ETV investigative show "Pealtnägija" found out more.

Last Friday, news spread of the largest cyber theft in history: hackers allegedly linked to North Korea stole a whopping $6.3 billion worth of cryptocurrency.

"When North Korean or Russian intelligence comes after you, they don't wave a red five-pointed star or wear military caps," said cybersecurity expert Tõnu Samuel, himself a legendary former hacker. The 54-year-old was caught up in a scheme in which hackers linked to North Korea tried to steal cryptocurrency and confidential information. This began on September 16 this year, when someone calling himself Muhammad Raza contacted Samuel on LinkedIn, presenting himself as the head of an AI company in Dubai and offering him a job. Fortunately, Samuel was wise to it.

"The message was broadly along the lines that I had an impressive profile, that I knew how to do everything. He started by praising me and said they had a project that involved a lot of buzzwords. That was the first red flag. When someone bombards you with buzzwords, they're usually a scammer," Samuel recalled.

"That's the whole point of the scheme: it is tailored to the right person according to their profile and skills," said Nikolai Kunitsõn, an analyst at the Information System Authority's (RIA) analysis and prevention department. "Tõnu quickly identified that this was a suspicious scheme and played along. That allowed us to obtain more detailed information about how it works."

The offer was not entirely uninformed either — Samuel's LinkedIn profile states he is chief engineer of a cryptocurrency company — but it contained empty, outdated phrases. There were more red flags too: the message came from Dubai, but the company he claimed to represent was an Argentine one.

Kunitsõn and Ago Ambur, former head of the Police and Border Guard Board's cybercrime bureau and now CEO of background-check firm Glazer Technologies, confirm the case was one of North Korea's attack schemes.

"North Korea is a strange country, with a population about 12 to 13 times larger than Estonia's and a GDP about a third of it, but they are major players in the cyber world," Kunitsõn noted.

North Korean hackers first drew worldwide attention back in 2014, when Sony Pictures — which had made "The Interview", a film mocking the dictatorship — was hacked, its internal correspondence published.

"The broader objective was to pressure the company into canceling or postponing the film's release, but the result was that the film received much more attention," Ambur said.

Two years later they exploited a previously unknown weakness in the SWIFT payment system. "They executed the attack with extraordinary precision and were caught out only due to a silly typo. Otherwise, they would have managed to steal more than a billion dollars," Kunitsõn said.

The group most associated with the country is Lazarus, which spread the WannaCry ransomware in 2017 — which also affected Estonia. Experts say the main objective remains financial.

"North Korea is one of the most heavily sanctioned countries in the world. Activities in cyberspace allow it to circumvent sanctions, and the main objective is to finance the regime and its weapons programs," Kunitsõn noted.

"According to estimates, which most likely underestimate the scale, they have stolen between six and eight billion dollars over the years," he added.

Estonia has not been untouched. The Internal Security Service's (KAPO) 2021 annual review said North Korean cyberattacks had been targeting Estonian diplomats while Estonia was a non-permanent member of the UN Security Council; the Foreign Intelligence Service (Välisluureamet) devoted a separate chapter to North Korean aggression in its most recent report.

"The FBI has publicly attributed the 2023 attacks against two Estonia-linked business entities to North Korean hackers. Around $150 million was stolen from them," Ambur said.

"We are not a priority for North Korea, but the more our IT sector develops and the more people accumulate crypto assets, the more attention they will pay to us," Kunitsõn added.

More recently, social engineering schemes have drawn attention: several Western countries have uncovered cases in which people linked to North Korea secured remote jobs by posing as IT specialists. "Using stolen identities, they apply for jobs, complete test assignments and work remotely. There are groups of North Koreans, mostly living in China or Russia, whose sole job is to keep applying for positions," Kunitsõn explained.

Samuel himself had encountered exactly such a recruiter. After exchanging messages, they arranged a video call, on September 22. "For a second, a bald man appeared on the screen who looked more Arab than anything else," Samuel recalled. "He said he was turning off his camera because his internet connection was slow. That was a warning sign for me."

Then came the test assignment. "He asked me to open a repository. In software terminology, that's a place where you can access all the source code at once," Samuel said.

"There's nothing unusual about being asked to complete a test assignment," Kunitsõn said. "It generally means a developer has to download pieces of code from a common platform, such as GitHub, to demonstrate their skills."

"I was asked to open it up. Developers commonly use a tool called Cursor. I happened to have it installed, although I hadn't opened it for years. I opened the files, and at that exact moment my computer got infected," Samuel recalled.

"Inside the software was a sequence that wouldn't mean anything at first glance, even to a complete professional. It didn't look suspicious, but in reality the code established a connection, and began waiting for commands," he said.

"That surprised and even angered me — it's 2026 and we have software on our computers that doesn't warn us when code does something unauthorized."

"That's both the ingenuity and the danger of the scheme," Kunitsõn said. "A piece of code downloaded from GitHub appears legitimate, and the people behind these schemes are technically very capable. That's why RIA's prevention campaign emphasizes that people must not click on unfamiliar links."

Samuel had taken protective measures. Because he works with sensitive clients, he wanted to know whether the attackers were after secrets or money. "I monitored what was happening and realized they were only looking for money — cryptocurrency wallets and similar things," he said. He removed the malware and sent a detailed report to RIA and the platforms involved.

RIA has now received similar reports from three victims in Estonia, one of whom lost €10,000 worth of cryptocurrency, and issued a warning on October 20.

The response from platforms outside Estonia was less enthusiastic. "Google rejected the detailed description, saying the email was too suspicious. GitHub accepted the report and deleted the malware, which was the right thing to do. But the LinkedIn profile is still active a month later," Samuel said.

"After a lot of pestering, LinkedIn announced that they had instead closed my account because it had been compromised and that I needed to verify my identity with a copy of my passport. In reality, my account isn't closed — they have no idea what they're doing."

A background check found the identity to be fake, though it incorporated real people: the face belonged to Muhammad Raza Shakeel, a Pakistani national living in Dubai whose accounts had been hacked. The company he supposedly represented had existed but ceased operations a couple of years ago, and he had never worked there.

"Identities are created from scratch on a fictitious basis, someone else's online identity is used, or recruiters exploit the candidates' own data," Ambur explained.

According to the experts, Estonia is not a specific target, but with the interconnected nature of the world, we are still exposed here — and it is particularly worrying that these attacks target IT specialists.

"They get hold of a real chief engineer who has access to everything, who infects an entire company, and whose employees then infect other places in turn. The risk is enormous, and I don't see a good countermeasure," Samuel warned.

Those words proved prophetic. The interview took place on Thursday, and just the following night, alleged North Korean hackers broke into Binance, one of the largest cryptocurrency exchanges, and stole $6.3 billion. Pyongyang denies involvement.

"This is by far the largest theft of money in history. The previous record was also attributed to North Korea and amounted to $1.5 billion. It is believed that the initial intrusion was achieved through a compromised developer's computer," Kunitsõn noted. According to the latest reports, a fake job offer similar to the one Samuel received played a central role.

"The attacks are evolving: today it's a job offer, tomorrow they'll approach from another angle, and the chances of recognizing the attack will fall sharply," Samuel concluded.

Last week brought a succession of reports that several IT companies were laying off staff — meaning people looking for new jobs may find themselves in a vulnerable position too.

--

Follow ERR News on Facebook and Twitter and never miss an update!