Adversary Intelligence — 2026-04-29
North Korea-Linked Campaign Uses Fake Zoom Meetings to Target Crypto Executives
Security researchers identified a North Korea-linked campaign using fraudulent Zoom meeting invitations to deploy malware against cryptocurrency firm executives, according to TechRadar. The attackers completed the full compromise cycle in under five minutes, exploiting the urgency of what appeared to be a legitimate business meeting. The campaign targeted individuals with privileged access to signing authority, treasury controls, or custody credentials at cryptocurrency firms.
Analysis
NK-linked actors, likelyLazarus Group or affiliated clusters, have compressed the social engineering compromise cycle to under five minutes, a tempo that defeats most enterprise detection windows. Targeting executives with signing authority and custody credentials signals strategic theft preparation, not opportunistic reconnaissance. Per a single TechRadar report with no independent corroboration, the described tactics align closely with well-documented DPRK tradecraft. It is very likely at least one publicly disclosed theft exceeding $10 million will result from this or a similar campaign within the next 90 days, consistent with Lazarus Group's near-continuous qualifying-scale theft record. Financially motivated criminal actors may instead be mimicking DPRK tradecraft to obscure attribution, which would undermine the state-directed framing without reducing the theft risk.
NK-linked actors, likely