Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · TraderTraitor · Unknown · assessed origin North Korea · misp-galaxy · refreshed 2026-10-06 · on the wire

TraderTraitor

  • Jade Sleet
  • UNC4899
  • Pukchong

sigil · no ATT&CK coverage stated

Last 30 days

last seen 9 d ago
dispatches4
victims0
CVEs seen0

What changed

ledger · newest first
  1. —28 d agoresurfacedback on the wire — nothing in the previous 30 days

Analyst brief

misp-galaxy

TraderTraitor targets blockchain companies through spear-phishing messages. The group sends these messages to employees, particularly those in system administration or software development roles, on various communication platforms, intended to gain access to these start-up and high-tech companies. TraderTraitor may be the work of operators previously responsible for APT38 activity.

On the wire

1 dispatch · newest first
  1. Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2022TraderTraitor: North Korean State-Sponsored APT Targets Blockchain CompaniesCISA ↗

Take it with you

keyless · no signup

References

4 sources
  1. 1.mandiant.com/resources/blog/north-korea-supply-chain
  2. 2.us-cert.cisa.gov/ncas/alerts/aa22-108a
  3. 3.mandiant.com/resources/blog/north-korea-cyber-structure-alignment-2…
  4. 4.cloud.google.com/blog/topics/threat-intelligence/cyber-threats-targetin…

Track TraderTraitor on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.