TraderTraitor

Executive Summary

TraderTraitor, also known as Jade Sleet or Pukchong (UNC4899), is suspected to be linked to APT38 operators targeting blockchain companies. The group employs spear-phishing attacks to compromise system administrators and software developers, aiming to infiltrate high-tech start-ups. While their exact motivations remain unclear, they pose a significant risk to the cryptocurrency sector.

Goals & Targeting

TraderTraitor appears to target sectors with rapid technological advancements, notably blockchain companies, which are often less mature in their cybersecurity practices. The targeting of system administrators and software developers indicates an operational focus on gaining initial access through trusted roles. Their long-term goals likely include data theft, financial gain, or disruption of critical operations, though specific motivations remain unclear.

TraderTraitor (Jade Sleet/UNC4899/Pukchong) is a cyber threat actor with suspected ties to APT38 operators. The group primarily targets blockchain companies through sophisticated spear-phishing campaigns. By targeting system administrators and software developers, TraderTraitor seeks to gain unauthorized access to sensitive systems within high-tech organizations. While specifics of their operations are limited, the group's focus on emerging technologies suggests a strategic intent to exploit vulnerabilities in innovative sectors.

Key Capabilities

• Spear-phishing campaigns
• Infection via malicious Office documents
• Undetected persistence mechanisms

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

TraderTraitor's campaigns are observed targeting system administrators and developers, with a focus on blockchain companies. While no specific campaigns have been confirmed, their operational style suggests a patient and deliberate approach, consistent with state-sponsored or well-organized cybercriminal activity.

IOC Patterns

• Spear-phishing emails with malicious Office attachments
• Lateral movement within internal networks

Recommended Actions

• Implement advanced phishing detection solutions
• Conduct regular employee training on identifying spear-phishing attempts
• Monitor for suspicious network activity related to known APT38 TTPs

Suggested Tags