UnknownPublished 18 Dec 2025

tlp clear · XCTDH Crypto Heist Part 4 · Nick Smart and Andrii Sovershennyi

Affects tlp clearSource CIRCL OSINT Feed

TLP:CLEAR, disclosure is not limited

Description

The XCTDH Crypto Heist Part 4 is a medium-severity cyber threat linked to North Korean actors targeting software supply chains and development tools. It involves compromising software dependencies and development environments to facilitate unauthorized access or manipulation, leveraging application layer protocols for communication or data exfiltration. Although no specific affected product versions or patches are identified, the threat highlights risks associated with supply chain attacks. European organizations relying on affected software development tools or dependencies could face risks of intellectual property theft, operational disruption, or unauthorized access. Mitigation requires enhanced supply chain security practices, including rigorous code and dependency auditing, network segmentation, and monitoring for anomalous application layer traffic. Countries with significant software development sectors and historical exposure to North Korean cyber activities, such as the UK, Germany, and France, are more likely to be impacted. Given the medium severity, the threat poses a moderate risk that demands proactive defense but does not indicate immediate critical exploitation. Defenders should prioritize supply chain security and monitor for related attack patterns to reduce exposure.

Impact

For European organizations, the XCTDH Crypto Heist poses significant risks primarily to software development firms, technology providers, and any enterprises relying heavily on third-party software dependencies. Compromise of development tools or dependencies can lead to the insertion of malicious code, resulting in intellectual property theft, unauthorized access to sensitive data, and potential disruption of services. This can undermine trust in software supply chains and cause cascading effects across multiple sectors, including finance, critical infrastructure, and government. The use of application layer protocols for command and control or data exfiltration complicates detection efforts, increasing the risk of prolonged undetected breaches. Financial institutions and cryptocurrency-related businesses in Europe could be particularly targeted given the 'Crypto Heist' context, potentially leading to direct financial losses. Additionally, the geopolitical attribution to North Korea suggests that espionage and sabotage could be secondary objectives, impacting national security interests. The medium severity indicates that while the threat is serious, it may require specific conditions or vulnerabilities to be exploited effectively, thus not representing an immediate widespread crisis but a persistent threat vector.

Defensive guidance

European organizations should implement a multi-layered defense strategy focused on securing the software supply chain. This includes: 1) Enforcing strict code signing and verification processes for all software dependencies and development tools to detect unauthorized modifications. 2) Conducting thorough audits and continuous monitoring of third-party libraries and components for vulnerabilities or suspicious changes. 3) Segmenting development environments from production networks to limit lateral movement if a compromise occurs. 4) Deploying network monitoring solutions capable of detecting anomalous application layer protocol traffic indicative of command and control or data exfiltration activities. 5) Enhancing threat intelligence sharing with industry peers and national cybersecurity centers to stay informed about emerging supply chain threats linked to North Korean actors. 6) Implementing robust access controls and multi-factor authentication for development and build systems to reduce insider threat risks. 7) Training developers and IT staff on supply chain security risks and best practices. 8) Preparing incident response plans specifically addressing supply chain compromise scenarios to enable rapid containment and remediation. These measures go beyond generic advice by focusing on the unique challenges posed by supply chain attacks and the stealthy use of application layer protocols.

Summary

The XCTDH Crypto Heist Part 4 is a cyber threat attributed to North Korean threat actors, specifically linked to tactics involving the compromise of software dependencies and development tools (MITRE ATT&CK T1195.001) and broader software supply chain attacks (T1195.002). This attack vector typically involves infiltrating the software development lifecycle by injecting malicious code or backdoors into software components or development environments, which are then propagated to downstream users. The use of application layer protocols (T1071) suggests that the threat actors employ legitimate communication channels to evade detection while exfiltrating data or controlling compromised systems. Although no specific affected software versions or patches are documented, the threat underscores the persistent risk posed by supply chain compromises, which can have widespread impact due to the trust placed in software dependencies. The absence of known exploits in the wild indicates this may be an emerging or observed campaign rather than a currently widespread active exploitation. The threat is tagged with North Korea and DPRK, indicating geopolitical motivations possibly linked to financial gain through cryptocurrency theft or espionage. The technical details are limited, but the focus on software supply chain compromise aligns with recent trends where nation-state actors target development tools to maximize impact. The medium severity rating reflects the moderate risk level considering the complexity of exploitation and potential impact on confidentiality and integrity of software products.

Indicators of compromise

IP addresses 9

188.43.33.249
154.91.0.103
136.0.9.8
166.88.4.2
23.27.202.27
23.27.120.142
202.155.8.173
198.105.127.210
166.88.134.82

Hashes 72

07f24071e2914c0be127004f5f4e98c22b319ceccdce07c84ff71244db187efc
6ca251da28246371936cbe8083f52527fb4fdfee4045fed3867bb614e67d13f7
b9264734cdc4bdc0cf0939729194a48b366470539c32b91417a50e3857721956
27dd9a146de5f8e7978a00c53ca8ec603f88e7652f99d1493b274689a4c8e542
4038400fbf249d9b6103815d105dcb23c6c61e6c1026a2a35a64564bf38706b3
e37ef036d36de9697c551139d0d8a4c6a401dd332a4f5872c1f21ab755f969ef
e18ddf47412ad4b1ed92dffcf15a6d8ae18b60c8b4e002cdd29237663d5b8308
eed4768a1127c2e15fc3f9f83fb8fa018862d1f46dab6b4c1bc7dd8fb0da56a1
913081a0cfad76e49c6c7eff89ef31a599e60d0288fe0576e8c61e75eda36517
89eb1359cb19f926caf29c01f2f587750d6a6d2a5040cc22fb4cd98f2fdbc178

File 73

filename
011025_0x09e61c8f00b01eaa28b3ffaafdeb5f0d402357b87573400ebad1e25f3d9c8693_FINAL.txt
011025_0x1a4272be3c516faea9093f5c2fadadb620cfe8bfbd50e22008847e6056fd91b9_FINAL.txt
011025_0x3b77783f8952ae8235a873a2ac6757f8ae563de56d0006d3f92fd8d73b45ac58_FINAL.txt
011025_0xc3d4740f747e2f0adf622d2ac48ef6bda4b18e3d152028f0f8027216199c4fee_FINAL.txt
011025_0xf9fca982ce5a8ae9463f7b469496a2554d0f09c8ca67ca5034de621963673a5e_FINAL.txt
011225_0x4ff108d057d6e62ec110a5c8a85b1b404aa0bf6299d63ee9a7679d858c981f0f_FINAL.txt
020725_0xc8090a40230cfacb82ead30d8d290a22f8e5f508800d725f8ae2dd1d35e03427_FINAL.txt
071025_0x6c777ac28d0dba345eeda8b65625ef1aec69ecb5a489f25f2a2545cf3b3bb344_FINAL.txt
071025_0xf0adf6867fa5e1f7f9323e992dcad37eda3ca9bff82f49729ff1b85ab84a10d9_FINAL.txt

Text 169

symbol
transaction-number
BSC
0x09e61c8f00b01eaa28b3ffaafdeb5f0d402357b87573400ebad1e25f3d9c8693
BSC
0x1a4272be3c516faea9093f5c2fadadb620cfe8bfbd50e22008847e6056fd91b9
BSC
0x3b77783f8952ae8235a873a2ac6757f8ae563de56d0006d3f92fd8d73b45ac58
BSC
0xc3d4740f747e2f0adf622d2ac48ef6bda4b18e3d152028f0f8027216199c4fee

Datetime 9

2025-11-18T00:00:00+00:00
2025-02-07T00:00:00+00:00
2025-06-12T00:00:00+00:00
2025-06-12T00:00:00+00:00
2025-06-20T00:00:00+00:00
2025-10-08T00:00:00+00:00
2025-10-30T00:00:00+00:00
2025-11-14T00:00:00+00:00
2025-11-21T00:00:00+00:00

Community reviews

Loading reviews…