North Korean Hackers Deploy New "Durian" Malware Against South Korean Crypto Firms

North Korean hackers group Kimsuky are reportedly using a new variant of malware known as "Durian" in an attack against South Korean crypto companies.

The incident is detailed in a threat intelligence report that Kaspersky published last week. The malware is deployed only for breaking and exploiting security software used by South Korean crypto firms, at least two of which have been pinpointed.

"Our telemetry suggests two compromises within the South Korean cryptocurrency industry. The first one took place in August 2023, and the second one took place in November 2023. Interestingly, we have not identified other victims being hit in these campaigns, which is typical of a very targeted nature from the actor," the report said.

The Durian is malware belonging to an "initial-stage" installer. It installs more malware and creates a mechanism of persistence in the device or instance where it has been infected. When it runs, the malware generates a stage loader and installs it into the infected operating system to be executed.

The installation of the malware is finalized with a payload, which is written over Golang, an open-source programming language developed by Google.

The last payload then allows for remote command execution that orders the compromised device to download and exfiltrate files. The language used also raises suspicion since Golang is so potent in networked machines and vast code bases.

The report even more astonishingly revealed that one of the tools in use by Durian, called LazyLoad, was, in fact, being used by Andariel, a sub-group of the infamous North Korean hacking club, Lazarus. This, naturally, left open the potential for some form of linkage between Kimsuky and Lazarus—a point Kaspersky was at pains to suggest was at best "tenuous".

Lazarus Group, the first time breaking into the scene in 2009, is one of the most infamous groups of crypto hackers. Independent onchain sleuth ZachXBT recently revealed that the group had managed to launder over $200 million of ill-gotten crypto between 2020 and 2023. In total, Lazarus is accused of swindling over $3 billion in crypto assets during the six years leading to 2023.

A US court has ordered the forfeiture of 279 crypto accounts tied to North Korean threat incidents last week.