Radiant Capital Breach Update: North Korean Hackers Pose as Former Contractor to Send Malware for Attack

BlockBeats News, December 9th, according to Cointelegraph, Radiant Capital stated in an updated survey report on December 6th that cybersecurity company Mandiant has assessed with high confidence that this attack was carried out by a North Korean (DPRK)-affiliated threat actor.

The platform stated that a Radiant developer received a Telegram message on September 11th containing a compressed file from a "trusted former contractor," requesting feedback on an upcoming project they were planning. Upon review, this message appeared to be from a North Korea-aligned threat actor impersonating the former contractor. "This ZIP file, when shared with other developers for feedback, ultimately delivered malware, facilitating the subsequent intrusion."

Radiant Capital believes the threat actor responsible for this incident is known as "UNC4736" — reportedly linked to North Korea's primary intelligence agency, the Reconnaissance General Bureau (RGB), and speculated to be a sub-group of the Lazarus Group hacker organization.

Previously reported, the cross-chain lending protocol Radiant Capital experienced a cyberattack, resulting in a loss of over $50 million.