Microsoft is working to resolve an ongoing Exchange Online outage affecting customers throughout North America, blocking their access to emails.

“We’re investigating an issue affecting a portion of infrastructure in North America, where users may be unable to access their mailbox via any Exchange Online connection method,” the company explained earlier today.

According to user reports on DownDetector, the issue began impacting Microsoft’s customers more than six hours ago and is causing server connection problems, affecting users who attempt to log in to their accounts and access Teams, Outlook, and Hotmail.

While the root cause has yet to be determined and Microsoft hasn’t shared the number of customers affected by this outage, the company said that it’s currently investigating telemetry data and working to mitigate the impacted infrastructure.

“We’re continuing to evaluate service telemetry for potential system irregularities contributing to impact, and in parallel we’re applying some changes to optimize affected mailbox infrastructure,” Microsoft added in a recent update.

Earlier this week, Redmond resolved another issue that caused an anti-spam service to quarantine some emails and mistakenly block Exchange Online and Microsoft Teams users from opening URLs.

The company is also rolling out a fix to address an Exchange Online issue that triggers email access problems for Outlook mobile users who use Hybrid Modern Authentication (HMA).

The issue began impacting Android and iOS users on August 17, causing mailboxes to crash and preventing them from accessing their email and calendars.

Update September 11, 18:12 EDT: According to an admin center update, the outage also impacts customers in South America. Microsoft says it’s seeing signs of recovery after implementing a configuration change to some of the impacted infrastructure.

“We’ve seen some steady improvements in service quality as our manual database optimizations and configuration changes have reduced the impact of the high service utilization on the environment,” the compay notes.

“Additionally, we’re looking into a potential build versioning issue with a subset of machines supporting the service that may be contributing to impact.”

This is a developing story…

The North Korean state-sponsored hackers known as Kimsuky has reportedly suffered a data breach after two hackers, who describe themselves as the opposite of Kimsuky’s values, stole the group’s data and leaked it publicly online.

The two hackers, named ‘Saber’ and ‘cyb0rg,’ cited ethical reasons for their actions, saying Kimsuky is “hacking for all the wrong reasons,” claiming they’re driven by political agendas and follow regime orders instead of practicing the art of hacking independently.

“Kimsuky, you are not a hacker. You are driven by financial greed, to enrich your leaders, and to fulfill their political agenda,” reads the hackers’ address to Kimsuky published in the latest issue of Phrack, which was distributed at the DEF CON 33 conference.

“You steal from others and favour your own. You value yourself above the others: You are morally perverted.”

The hackers dumped a portion of Kimsuky’s backend, exposing both their tooling and some of their stolen data that could provide insight into unknown campaigns and undocumented compromises.

The 8.9GB dump currently hosted on the ‘Distributed Denial of Secrets” website contains, among others:

• Phishing logs with multiple dcc.mil.kr (Defense Counterintelligence Command) email accounts.
• Other targeted domains: spo.go.kr, korea.kr, daum.net, kakao.com, naver.com.
• .7z archive containing the complete source code of South Korea’s Ministry of Foreign Affairs email platform (“Kebi”), including webmail, admin, and archive modules.
• References to South Korean citizen certificates and curated lists of university professors.
• PHP “Generator” toolkit for building phishing sites with detection evasion and redirection tricks.
• Live phishing kits.
• Unknown binary archives (voS9AyMZ.tar.gz, Black.x64.tar.gz) and executables (payload.bin, payload_test.bin, s.x64.bin) not flagged in VirusTotal.
• Cobalt Strike loaders, reverse shells, and Onnara proxy modules found in VMware drag-and-drop cache.
• Chrome history and configs linking to suspicious GitHub accounts (wwh1004.github.io, etc.), VPN purchases (PureVPN, ZoogVPN) via Google Pay, and frequent use of hacking forums (freebuf.com, xaker.ru).
• Google Translate use for Chinese error messages and visits to Taiwan government and military sites.
• Bash history with SSH connections to internal systems.

The hackers note that some of the above are already known or previously documented, at least partially.

However, the dump gives a new dimension to the data and provides interlinking between Kimsuky’s tools and activities, exposing and effectively “burning” the APT’s infrastructure and methods.

BleepingComputer has contacted various security researchers to confirm the veracity of the leaked documents and its value and will update the story if we receive a response.

While the breach will likely not have long-term impact on Kimsuky’s operations, it could lead to operational difficulties for Kimsuky and disruptions to ongoing campaigns.

The latest issue of Phrack (#72) is currently only available in a limited physical copy, but the online version should be ready for people to read for free in the following days from here.

Crypto Journalist

Amin Ayan

Crypto Journalist

Amin Ayan

About Author

Amin Ayan is a crypto journalist with over four years of experience in the industry. He has contributed to leading publications such as Cryptonews, Investing.com, 99Bitcoins, and 24/7 Wall St. He has…

Share

Last updated: 

July 25, 2025

An Arizona-based TikTok influencer has been sentenced to eight and a half years in prison for her role in a North Korean plot to infiltrate the U.S. tech workforce and fund the regime’s weapons program.

Christina Marie Chapman, who gained popularity online for her freelance lifestyle content, was convicted in Washington, D.C. on charges of wire fraud conspiracy, aggravated identity theft, and money laundering.

In addition to prison time, Chapman was ordered to forfeit over $284,000 and pay restitution of $176,850. She will also serve three years of supervised release.

TikToker Ran ‘Laptop Farm’ to Help North Korean IT Workers Pose as US Employees

According to prosecutors, Chapman operated a “laptop farm” from her home, allowing North Korean IT workers to remotely access U.S.-based networks while appearing to be physically located inside the country.

Between 2020 and her arrest, she helped operatives obtain remote roles at more than 300 American companies, including Fortune 500 firms, a major television network, and a leading aerospace manufacturer.

“Even an adversary as sophisticated as the North Korean government can’t succeed without the assistance of willing U.S. citizens like Christina Chapman,” said Roman Rozhavsky, Assistant Director of the FBI’s Counterintelligence Division.

US authorities say North Korea has built a global network of IT operatives who use fake identities and proxy networks to secure jobs and channel funds to the regime.

Chapman’s activities helped facilitate these efforts by setting up U.S.-based internet access, laundering wages through personal bank accounts, and shipping laptops overseas, including multiple devices sent to a Chinese city near North Korea.

Investigators seized more than 90 laptops from her residence and discovered she had sent 49 more abroad.

The wages earned by the North Korean agents were misreported to the US tax and social security agencies under stolen or borrowed American identities.

The crypto sector remains a key target in this operation. According to Chainalysis, North Korean-linked hackers stole $1.34 billion in cryptocurrency in 2024 alone, up 21% from the previous year.

Cybersecurity experts say North Korean job seekers are increasingly sophisticated, often hiring European actors to front video interviews while using VPNs and proxy IPs to conceal their locations.

North Korea Linked to Major Crypto Hacks

North Korea has also been linked to several other major crypto heists, including those targeting Bybit, the Ronin Bridge, Harmony, and various DeFi platforms.

Global law enforcement is responding. The U.S. Department of Justice recently moved to seize over $7.7 million in digital assets tied to North Korean IT workers embedded in blockchain firms.

Meanwhile, the U.S. and South Korea signed a bilateral agreement in 2023 to enhance their technical capabilities in detecting and countering DPRK cyber operations.

North Korean cyber strategies continue to evolve. In April, Lazarus-linked operatives reportedly set up US-based shell companies to distribute malware to crypto developers.

Kraken recently thwarted an infiltration attempt by a suspected North Korean posing as a job candidate.

The US Treasury has sanctioned two people and four entities involved in what it says was a North Korea-run IT worker ring that would infiltrate crypto companies, aiming to exploit them.

The Treasury’s Office of Foreign Assets Control (OFAC) said on Tuesday that it sanctioned the North Korea-based Song Kum Hyok for allegedly stealing US citizens’ information to use as aliases and giving it to hired foreign IT workers who would seek employment at US companies.

OFAC also sanctioned the Russian national Gayk Asatryan for allegedly using his companies to employ dozens of North Korean IT workers under long-term agreements he signed with North Korean trading firms starting in 2024.

A growing number of fraudulent tech workers with ties to North Korea, officially the Democratic People’s Republic of Korea (DPRK), have been expanding their infiltration operations, with an April report from Google finding that the infrastructure for the schemes has spread worldwide.

“Treasury remains committed to using all available tools to disrupt the Kim regime’s efforts to circumvent sanctions through its digital asset theft, attempted impersonation of Americans, and malicious cyber-attacks,” said Treasury Deputy Secretary Michael Faulkender.

Thousands of IT workers target wealthier countries to fund missile program

OFAC said North Korea aims to generate revenue for its ballistic missile programs by deploying a thousands-strong workforce of highly skilled IT workers all over the world, the bulk of which are located in China and Russia.

The workforce mainly targets employers located in wealthier countries and uses various mainstream and industry-specific networking platforms, OFAC said.

The sanctions mean all US assets connected to Asatryan, Song, and the four Russian entities also named are frozen. It’s also now illegal for people in the US to conduct any financial transactions or have business dealings with them under the threat of civil and criminal penalties.

North Korea shifting away from hacks

North Korea has been notorious for its high-profile hacks through teams such as the Lazarus Group, and is responsible for some of the largest crypto hacks ever recorded, such as the $1.5 billion Bybit exploit in February.

However, blockchain intelligence firm TRM Labs said on Tuesday that they are starting to shift tactics. 

“While exchange breaches remain significant, DPRK-linked operations are increasingly shifting toward deception-based revenue generation, including IT worker infiltration,” the firm said.

TRM Labs estimates North Korea-aligned bad actors are responsible for $1.6 billion of the $2.1 billion stolen across 75 crypto hacks and exploits in the first half of 2025.

US cracks down on North Korean IT workers

US authorities have been increasingly cracking down on fraudulent North Korean IT worker schemes this year.

Related: North Korea targets crypto workers with new info-stealing malware

On June 30, four North Korean nationals were charged with wire fraud and money laundering after posing as remote workers at US and Serbian blockchain companies.

Meanwhile, on June 5, the US Department of Justice said it was trying to seize $7.74 million in frozen crypto allegedly earned by North Korean IT workers using fake identities and working at blockchain firms as remote contractors.  

Magazine: North Korea crypto hackers tap ChatGPT, Malaysia road money siphoned: Asia Express

]]> https://earlybirdsinvest.com/us-sanctions-north-korean-tech-worker-crew-over-crypto-thefts/feed/ 0 46570 https://earlybirdsinvest.com/remote-work-scam-north-koreans-stole-1-million-in-crypto-doj-says/ https://earlybirdsinvest.com/remote-work-scam-north-koreans-stole-1-million-in-crypto-doj-says/#respond Wed, 02 Jul 2025 06:27:08 +0000 https://earlybirdsinvest.com/remote-work-scam-north-koreans-stole-1-million-in-crypto-doj-says/

US prosecutors have charged four North Korean citizens with wire fraud and money laundering after they allegedly pretended to be remote IT workers to steal nearly $1 million in crypto.

The charges were filed in the state of Georgia and involve two blockchain companies based in the US and Serbia.

The US Department of Justice (DOJ) identified the suspects as Kim Kwang Jin, Kang Tae Bok, Jong Pong Ju, and Chang Nam Il. The group reportedly used fake and stolen IDs to hide that they were North Korean citizens.

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe – We publish new crypto explainer videos every week!

What is Terra Luna? History & Crash Explained (ANIMATED)

They started operating from the United Arab Emirates in 2019 before later getting jobs at a blockchain startup in Atlanta and a crypto firm in Serbia between December 2020 and May 2021.

Kim and Jong are accused of using fake documents, including false identification, to secure employment. US Attorney Theodore S. Hertzberg said this method poses a risk for companies that rely on remote workers, as it can be difficult to confirm someone’s true identity.

After getting access to internal systems, the suspects carried out two separate thefts. In February 2022, Jong allegedly stole around $175,000 in cryptocurrency. A month later, Kim exploited smart contract code to take another $740,000.

The stolen money was then moved through mixing services and sent to exchange accounts controlled by Kang and Chang. These accounts were set up using fake Malaysian IDs, investigators said.

According to John A. Eisenberg, the assistant attorney general for national security, the stolen funds were meant to help North Korea avoid sanctions and support its banned weapons programs.

Recently, Dwayne Golden, a 57-year-old man from the US, was sentenced to nearly eight years in prison. What happened? Read the full story.

Having completed a Master’s degree in Economics, Politics, and Cultures of the East Asia region, Aaron has written scientific papers analyzing the differences between Western and Collective forms of capitalism in the post-World War II era.
With close to a decade of experience in the FinTech industry, Aaron understands all of the biggest issues and struggles that crypto enthusiasts face. He’s a passionate analyst who is concerned with data-driven and fact-based content, as well as that which speaks to both Web3 natives and industry newcomers.
Aaron is the go-to person for everything and anything related to digital currencies. With a huge passion for blockchain & Web3 education, Aaron strives to transform the space as we know it, and make it more approachable to complete beginners.
Aaron has been quoted by multiple established outlets, and is a published author himself. Even during his free time, he enjoys researching the market trends, and looking for the next supernova.

---