Date: 10/30/2026
Severity: High
Summary
Throughout 2026, the financially motivated North Korean threat group TraderTraitor (also tracked as UNC4899, PUKCHONG, and Jade Sleet) conducted campaigns targeting cryptocurrency-related organizations. In April, the group was linked to a major attack involving KelpDAO, resulting in the theft of approximately $292 million. The attack involved the compromise of LayerZero, a service that enables cryptocurrency transfers across different blockchain networks. KelpDAO is a decentralized finance (DeFi) protocol that supports Ethereum restaking.
Indicators of Compromise (IOC) List
Domains/URLs | technicais.sytes.net storage.hubpage.cloud grenight.com 185-66-91-112.cprapid.com 213-111-146-132.cprapid.com anesthesiaschool.com app.heyhay.online dela.servehttp.com galaxy-royal.online game.galaxy-royal.online grenight.com heyhay.online mactroubleshoots.pro mx01.galaxy-royal.online ns4.galaxy-royal.online storage.hubpage.cloud tinklify.com update.heyhay.online vaimage.com wss.sytes.net www.anesthesiaschool.com www.freehealth.lat www.heyhay.online www.mactroubleshoots.pro www.tinklify.com https://github.com/exubient0/terraform-candidate-repo/blob/main/.terraform.lock.hcl https://github.com/radupopa369/gtn-candidate-repo/blob/feat/three-tier-infrastructure/live/.terraform.lock.hcl https://github.com/chainstacker/Northwind-IAC/blob/930e5be6d34511bedbfb0d762bd08fffe64e9630/aws/us-east-1/prod/northwind/global/vpc/.terraform.lock.hcl https://github.com/RyanLRay/Technical-Assessments/blob/19af09ebe8b7ad03419677dda515507dd099bc39/README.md?plain=1#L175 |
IP Address | 176.97.114.232 45.11.59.140 85.137.56.245 85.137.56.10 |
Hash | 02df07a173ab03b82a4fb6a08973fff8b1467f28
c491d477dbe0ae04e9aed9dbe237144c03f73ec4
5728b11d30586bbfc1d8bd12df1c722a06e767a2
4b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daa
4ad92bf92ee614b05c340ce17bef7b6ef5a25e82
|
Filepath | ~/Library/com.apple.iTunesCloud/SystemUpdate ~/Library/com.apple.internal.ck/iSync ~/Library/com.apple.appleaccountd/loginwindow /private/tmp/.pipe-airway $TMPDIR/tmp*.lock ~/DevOps-Automation/cloudshield $HOME/.config/.repl_history |
Serial | 1cd6d13ff15adbf7a42025d10ec99b4a |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "wss.sytes.net" or url like "wss.sytes.net" or siteurl like "wss.sytes.net" or domainname like "technicais.sytes.net" or url like "technicais.sytes.net" or siteurl like "technicais.sytes.net" or domainname like "https://github.com/exubient0/terraform-candidate-repo/blob/main/.terraform.lock.hcl" or url like "https://github.com/exubient0/terraform-candidate-repo/blob/main/.terraform.lock.hcl" or siteurl like "https://github.com/exubient0/terraform-candidate-repo/blob/main/.terraform.lock.hcl" or domainname like "mx01.galaxy-royal.online" or url like "mx01.galaxy-royal.online" or siteurl like "mx01.galaxy-royal.online" or domainname like "https://github.com/radupopa369/gtn-candidate-repo/blob/feat/three-tier-infrastructure/live/.terraform.lock.hcl" or url like "https://github.com/radupopa369/gtn-candidate-repo/blob/feat/three-tier-infrastructure/live/.terraform.lock.hcl" or siteurl like "https://github.com/radupopa369/gtn-candidate-repo/blob/feat/three-tier-infrastructure/live/.terraform.lock.hcl" or domainname like "ns4.galaxy-royal.online" or url like "ns4.galaxy-royal.online" or siteurl like "ns4.galaxy-royal.online" or domainname like "tinklify.com" or url like "tinklify.com" or siteurl like "tinklify.com" or domainname like "anesthesiaschool.com" or url like "anesthesiaschool.com" or siteurl like "anesthesiaschool.com" or domainname like "185-66-91-112.cprapid.com" or url like "185-66-91-112.cprapid.com" or siteurl like "185-66-91-112.cprapid.com" or domainname like "grenight.com" or url like "grenight.com" or siteurl like "grenight.com" or domainname like "www.freehealth.lat" or url like "www.freehealth.lat" or siteurl like "www.freehealth.lat" or domainname like "vaimage.com" or url like "vaimage.com" or siteurl like "vaimage.com" or domainname like "https://github.com/RyanLRay/Technical-Assessments/blob/19af09ebe8b7ad03419677dda515507dd099bc39/README.md?plain=1#L175" or url like "https://github.com/RyanLRay/Technical-Assessments/blob/19af09ebe8b7ad03419677dda515507dd099bc39/README.md?plain=1#L175" or siteurl like "https://github.com/RyanLRay/Technical-Assessments/blob/19af09ebe8b7ad03419677dda515507dd099bc39/README.md?plain=1#L175" or domainname like "213-111-146-132.cprapid.com" or url like "213-111-146-132.cprapid.com" or siteurl like "213-111-146-132.cprapid.com" or domainname like "www.heyhay.online" or url like "www.heyhay.online" or siteurl like "www.heyhay.online" or domainname like "storage.hubpage.cloud" or url like "storage.hubpage.cloud" or siteurl like "storage.hubpage.cloud" or domainname like "app.heyhay.online" or url like "app.heyhay.online" or siteurl like "app.heyhay.online" or domainname like "game.galaxy-royal.online" or url like "game.galaxy-royal.online" or siteurl like "game.galaxy-royal.online" or domainname like "www.mactroubleshoots.pro" or url like "www.mactroubleshoots.pro" or siteurl like "www.mactroubleshoots.pro" or domainname like "update.heyhay.online" or url like "update.heyhay.online" or siteurl like "update.heyhay.online" or domainname like "heyhay.online" or url like "heyhay.online" or siteurl like "heyhay.online" or domainname like "dela.servehttp.com" or url like "dela.servehttp.com" or siteurl like "dela.servehttp.com" or domainname like "mactroubleshoots.pro" or url like "mactroubleshoots.pro" or siteurl like "mactroubleshoots.pro" or domainname like "www.tinklify.com" or url like "www.tinklify.com" or siteurl like "www.tinklify.com" or domainname like "galaxy-royal.online" or url like "galaxy-royal.online" or siteurl like "galaxy-royal.online" or domainname like "www.anesthesiaschool.com" or url like "www.anesthesiaschool.com" or siteurl like "www.anesthesiaschool.com" or domainname like "https://github.com/chainstacker/Northwind-IAC/blob/930e5be6d34511bedbfb0d762bd08fffe64e9630/aws/us-east-1/prod/northwind/global/vpc/.terraform.lock.hcl" or url like "https://github.com/chainstacker/Northwind-IAC/blob/930e5be6d34511bedbfb0d762bd08fffe64e9630/aws/us-east-1/prod/northwind/global/vpc/.terraform.lock.hcl" or siteurl like "https://github.com/chainstacker/Northwind-IAC/blob/930e5be6d34511bedbfb0d762bd08fffe64e9630/aws/us-east-1/prod/northwind/global/vpc/.terraform.lock.hcl" |
Detection Query 2 : | dstipaddress IN ("176.97.114.232","85.137.56.245","85.137.56.10","45.11.59.140") or srcipaddress IN ("176.97.114.232","85.137.56.245","85.137.56.10","45.11.59.140") |
Detection Query 3 : | sha1hash IN ("c491d477dbe0ae04e9aed9dbe237144c03f73ec4","5728b11d30586bbfc1d8bd12df1c722a06e767a2","02df07a173ab03b82a4fb6a08973fff8b1467f28","4ad92bf92ee614b05c340ce17bef7b6ef5a25e82")
|
Detection Query 4 : | sha256hash in ("4b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daa")
|
| Detection Query 5 : | datasourcename = "Windows Security" and eventtype = "4663" and (objectname like "~/Library/com.apple.iTunesCloud/SystemUpdate" or objectname like "~/Library/com.apple.internal.ck/iSync" or objectname like "~/Library/com.apple.appleaccountd/loginwindow" or objectname like "/private/tmp/.pipe-airway" or objectname like "$TMPDIR/tmp%.lock" or objectname like "~/DevOps-Automation/cloudshield" or objectname like "$HOME/.config/.repl_history") |
Detection Query 6 : | technologygroup = "EDR" and (objectname like "~/Library/com.apple.iTunesCloud/SystemUpdate" or objectname like "~/Library/com.apple.internal.ck/iSync" or objectname like "~/Library/com.apple.appleaccountd/loginwindow" or objectname like "/private/tmp/.pipe-airway" or objectname like "$TMPDIR/tmp%.lock" or objectname like "~/DevOps-Automation/cloudshield" or objectname like "$HOME/.config/.repl_history") |
Reference:
TraderTraitor Backdoors Target Non-Crypto Victims