PROFILING TRADETRAITOR: TACTICS, HISTORY & DEFENSES

Summary from the TLDR InfoSec newsletter

TradeTraitor, a North Korean threat actor, has stolen over $2.4 billion through social engineering and cloud attacks, compromising developer credentials to inject malicious code and reroute ETH. Its attacks involve harvesting AWS tokens, injecting JavaScript into cloud applications, with defenses including short-lived tokens, full CloudTrail logs, MFA, and credential monitoring.