North Korean Hackers Target Crypto Cloud Systems in Coordinated Attack
Suspected North Korean hackers exploited the React2Shell vulnerability to breach crypto companies, stealing AWS credentials and infiltrating cloud systems. Security researchers at Ctrl Alt Intel traced the attacks to a South Korea-based server, though attribution remains inconclusive.
The threat group compromised private keys, configuration data, and source code from staking platforms and exchange providers, including ChainUp. Docker images were also exfiltrated, highlighting the attackers' focus on infrastructure critical to digital asset operations.
The incident underscores persistent security gaps in crypto cloud environments, with stolen credentials enabling lateral movement across systems. The origin of the compromised AWS access remains unknown, complicating mitigation efforts.
