetes Service (EKS) cluster.
After gaining access, they began exploring workloads and containers related to cryptocurrency operations.
Attackers:
enumerated pods across namespaces
examined container workloads
extracted configuration data from running services
📦 Container Registry Exfiltration
The attackers also accessed the victim’s Elastic Container Registry (ECR).
Inside the registry, they located multiple private Docker images containing proprietary exchange software.
At least five container images were exported and archived for exfiltration.
These images contained:
exchange business logic
internal routing configurations
authentication credentials
Such information provides attackers with deep insight into how crypto infrastructure operates.
🔐 Secrets and Configuration Theft
The attackers then focused on collecting credentials and secrets from multiple sources.
They extracted sensitive data from:
AWS Secrets Manager
Kubernetes ConfigMaps and Secrets
configuration files inside running containers
private Git repositories
This provided the attackers with full visibility into backend systems and infrastructure.
🌐 Command and Control Infrastructure
For command and control communications, the attackers used a combination of:
VShell remote management software
FRP (Fast Reverse Proxy)
FRP is frequently used by advanced threat actors because it allows covert tunneling through firewalls and NAT boundaries.
The command-and-control servers were hosted on infrastructure linked to the domain:
itemnania[.]com
The infrastructure was located on a VPS provider in South Korea and used both IPv4 and IPv6 connectivity.
Researchers also observed SSH activity routed through South Korean VPN exit nodes, further obscuring the attackers’ origin.
🎯 Targeting Crypto Supply Chains
Unlike opportunistic attacks focused on immediate financial theft, this campaign appears to prioritize long-term infrastructure access.
The attackers targeted:
staking platforms
cryptocurrency exchanges
exchange software vendors
Their primary objective appears to be the collection of:
backend source code
database credentials
private keys
infrastructure configuration data
These assets can later be used to conduct large-scale cryptocurrency theft or sabotage.
🧠 Attribution to DPRK Actors
Based on infrastructure patterns, tooling, and tactics, researchers assess with moderate confidence that the activity aligns with North Korean threat actors.
DPRK-linked groups have historically targeted cryptocurrency platforms to generate revenue that funds state operations.
However, analysts note that some tools used in this campaign are also employed by other nation-state actors, making definitive attribution challenging.
🛡 Security Recommendations
Cryptocurrency firms and cloud operators should adopt stronger security controls to defend against similar attacks.
Recommended actions include:
Patch Web Applications Immediately
Ensure frameworks such as React and Next.js are updated to mitigate vulnerabilities like React2Shell.
Secure Cloud Credentials
Rotate AWS access keys regularly and enforce strict IAM policies.
Monitor Infrastructure Artifacts
Audit Terraform state files, container registries, and configuration repositories for exposed secrets.
Implement Cloud Detection and Response
Monitor abnormal AWS activity such as mass enumeration, container image exports, and unusual Kubernetes access.
🎯 Security Takeaway
This campaign highlights how modern cyberattacks increasingly combine application exploitation, cloud infrastructure abuse, and supply-chain intelligence gathering.
Rather than targeting individual wallets or users, attackers are focusing on the infrastructure behind cryptocurrency platforms.
By compromising cloud environments and backend systems, they can position themselves for far larger theft operations.
Because in today’s cyber threat landscape, the real prize isn’t just cryptocurrency.
