← AVOID.NET
Entity Graph
Browse extracted entities, relationships, and potential duplicates.
Total entities
29,543
Relationships
32,611
Potential duplicates
0
Filter by kind
Entities (event)
↯a88ff143
OFAC designates six individuals and two entities (Amnokgang Technology Development Company; Quangvietdnbg International Services Company Limited) for roles in generating approximately $800 million in 2024 for DPRK weapons programs. Twenty-one cryptocurrency addresses across Ethereum, Tron, and Bitcoin identified.(2026-03-12:dprk-it-worker-network-overseas-scheme)event
↯7ca7823a
OFAC designates Russian national Vitaliy Sergeyevich Andreyev, Shenyang Geumpungri Network Technology Co. (China), and Korea Sinjin Trading Corporation (DPRK) for facilitating payments to Chinyong IT worker network.(2025-08-27:dprk-it-worker-network-overseas-scheme)event
↯e642b6ce
CrowdStrike reports North Korean IT worker infiltration attempts grew 220% year-over-year; AI is weaponized at every stage of the hiring process including deepfakes and synthetic identity generation.(2025-08-04:dprk-it-worker-network-overseas-scheme)event
↯958cac87
DOJ files civil forfeiture complaint against $7.74 million in cryptocurrency tied to Sim Hyon Sop's laundering network.(2025-06-05:dprk-it-worker-network-overseas-scheme)event
↯9398a3ea
DOJ announces coordinated nationwide enforcement: two new indictments, one information with plea, arrest of Zhenxing Wang in New Jersey. FBI executes searches of 21 premises across 14 states hosting laptop farms (June 10–17). Seizure of 29 financial accounts and 21 fraudulent websites.(2025-06-10:dprk-it-worker-network-overseas-scheme)event
↯72534535
FBI IC3 issues public service announcement warning companies of data extortion by North Korean IT workers leveraging unauthorized corporate network access.(2025-01-23:dprk-it-worker-network-overseas-scheme)event
↯67caacf7
DOJ indicts North Korean nationals Jin Sung-Il and Pak Jin-Song plus three facilitators for placing workers at 64 U.S. companies between 2018 and 2024, generating at least $866,255 in illicit revenue laundered through a Chinese bank account.(2025-01-21:dprk-it-worker-network-overseas-scheme)event
↯765898e9
DOJ indicts 14 North Korean nationals (including Yanbian Silverstar CEO Jong Song Hwa, Kim Ryu Song, Ri Kyong Sik) for $88 million IT worker fraud scheme over six years. State Department simultaneously offers $5 million Rewards for Justice bounty on the companies.(2024-12-11:dprk-it-worker-network-overseas-scheme)event
↯fbdbba33
Google/Mandiant documents sharp increase in extortion attempts by DPRK IT workers, coinciding with increased law enforcement pressure. Workers begin targeting larger organizations.(2024-10-01:dprk-it-worker-network-overseas-scheme)event
↯9a1cff88
DOJ arrests Nashville-based facilitator Matthew Isaac Knoot; disrupts North Korean remote IT worker fraud schemes. Seizures of related financial accounts.(2024-08-01:dprk-it-worker-network-overseas-scheme)event
↯45272a17
DOJ launches DPRK RevGen: Domestic Enabler Initiative under National Security Division and FBI Cyber and Counterintelligence Divisions, specifically targeting U.S.-based laptop farm operators.(2024-03-01:dprk-it-worker-network-overseas-scheme)event
↯0a37142a
Sim Hyon Sop indicted for conspiring with DPRK IT workers to generate revenue and with OTC crypto traders to launder funds; $7.74 million restrained by U.S. government.(2023-04-01:dprk-it-worker-network-overseas-scheme)event
↯5ad9968a
OFAC publishes advisory on North Korea IT Workers; first U.S. government public warning to the private sector.(2022-05-16:dprk-it-worker-network-overseas-scheme)event
↯427ebaa4
Second cohort of DPRK IT workers (Jin Sung-Il, Pak Jin-Song network) begins placing workers at U.S. companies under stolen U.S. passport identities (approximate start date per DOJ indictment).(2018-04-01:dprk-it-worker-network-overseas-scheme)event
↯25c5c4bc
Yanbian Silverstar and Volasys Silver Star begin operating; DPRK IT workers placed in U.S. companies under false identities (approximate start date per DOJ indictment).(2017-04-01:dprk-it-worker-network-overseas-scheme)event
↯e0d2ab2c
Drift Protocol publishes post-mortem attributing attack to UNC4736 (Citrine Sleet) with medium confidence based on on-chain fund flows to Radiant Capital addresses. Mandiant and law enforcement engaged.(2026-04-05:citrine-sleet-applejeus)event
↯be001b93
Attackers execute durable nonce attack on Drift Protocol using pre-signed multisig transactions dormant for over one week, draining approximately $285 million in user assets in roughly twelve minutes. Telegram channels and malware are immediately deleted.(2026-04-01:citrine-sleet-applejeus)event
↯96a99ab5
Drift operatives continue in-person meetings with contributors across multiple countries, sharing malicious links and ultimately compromising contributor devices via malicious VSCode project (tasks.json exploit) and a TestFlight iOS application.(2026-02-01:citrine-sleet-applejeus)event
↯0743d45f
Attackers onboard an Ecosystem Vault on Drift Protocol, depositing over $1 million in real capital to establish legitimacy and begin formal integration discussions.(2025-12-01:citrine-sleet-applejeus)event
↯44e5e2cc
Citrine Sleet operatives begin approaching Drift Protocol contributors at major cryptocurrency conferences, presenting as employees of a quantitative trading firm. Six-month social engineering operation commences.(2025-10-01:citrine-sleet-applejeus)event
↯82151b85
Radiant Capital publicly attributes the October 2024 $50 million exploit to UNC4736 (Citrine Sleet) following Mandiant investigation.(2024-12-09:citrine-sleet-applejeus)event
↯349e0e46
UNC4736 (Citrine Sleet) exploits compromised Radiant Capital developer devices to drain approximately $50 million from the cross-chain DeFi protocol. Three developers' multisig keys are used to approve fraudulent transactions.(2024-10-16:citrine-sleet-applejeus)event
↯f8946b28
Palo Alto Networks Unit 42 publishes Gleaming Pisces / PondRAT poisoned Python packages campaign analysis.(2024-09-01:citrine-sleet-applejeus)event
↯bf55f1b2
UNC4736 operatives send malicious ZIP file via Telegram to Radiant Capital developers, impersonating a former contractor and delivering INLETDRIFT macOS backdoor inside a PDF.(2024-09-11:citrine-sleet-applejeus)event
↯6a2cd96d
Microsoft publicly publishes Citrine Sleet CVE-2024-7971 / FudModule rootkit analysis.(2024-08-30:citrine-sleet-applejeus)event
↯0352d178
Google releases Chrome patch for CVE-2024-7971.(2024-08-21:citrine-sleet-applejeus)event
↯f107cf26
Microsoft identifies Citrine Sleet actively exploiting Chromium zero-day CVE-2024-7971 (V8 type confusion, CVSS 8.8) to deliver FudModule rootkit via exploit domain voyagorclub[.]space.(2024-08-19:citrine-sleet-applejeus)event
↯5187146e
Microsoft patches CVE-2024-38106 (Windows kernel vulnerability) as part of August Patch Tuesday.(2024-08-13:citrine-sleet-applejeus)event
↯0ddbdde2
Malicious Python packages (real-ids, coloredtxt, beautifultext, minisound) containing PondRAT backdoor uploaded to PyPI, attributed to Gleaming Pisces (Citrine Sleet) by Palo Alto Networks Unit 42.(2024-02-01:citrine-sleet-applejeus)event
↯57947f36
Mandiant publishes full 3CX supply chain compromise analysis, attributing the cascading attack to UNC4736 with high confidence of North Korean nexus.(2023-04-20:citrine-sleet-applejeus)event
↯764c4911
3CX DesktopApp supply chain compromise discovered; malicious versions 18.12.416 and earlier found to deliver SUDDENICON and ICONICSTEALER to enterprise users globally.(2023-03-01:citrine-sleet-applejeus)event
↯b002c327
Volexity documents additional AppleJeus variants including 'BloxHolder' fake trading platform distributing updated malware.(2022-12-01:citrine-sleet-applejeus)event
↯bf47ddfc
Trading Technologies website compromised via hidden IFRAME exploit (CVE-2022-0609); X_TRADER software trojanized with VEILEDSIGNAL backdoor, initiating the 3CX supply chain attack chain.(2022-02-01:citrine-sleet-applejeus)event
↯ae961140
CISA, FBI, and the Department of the Treasury issue joint advisory AA21-048A documenting seven AppleJeus malware variants and associated fake cryptocurrency trading companies targeting organizations in over 30 countries.(2021-02-17:citrine-sleet-applejeus)event
↯cfb31636
OFAC formally sanctions the Lazarus Group as an agency or instrumentality of the Government of the DPRK.(2019-09-13:citrine-sleet-applejeus)event
↯2ed4eb97
Kaspersky Lab publicly discloses Operation AppleJeus, attributing trojanized cryptocurrency trading software to the Lazarus Group.(2018-08-23:citrine-sleet-applejeus)event
↯454f65ae
AppleJeus malware samples dated June–August 2018 deployed against a cryptocurrency exchange in Asia via trojanized 'Celas Trade Pro' application from fake company 'Celas LLC.' First documented macOS malware deployment by Lazarus Group.(2018-06-01:citrine-sleet-applejeus)event
↯489f9f16
TRM Labs reports that North Korean hackers — including TraderTraitor — account for 76% of all crypto hack losses in the first four months of 2026, with $577 million stolen across two major attacks (KelpDAO and Drift Protocol).(2026-04-30:tradertraitor-unc4899)event
↯3d2decc2
KelpDAO exploited for approximately $292 million. TRM Labs attributes the attack to TraderTraitor based on pre-funding analysis traceable to known TraderTraitor laundering networks. Approximately $175 million converted to Bitcoin via THORChain.(2026-04-18:tradertraitor-unc4899)event
↯fb9efa74
Google Threat Intelligence Group (formerly Mandiant) publishes report on UNC4899's breach of an unnamed cryptocurrency firm after a developer AirDropped a trojanized archive to a corporate device. Attackers used living-off-the-cloud techniques to steal several million dollars via Kubernetes and Cloud SQL tampering.(2026-03-09:tradertraitor-unc4899)event
↯9c97525c
Chainalysis publishes 2025 crypto crime report, attributing $2.02 billion in cryptocurrency theft to North Korean actors — a record high — accounting for approximately 60% of all global crypto theft in 2025. Cumulative DPRK-attributed theft reaches approximately $6.75 billion since 2017.(2025-12-18:tradertraitor-unc4899)event
↯c3b4c6d0
Lazarus Group adopts ClickFix social engineering technique to deliver GolangGhost malware to cryptocurrency job seekers, as documented by security researchers. The campaign targets both Windows and macOS users via fake video interview platforms.(2025-04-01:tradertraitor-unc4899)event
↯5ce326c9
FBI issues IC3 PSA I-022625-PSA formally attributing the Bybit theft to North Korea's TraderTraitor, listing 51 Ethereum wallet addresses and urging industry to block related transactions.(2025-02-26:tradertraitor-unc4899)event
↯822b2b63
Bybit cold wallet transfer intercepted after TraderTraitor actors compromise a Safe{Wallet} developer machine and inject malicious JavaScript into the Safe{Wallet} AWS S3-hosted frontend. Approximately 400,000 ETH (~$1.5 billion) stolen — the largest cryptocurrency theft in history.(2025-02-21:tradertraitor-unc4899)event
↯f840ab48
FBI, DC3, and Japan's NPA issue joint attribution statement formally linking TraderTraitor to the $308 million DMM Bitcoin theft. This is the first formal government attribution of a specific TraderTraitor incident to a named currency theft.(2024-12-24:tradertraitor-unc4899)event
↯6c91d5b7
WazirX (India) loses approximately $234.9 million in digital assets from a multi-signature wallet. A joint statement by the U.S., South Korea, and Japan in January 2025 attributed the attack to North Korean Lazarus Group actors.(2024-07-18:tradertraitor-unc4899)event
↯bcc2c08e
DMM Bitcoin (Japan) loses 4,502.9 BTC (~$308 million) after TraderTraitor actors use compromised session cookies to access Ginco's communications system and manipulate a legitimate DMM transaction.(2024-05-31:tradertraitor-unc4899)event
↯9e545b2e
TraderTraitor actor posing as LinkedIn recruiter contacts Ginco employee with malicious Python script disguised as a pre-employment coding test, initiating the attack chain that ultimately leads to the $308 million DMM Bitcoin theft.(2024-03-28:tradertraitor-unc4899)event
↯74b04d08
UNC4899 (TraderTraitor) executes supply chain attack against JumpCloud, injecting malicious Ruby script into JumpCloud's command framework via spear phishing of JumpCloud employees. Fewer than five downstream cryptocurrency customers compromised. An OPSEC slip — direct connection from Pyongyang IP block — confirmed attribution.(2023-06-27:tradertraitor-unc4899)event
↯aa073b5f
Ronin Network (Axie Infinity) bridge exploited for approximately $620 million in ETH and USDC. FBI later formally attributed the attack to Lazarus Group / APT38 (overlapping with TraderTraitor). Initial access traced to a fake job offer PDF delivered to a Sky Mavis engineer.(2022-03-23:tradertraitor-unc4899)event
Data refreshes within about 10 minutes · All metrics derived from Supabase