Threat Actor Profile
Dalton Hunter
August 2026
Threat Actor Profile: DPRK State-Sponsored Cyber Operation

TraderTraitor

aka Jade Sleet (Microsoft) · UNC4899 (Mandiant) · Slow Pisces · Lazarus / APT38 subgroup
Threat Level: Critical
Section 01

Actor Profile

Key Findings

  • OriginDPRK state-sponsored actor assessed to operate under North Korea's Reconnaissance General Bureau and tracked as a Lazarus subgroup.
  • Primary TargetCryptocurrency and blockchain organizations, particularly developers, sysadmins, and DevOps personnel.
  • Initial AccessSocial engineering, fake job offers, compromised credentials, and increasingly third-party supply-chain compromises.
  • Primary ObjectiveCryptocurrency and digital asset theft through stolen credentials, private keys, and compromised infrastructure.
  • Operating MethodPatiently maps cloud environments and trusted third-party infrastructure before executing high-value theft.
  • Defense PrioritiesProtect developer accounts, enforce least-privilege IAM, secure third-party dependencies, and monitor unauthorized cloud activity.
Section 02

Kill Chain & MITRE ATT&CK Mapping

TraderTraitor's kill chain centers on social engineering a single developer or engineer, then pivoting stolen credentials into cloud and supply-chain access; dwell time before the final theft can run to weeks as the actor quietly maps the environment.

01

Reconnaissance & Resource Development

Establish Accounts: Cloud Accounts

Infrastructure staging: Domains such as getstockprice[.]com registered ahead of time to host payloads and blend AWS-bound command-and-control traffic with legitimate cloud calls.

Analyst Note

Infrastructure is quietly stood up well before a target is ever contacted.

02

Initial Access

Phishing

Recruiter lures on LinkedIn: A fake high-paying job offer leads the target to a malicious PDF, a "coding test" Python script, or a trojanized cryptocurrency application built on Node.js/Electron.

Supply Chain Compromise

Third-party vendor compromise: A trusted supplier's code or hosting is poisoned instead of attacking the end target directly, as in the Safe{Wallet} AWS S3 compromise that preceded the Bybit theft.

Valid Accounts: Cloud Accounts

Stolen developer credentials: A compromised workstation yields an AWS session token or similar cloud credential, granting the actor access without needing further exploitation.

Analyst Note

Nearly every intrusion starts with one person being socially engineered, not a technical exploit.

03

Persistence & Discovery

Create Account: Cloud Account

IAM manipulation: New or modified IAM users, roles, and keys maintain access; in the Bybit case the actor also attempted to register a virtual MFA device to solidify a foothold.

Cloud Service Discovery

Extended environment mapping: S3 buckets, IAM roles, and CloudFront distributions are enumerated over a multi-day dwell period (roughly 12 days in the Bybit intrusion) to locate the highest-value target.

Analyst Note

The actor is patient, spending days mapping the cloud environment before touching anything of value.

04

Defense Evasion

Impair Defenses: Disable or Modify Cloud Logs

Evidence minimization: Malicious code is later removed from S3 buckets and related objects to reduce the CloudTrail trail left for investigators.

Modify Cloud Compute Infrastructure: Modify Security Groups

Injected JavaScript: Malicious code inserted into a hosted frontend bundle alters transaction payloads while appearing to be legitimate application logic.

Analyst Note

Cleanup of cloud logs happens quickly after the theft to slow down incident response.

05

Impact

Resource Hijacking

Hijacked hosting infrastructure: A trusted S3-hosted frontend is repurposed to serve malicious code that only triggers against a specific, pre-identified target wallet.

Financial Theft

Large-scale crypto withdrawal: Altered transaction payloads or forged approvals reroute funds to actor-controlled wallets, followed by rapid swapping, splitting, and layering through mixers.

Analyst Note

The theft itself is nearly instantaneous once the final trigger condition is met; the laundering that follows is where the money disappears.

Section 03

Indicators of Compromise

TraderTraitor rebuilds tooling and infrastructure per campaign, so durable indicators center on tradecraft patterns and reported artifacts rather than a single fixed toolkit.

Reported patterns & behavior

Indicator / BehaviorTypeNotes
getstockprice[.]comInfrastructureNamecheap-registered domain reported as staging infrastructure ahead of the Bybit intrusion
_app-52c9031bfa03da47.jsMalicious fileInjected JavaScript bundle used to alter Bybit's multisig transaction payload
PLOTTWIST / TIEDYEMalwareReported custom macOS backdoors used for initial foothold and follow-on access
RN LoaderMalwareInstalls an information stealer, then self-deletes to reduce forensic footprint
Trojanized Electron/Node.js crypto appsMalwareCross-platform malicious applications distributed as legitimate-looking trading or wallet tools
Unauthorized S3 / IAM changesBehaviorNew IAM users, roles, or MFA registrations appearing outside normal CI/CD workflows
Analyst Note

Because malware and infrastructure are rebuilt often, behavioral indicators like recruiter-style outreach and unexplained IAM changes are more durable than any single file hash or domain.

Section 04

Detection & Mitigation Priorities

Ordered by impact-to-effort ratio for a crypto or blockchain-adjacent organization.

  • P1Train developers and DevOps staff on recruiting-lure social engineering, especially unsolicited LinkedIn job offers requesting a code sample or test download.
  • P1Enforce MFA and least-privilege IAM across all cloud accounts, with short-lived credentials in place of long-lived access keys.
  • P1Alert on new IAM users, roles, or MFA device registrations occurring outside automated CI/CD pipelines.
  • P2Enable multi-region CloudTrail logging with Object Lock on critical buckets to prevent silent log or artifact deletion.
  • P2Vet and monitor third-party vendors and dependencies (wallet providers, npm packages) that can inject code into production frontends.
  • P3Rotate credentials immediately after any suspected developer workstation compromise, and correlate GuardDuty/Config findings with first-time access patterns.
Analyst Note

Because the entry point is almost always a person, not a vulnerability, awareness training and IAM discipline stop more TraderTraitor intrusions than any single technical control.

Section 05

References