UNC4899 Breached Crypto Firm After Developer AirDropped Trojanized File to Work Device

Google Cloud's H1 2026 report details how North Korean threat actor UNC4899 (also known as Jade Sleet, TraderTraitor) breached a cryptocurrency firm by chaining social engineering with cloud-native attack techniques.

• •A developer was tricked into downloading a trojanized archive via fake open-source collaboration, then AirDropped it to their corporate device
• •An AI-assisted IDE triggered execution of malicious Python code that deployed a fake Kubernetes CLI binary acting as a backdoor
• •Attackers pivoted to Google Cloud using stolen authenticated sessions, modified MFA policies on a bastion host, and performed reconnaissance across Kubernetes pods
• •CI/CD pipeline resources were tampered with to expose service account tokens in logs, enabling privilege escalation and container escape