North Korean hack group BlueNoroff hacked Canadian iGaming service via fake Zoom

North Korean cyber group BlueNoroff continues its global hunt for cryptocurrency and financial companies. This time, they targeted a Canadian iGaming operator. The attack, which began in the spring of 2025, was part of a large-scale campaign that affected companies around the world.

How the attack went

Everything looked as plausible as possible. The victim was informed about an alleged technical problem with sound during communication and was offered to install a fix through a special link on Zoom. But instead of the usual application, the person downloaded a malicious script disguised as a secure utility.

This script quietly installed spyware on the computer. The malware could steal logins, passwords, and access to crypto wallets, as well as open stable "backdoors" for further control over the system. At the same time, the software automatically deleted traces of its activity after the task was completed, which made it extremely difficult to detect the attack.

When and who else was attacked

The attack on the Canadian iGaming service began in March 2025. At the same time, experts have recorded similar schemes in the United States, South Korea, Japan, and several European countries.

Who is BlueNoroff

BlueNoroff is one of the key APT (Advanced Persistent Threat) groups associated with the DPRK government. Their main task is cyber espionage and the theft of digital assets to finance government projects, including weapons development programs. Previously, BlueNoroff has already been involved in a number of major attacks, including on banks and crypto exchanges.

This case in Canada is another confirmation that the iGaming industry, especially with elements of working with cryptocurrencies, is becoming an increasingly attractive target for international cybercriminals.