I blogged about this earlier this year - I think they reached out to me as part of my crate work and tried to get me to download a booby-trapped repo with a remote shell.
Insidious attack, it felt very real, they had a compelling fake network of sites and companies
There was a DND episode about fake online schools run from overseas springing up to soak up US college grant money that was being given out. The schools were built well enough to fool some one not that interested into thinking they were a real (but probably kind of crappy) school and had actual online classrooms with minimal assignments. Every time the government got wise to one they'd just shut it down and spin up a new school with new materials to stay ahead.
IIRC this before AI so I expect this kind of thing to accelerate since it should be a lot easier to spin up a whole fake narrative for some one to investigate. And since so many real companies are now using AI generated websites with AI generated images or even conducting early interviews with AI recruiter avatars recognizing AI generated sites won't even be an actual tell.
The age of per person bespoke scams for increasingly small potential payoffs is upon us.
I think the lack of actual building suite/street address in the email signature in the very first email would have immediately made me extremely suspicious. That's about as good as "Totally real business address, trust me bro, Singapore".
Also some kind of company main phone number in an email sig is a thing I'm expecting, even if it almost certainly goes to an IVR system, or the email sig doesn't have an extension number in it. But if a person is reaching out to me with a hand crafted email I'm also going to consider them a bit more suspiciously if there's no phone contact in the email sig.
Further, .xyz or similar as a company domain name is pretty damn suspicious when, for example, luaventures.net isn't taken as a domain name. 99% of the time when I see .xyz it's spam/scam/phishing disposable domains.
----------------
edit: looks like the website still exists: https://www.luaventures.xyz/ (open in sandbox, do not download anything, caution, etc!)
Googling luaventures.xyz turns up all sorts of weird things.
The C2 IP mentioned in the writeup appears to be a /24 of some small hosting company in the UAE.
There were obvious signs that things should look fishy, but I understand people cannot be vigilant all the time, and hence the trap. Once way to keep remining employees and staff is constant refresher courses. But this has been a problem haunting my workspace as well
I really hope someone is able to obtain a screen-recording video of this as an example. I'd like to see just how good the 'fake' person on the other end really is... To date all the reports of this have been in written text form after the fact.
Read the article! They used "pre-recorded videos of previous victims the target is acquainted with to simulate a legitimate call – except that the audio would appear to malfunction."
I said 'fake', not AI. Pre-recorded video of a person from the other end with broken audio, that's a known scam technique that's been used for close to 15 years now to bait horny men on the internet for extortion and other purposes. Very well known threat model. The scammers collect a set of attractive looking pre-recorded videos of some camgirl and run it in a loop as a virtual webcam device, then pretend to have microphone/audio malfunctions.
If I'm put into a meeting with someone I recognize and their audio is broken I'm going to attempt to get an answer from them by text chat on what's going on before I go clicking any links or downloading anything.
If it's as good as the AI videos in our security training, then the fake person was really good.
On a related note, trying to get my parents to understand that they can no longer trust people in videos, even if it's me or my 8yo niece begging for ransom money, has been a real struggle.
I wonder how the AI video handles unusual requests for actions. If anyone remembers some of the classic 419 scam baiting sites where the scambait people got the scammers to take a real photo of themselves with a shoe balanced on top of their head... If I think I'm talking to an AI, I might make a similar request.
If it's a close friend or colleague and they get such a ridiculous request from me like "Hey just to confirm you're a real human, show me an object from your desk and balance it on top of your head", they'll understand why I'm doing it and why it's mildly humorous in the present threat environment.
The DPRK noted that Donald Trump said that he would take possession of recovered stolen crypto as a state reserve. Their media noted dryly that when the coins are recovered, it would be good to watch where they go and that information should lead one to ask qui bono.
The funny think about the DPRK is that because no one will ask a single critical question about something bad said about them, you can say literally anything and pin the blame on them.
Kind of interesting we care about NK when they steal fictional digiBux but don't care about them torturing men, women, and children in the gulags for the past several decades.
The big takeaway of the 30 years war was that sovereign nations have the right to deal with their domestic affairs themselves. If you don't like what they do in their own borders with their own citizens you can send them strongly worded letter or refuse to trade with them, but you don't go to war over it. Because that way lies madness (and multi-decade religious wars)
And we are sending NK strongly worded letters and refuse to trade or otherwise engage with them. There is really not much else we can do
But stealing fictional digiBux from Binance is not a domestic affair. You could theoretically go to war with NK over it (though this would obviously be ill-advised for other reasons)
This is a real "thoughts and prayers" type situation because I basically have zero sympathy for those affected by this. There's really no reason for crypto to exist. You're kind of on your own. I view reversible transactions and the like as a feature not a bug. Every one of these crypto thefts is the fruit of irreversible transactions that crypto advocates wanted.
Live by the sword, die by the sword.
Don't get me wrong: I love reading about the ingenuity involved in these hacks. Keep em coming. The Ledger chip hack was particularly impressive from a technical POV.
There definitely are some reasons, precisely when reversibility works against you: eg. when bad authorities wrongly target you or censor you. Crytocurrencies give us payment networks that work even where traditional systems fail. No denied transactions. No limits. No "account" to open. Works for the underbanked. Send money truly anytime anywhere. No other system does this. That's the value.
It's absolutely possible that you personally have no reason to use crypto. But others don't have the same experience as you due to where they live, what political party they support, what they do, etc. There is a lot of censorship and oppression in the world.
I’m mildly pro-crypto but I also believe that FBI shouldn’t be getting invovled in recovering “stolen” crypto. If you lose your keys, whether by incompetence or a scam, that’s that. Whoever has the keys owns the crypto. Trying to impose government-sanctioned concepts of ownership or theft beyond this is defeating the purpose.
You’ll get downvoted, but I’m totally with you. Very interesting write ups and lots of ingenuity in the hack, very/completely unsympathetic targets of the hack.
The problem with this kind of thinking of "they deserve it because they engage in something I find wrong" is that almost everyone does at least one thing that one group or another considers "wrong" in some way: Eating meat, using AI, flying, taking cruise ships, driving a car, eating pork, drinking alcohol, smoking, being too tolerant or not tolerant enough towards someone or something, dressing wrong, working in the wrong industry, supporting the wrong political party, ...
Fools and there money, but I do not like the idea of North Korea illegally gathering money in any form. While I don't care whether cryptobros loose money, I don't want to see that money go to such a regime.
Well, i think you would need to be extremely creative to make me fall prey for this, as i do not do any video call at all, don't even have a cam or mic on my PC and, most important, don't have any crypto that could be stolen from me. :)
I blogged about this earlier this year - I think they reached out to me as part of my crate work and tried to get me to download a booby-trapped repo with a remote shell.
Insidious attack, it felt very real, they had a compelling fake network of sites and companies
There was a DND episode about fake online schools run from overseas springing up to soak up US college grant money that was being given out. The schools were built well enough to fool some one not that interested into thinking they were a real (but probably kind of crappy) school and had actual online classrooms with minimal assignments. Every time the government got wise to one they'd just shut it down and spin up a new school with new materials to stay ahead.
IIRC this before AI so I expect this kind of thing to accelerate since it should be a lot easier to spin up a whole fake narrative for some one to investigate. And since so many real companies are now using AI generated websites with AI generated images or even conducting early interviews with AI recruiter avatars recognizing AI generated sites won't even be an actual tell.
The age of per person bespoke scams for increasingly small potential payoffs is upon us.
Do you have a link? I’d be curious to read it
https://grack.com/blog/2026/06/25/dissecting-a-failed-nation...
I think the lack of actual building suite/street address in the email signature in the very first email would have immediately made me extremely suspicious. That's about as good as "Totally real business address, trust me bro, Singapore".
Also some kind of company main phone number in an email sig is a thing I'm expecting, even if it almost certainly goes to an IVR system, or the email sig doesn't have an extension number in it. But if a person is reaching out to me with a hand crafted email I'm also going to consider them a bit more suspiciously if there's no phone contact in the email sig.
Further, .xyz or similar as a company domain name is pretty damn suspicious when, for example, luaventures.net isn't taken as a domain name. 99% of the time when I see .xyz it's spam/scam/phishing disposable domains.
----------------
edit: looks like the website still exists: https://www.luaventures.xyz/ (open in sandbox, do not download anything, caution, etc!)
Googling luaventures.xyz turns up all sorts of weird things.
The C2 IP mentioned in the writeup appears to be a /24 of some small hosting company in the UAE.
inetnum: 89.124.107.0 - 89.124.107.255 netname: VDSINA country: NL geofeed: https://vdsina.com/geofeed_as216071.csv geoloc: 52.309711 4.935438 admin-c: SK15998-RIPE tech-c: SK15998-RIPE status: ASSIGNED PA mnt-by: servers-tech-mnt created: 2025-11-12T07:06:42Z last-modified: 2025-11-12T07:06:42Z source: RIPE
role: SERVERS TECH FZCO address: UNITED ARAB EMIRATES address: Dubai address: 336469 address: Ifza Business Park DDP, Building 1, office number 36298-001 nic-hdl: SK15998-RIPE mnt-by: lir-ae-servers-tech-1-MNT created: 2023-10-25T09:55:18Z last-modified: 2024-07-10T12:05:37Z source: RIPE # Filtered
% Information related to '89.124.107.0/24AS216071'
route: 89.124.107.0/24 origin: AS216071 mnt-by: servers-tech-mnt created: 2025-11-12T07:08:49Z last-modified: 2025-11-12T07:08:49Z source: RIPE
There were obvious signs that things should look fishy, but I understand people cannot be vigilant all the time, and hence the trap. Once way to keep remining employees and staff is constant refresher courses. But this has been a problem haunting my workspace as well
Related: https://www.theguardian.com/world/2026/oct/30/how-crypto-hac...
Cryptocurrency theft is estimated to generate half of the country’s foreign currency income
And here I was complaining that crypto is of no use. I should be ashamed of myself.
I really hope someone is able to obtain a screen-recording video of this as an example. I'd like to see just how good the 'fake' person on the other end really is... To date all the reports of this have been in written text form after the fact.
Read the article! They used "pre-recorded videos of previous victims the target is acquainted with to simulate a legitimate call – except that the audio would appear to malfunction."
So it is not an AI video here.
I said 'fake', not AI. Pre-recorded video of a person from the other end with broken audio, that's a known scam technique that's been used for close to 15 years now to bait horny men on the internet for extortion and other purposes. Very well known threat model. The scammers collect a set of attractive looking pre-recorded videos of some camgirl and run it in a loop as a virtual webcam device, then pretend to have microphone/audio malfunctions.
If I'm put into a meeting with someone I recognize and their audio is broken I'm going to attempt to get an answer from them by text chat on what's going on before I go clicking any links or downloading anything.
If it's as good as the AI videos in our security training, then the fake person was really good.
On a related note, trying to get my parents to understand that they can no longer trust people in videos, even if it's me or my 8yo niece begging for ransom money, has been a real struggle.
I wonder how the AI video handles unusual requests for actions. If anyone remembers some of the classic 419 scam baiting sites where the scambait people got the scammers to take a real photo of themselves with a shoe balanced on top of their head... If I think I'm talking to an AI, I might make a similar request.
If it's a close friend or colleague and they get such a ridiculous request from me like "Hey just to confirm you're a real human, show me an object from your desk and balance it on top of your head", they'll understand why I'm doing it and why it's mildly humorous in the present threat environment.
The DPRK noted that Donald Trump said that he would take possession of recovered stolen crypto as a state reserve. Their media noted dryly that when the coins are recovered, it would be good to watch where they go and that information should lead one to ask qui bono.
The funny think about the DPRK is that because no one will ask a single critical question about something bad said about them, you can say literally anything and pin the blame on them.
https://coinpedia.org/research-report/u-s-strategic-bitcoin-...
Honestly, is crypto good for anything other than crimes and North Korea's budget?
Helping people escape, or operate within, authoritarian regimes, is probably the most charitable answer.
If you wanted one.
Kind of interesting we care about NK when they steal fictional digiBux but don't care about them torturing men, women, and children in the gulags for the past several decades.
The big takeaway of the 30 years war was that sovereign nations have the right to deal with their domestic affairs themselves. If you don't like what they do in their own borders with their own citizens you can send them strongly worded letter or refuse to trade with them, but you don't go to war over it. Because that way lies madness (and multi-decade religious wars)
And we are sending NK strongly worded letters and refuse to trade or otherwise engage with them. There is really not much else we can do
But stealing fictional digiBux from Binance is not a domestic affair. You could theoretically go to war with NK over it (though this would obviously be ill-advised for other reasons)
https://en.wikipedia.org/wiki/Westphalian_system
What do you suggest the west do in response that isn't already being done? North Korea is completely isolated in large part due to this.
We definitely care about that. Especially since stolen money funds their gulags.
This is a real "thoughts and prayers" type situation because I basically have zero sympathy for those affected by this. There's really no reason for crypto to exist. You're kind of on your own. I view reversible transactions and the like as a feature not a bug. Every one of these crypto thefts is the fruit of irreversible transactions that crypto advocates wanted.
Live by the sword, die by the sword.
Don't get me wrong: I love reading about the ingenuity involved in these hacks. Keep em coming. The Ledger chip hack was particularly impressive from a technical POV.
"There's really no reason for crypto to exist"
There definitely are some reasons, precisely when reversibility works against you: eg. when bad authorities wrongly target you or censor you. Crytocurrencies give us payment networks that work even where traditional systems fail. No denied transactions. No limits. No "account" to open. Works for the underbanked. Send money truly anytime anywhere. No other system does this. That's the value.
It's absolutely possible that you personally have no reason to use crypto. But others don't have the same experience as you due to where they live, what political party they support, what they do, etc. There is a lot of censorship and oppression in the world.
I’m mildly pro-crypto but I also believe that FBI shouldn’t be getting invovled in recovering “stolen” crypto. If you lose your keys, whether by incompetence or a scam, that’s that. Whoever has the keys owns the crypto. Trying to impose government-sanctioned concepts of ownership or theft beyond this is defeating the purpose.
You’ll get downvoted, but I’m totally with you. Very interesting write ups and lots of ingenuity in the hack, very/completely unsympathetic targets of the hack.
The problem with this kind of thinking of "they deserve it because they engage in something I find wrong" is that almost everyone does at least one thing that one group or another considers "wrong" in some way: Eating meat, using AI, flying, taking cruise ships, driving a car, eating pork, drinking alcohol, smoking, being too tolerant or not tolerant enough towards someone or something, dressing wrong, working in the wrong industry, supporting the wrong political party, ...
Crypto now exists to solely to fund Kim Jong Un's regime
/s (kinda)
Fools and there money, but I do not like the idea of North Korea illegally gathering money in any form. While I don't care whether cryptobros loose money, I don't want to see that money go to such a regime.
"If you can't imagine a scenario where you might fall prey to it, you are not thinking creatively enough."
I dunno, maybe I'm being smug but I don't think I would fall for this.
Thing with scams is 98% of them are obvious and dumb, but 2% hit your blind spot or vulnerability, and you end up owned.
Well, i think you would need to be extremely creative to make me fall prey for this, as i do not do any video call at all, don't even have a cam or mic on my PC and, most important, don't have any crypto that could be stolen from me. :)