TraderTraitor: Deep Dive

TraderTraitor is a financially motivated North Korean subgroup of Lazarus active since at least 2020 that targets cryptocurrency exchanges, developers, and cloud/supply-chain providers using social engineering, trojanized applications, poisoned open-source packages, and cloud credential theft; the report maps their MITRE-based TTPs, catalogs malware (e.g., RN Loader/Stealer, MANUSCRYPT, GopherGrabber), describes major incidents including the DMM/Ginco $308M theft and the Bybit ~$1.5B heist, and recommends cloud-focused detection and prevention controls.