Full Report
The North Korean threat actor known as UNC4899 is suspected to be behind a sophisticated cloud compromise campaign targeting a cryptocurrency organization in 2025 to steal millions of dollars in cryptocurrency. The activity has been attributed with moderate confidence to the state-sponsored adversary, which is also tracked under the cryptonyms Jade Sleet, PUKCHONG, Slow Pisces, and
Analysis Summary
# Threat Actor: UNC4899
## Attribution & Identity
UNC4899 is a North Korean state-sponsored threat actor. The group is attributed with moderate confidence to the Democratic People's Republic of Korea (DPRK) and is also tracked by the security community under the following cryptonyms:
* **Jade Sleet**
* **PUKCHONG**
* **Slow Pisces**
* **TraderTraitor**
## Activity Summary
In a sophisticated 2025 campaign, UNC4899 targeted a cryptocurrency organization to steal millions of dollars. The operation was characterized by a "personal-to-corporate" pivot, where the actor initially compromised a developer’s personal device before jumping to the corporate environment and eventually escalating into the Google Cloud Platform (GCP) infrastructure. The attack concluded with the modification of financial logic and Cloud SQL databases to facilitate unauthorized withdrawals.
## Tactics, Techniques & Procedures
* **Social Engineering:** Using deceptive ploys and lures regarding open-source project collaborations.
* **P2P Data Transfer Exploitation:** Leveraging Apple AirDrop to move trojanized files from a compromised personal device to a corporate workstation.
* **Malicious Developer Tooling:** Exploitation of AI-assisted Integrated Development Environment (IDE) workflows to execute malicious Python code.
* **Masquerading:** Deploying a malicious binary disguised as the legitimate Kubernetes command-line tool (`kubectl`).
* **MFA Manipulation:** Modifying multi-factor authentication policy attributes on bastion hosts to gain unauthorized access.
* **Living-off-the-Cloud (LotC):**
* Altering Kubernetes deployment configurations to execute bash commands automatically.
* Injecting commands into CI/CD platform resources to leak service account tokens into logs.
* **Privilege Escalation & Lateral Movement:** Using high-privileged CI/CD service account tokens to escape containers and access sensitive infrastructure pods.
* **Data/Credential Harvesting:** Extracting static database credentials stored insecurely in environment variables.
* **Database Tampering:** Utilizing Cloud SQL Auth Proxy to execute SQL commands for password resets and MFA seed updates on high-value victim accounts.
## Targeting
* **Sectors:** Cryptocurrency, Financial Services, Software Development/DevOps.
* **Geography:** Global (targeting decentralized/cloud-native organizations).
* **Victims:** An unnamed cryptocurrency organization and its high-value individual account holders.
## Tools & Infrastructure
* **Malware:**
* Trojanized archive files (Python-based).
* A backdoor masquerading as the Kubernetes CLI.
* Custom backdoors deployed via bash commands in Kubernetes pods.
* **Infrastructure:**
* Attacker-controlled C2 domains (specific URLs defanged in reporting as `[attacker-controlled domain]`).
* Cloud SQL Auth Proxy (abused).
* Google Cloud Platform (GCP) services (interacted with via authenticated sessions).
## Implications
This campaign demonstrates an advanced evolution in DPRK cyber strategy, moving beyond simple phishing to exploiting the "blurred lines" between personal and professional device usage. By targeting DevOps workflows and CI/CD pipelines, UNC4899 shows a high level of proficiency in cloud-native environments (Kubernetes, GCP), shifting from simple malware deployment to sophisticated "Living-off-the-Cloud" techniques that bypass traditional endpoint detection.
## Mitigations
* **Device Integrity:** Enforce strict policies against using P2P transfer mechanisms (like AirDrop) or personal devices for corporate data/development work.
* **Cloud Security Posture Management (CSPM):** Regularly audit Kubernetes deployment configurations and MFA policies for unauthorized changes.
* **Secrets Management:** Avoid storing static credentials in environment variables; use dedicated secret management services (e.g., Google Cloud Secret Manager).
* **CI/CD Hardening:** Monitor CI/CD logs for unusual commands or the output of sensitive tokens. Restrict the permissions of CI/CD service accounts using the principle of least privilege.
* **Network Segmentation:** Implement strict network policies to prevent pods from accessing sensitive infrastructure or management planes unless strictly required.