North Korean Hackers Target Crypto Engineers with Kandykorn Malware

According to CryptoPotato, Elastic Security Labs has recently uncovered a sophisticated cyber intrusion by North Korean hackers believed to be associated with the Lazarus group. The incident, tracked as REF7001, involved the use of a new macOS malware named Kandykorn, specifically designed to target blockchain engineers involved in cryptocurrency exchange platforms. The malware was distributed through a private message on a public Discord server, which is atypical of macOS intrusion tactics.The Kandykorn malware initiates communication with a command-and-control (C2) server, utilizing encrypted RC4 and implementing a distinct handshake mechanism. It patiently awaits commands, allowing hackers to retain control over the compromised systems discreetly. Elastic Security Labs has provided valuable insights into the capabilities of Kandykorn, showcasing its proficiency in performing file upload and download, process manipulation, and execution of arbitrary system commands. The malware also utilizes reflective binary loading, a fileless execution technique associated with the notorious Lazarus Group.There is compelling evidence linking this attack to the Lazarus Group in North Korea, including similarities in techniques, network infrastructure, certificates used to sign malicious software, and custom methods for detecting Lazarus Group activities. On-chain transactions have revealed connections between security breaches at Atomic Wallet, Alphapo, CoinsPaid, Stake.com, and CoinEx, further proving the Lazarus Group's participation in these exploits. Elastic Security Labs has emphasized the importance of robust cybersecurity measures to safeguard against such threats.