State-Sponsored Financially Motivated Attacks
Contents
This is a presentation delivered at Melbourne AISA in October 2023 about a nation state investigation targeting the cryptocurrency industry.
State-Sponsored Financially
Motivated Attacks
Connecting the dot to a sophisticated threat actor
Thomas Roccia
Sr. Security Researcher at Microsoft
@fr0gger_
Sr. Security Researcher at Microsoft
Author of Visual Threat Intelligence
https://SecurityBreak.io
@Fr0gger_
🤓 THOMAS ROCCIA
The Correlation Between Cryptocurrency Markets and
Nation State Interest
A Detailed Analysis of a Targeted Attack
Examining the Bigger Picture: Connecting the Dots
🔍 What will be covered?
🤑 Cryptocurrency Industry Overview
The market size is anticipated to reach
$7 billion by 2032 according to predictions.
In September 2023, the price of
BTC was approximately $26,321.
🏦 Interest in Cryptocurrency
Among Nation-States
☠️ Targeted Attack by Citrine Sleet Overview
Citrine Sleet
North Korea
Focus on targeting financial
institutions and
cryptocurrency exchanges.
Use of social media, supply
chain attacks, trojanised
apps, lure and decoy.
☠️ Targeted Attack by Citrine Sleet Overview
🤝The Initial Step: Establishing Trust
Cryptocurrency investment groups on
Telegram
In the specific attack, the attackers got in
touch with their target on October 19, 2022
Created a secondary Telegram group with the
name <>
OKX …
State-Sponsored Financially
Motivated Attacks
Connecting the dot to a sophisticated threat actor
Thomas Roccia
Sr. Security Researcher at Microsoft
@fr0gger_
Sr. Security Researcher at Microsoft
Author of Visual Threat Intelligence
https://SecurityBreak.io
@Fr0gger_
🤓 THOMAS ROCCIA
The Correlation Between Cryptocurrency Markets and
Nation State Interest
A Detailed Analysis of a Targeted Attack
Examining the Bigger Picture: Connecting the Dots
🔍 What will be covered?
🤑 Cryptocurrency Industry Overview
The market size is anticipated to reach
$7 billion by 2032 according to predictions.
In September 2023, the price of
BTC was approximately $26,321.
🏦 Interest in Cryptocurrency
Among Nation-States
☠️ Targeted Attack by Citrine Sleet Overview
Citrine Sleet
North Korea
Focus on targeting financial
institutions and
cryptocurrency exchanges.
Use of social media, supply
chain attacks, trojanised
apps, lure and decoy.
☠️ Targeted Attack by Citrine Sleet Overview
🤝The Initial Step: Establishing Trust
Cryptocurrency investment groups on
Telegram
In the specific attack, the attackers got in
touch with their target on October 19, 2022
Created a secondary Telegram group with the
name <>
OKX …