Elastic Security Labs has identified a unique intrusion malware that specifically targets blockchain engineers in cryptocurrency exchange platforms.
This attack employs a blend of deceptive tactics and conventional tools to gain unauthorised access to computer systems and extract sensitive data.
The use of this cyber intrusion tool was first detected during an investigation into the background activity of a Macintosh computer.
The attack was initiated through a counterfeit program masquerading as a cryptocurrency profit-generating tool, distributed via direct messages on Discord.
Attributed to a group believed to be operating from Democratic People's Republic of Korea (DPRK) i.e. North Korea, it shares significant resemblances with the Lazarus Group.
This is based on the analysis of methodologies, network structures, digital certificates, and unique detection measures related to the Lazarus Group.
Elastic has named this specific form of intrusion as "REF7001."
It all started rather simply.
Malicious actors assumed false identities within a Discord group dedicated to discussions on cryptocurrency-related software.
As with most malware, they manipulated an unsuspecting individual into downloading a seemingly innocuous file, which, in reality, harboured malicious code.
The victim was under the impression that they were acquiring a cryptocurrency arbitrage bot, which was capable of detecting rate differences between exchanges and profiting from the variances.
Upon opening this file, the primary phase of the attack, known as "KANDYKORN," was initiated.
To execute the attack, the victim was required to run the a program.
Playing its part to deceive the victim, the original program appeared innocuous as it imported other files and executed seemingly routine operations.
The user will then unknowingly play a crucial role in running this program, participating in seemingly routine actions that were, in fact, essential to the attack's success.
Subsequent to the victim's execution of this program, the REF7001 attack unfolded through five discrete stages.
Stage 1 - Preparation:
The original program will discretely run another program. This particular program will assess the computer's environment and prepare it for the next phase of attack.
Stage 2 - Loading Additional Malware:
Once the computer's environment has been ascertained, two other files that are intermediary Python scripts, will download and run a program known as "SUGARLOADER."
Stage 3 - SUGARLOADER:
This program will execute further clandestine operations. and facilitate the loading of the final stage, "KANDYKORN."
Stage 4 - Camouflage as Discord:
A file named "HLOADER/Discord(fake)" will then pretend to be the legitimate Discord program. It served as a ruse to maintain the presence of the deceptive program "SUGARLOADER" on the victim's system.
Stage 5 - "KANDYKORN"
Once infiltrated, KANDYKORN will possesses a wide range of capabilities. It can receive discrete commands, such as downloading from another computer. It will also be able to check the computer's details, send and receive information to another computer, even grant control of the computer to another terminal. In short, a complete breach.
Elastic traces the campaign back to April 2023.
They did this by analysing the encryption key employed for securing the SUGARLOADER and KANDYKORN C2 communications.
The threat remains active, and apparently continues to undergo evolution in both tools and techniques.
Lazarus is a well-known North Korean cryptocurrency cyberespionage group.
They have a history dating back to at least 2009.
Due to sanctions surrounding the DPRK, their objective is to pilfer cryptocurrency - since the use of the digital currency helps them evade such international sanctions.
North Korean hackers have purportedly stolen approximately $3.5 billion from cryptocurrency projects since 2016, based on reports from blockchain forensics firm Chainalysis on September 14.
It is speculated by the UN that the stolen funds are being used to support North Korea's nuclear missile program.
Coinlive previously reported on how the Lazarus Group was using LinkedIn to infect computers with malware.
Lazarus Group, notorious for $3 billion crypto exploits, withdrew $1.2 million Bitcoin from a coin mixer. Blockchain analysis by Arkham reveals their $79 million wallet. Recent attacks align with Lazarus's known patterns, raising concerns.
Bernice
JinseFinanceThe seizure was coordinated between Binance, Huobi, and Elliptic.
cryptopotatoIt is claimed North Korea is funding its nuclear weapons through cryptocurrency theft.
BeincryptoNorth Korea-linked cybercrime syndicate Lazarus Group has reportedly transferred $63.4 million in Ethereum from 2022’s mammoth Harmony bridge hack, depositing it on Binance, Huobi, and OKX.
decryptBlueNoroff has expanded its criminal activities to include posing as venture capitalists looking to invest in crypto startups.
decryptIn 2009, Satoshi Nakamoto released the Bitcoin white paper and open source code, and since then, there has been an open spirit in the crypto industry. From the very beginning, anyone can copy the code, change the way of marketing, launch "own" coin and network
CointelegraphAuthorities have warned that a North Korean hacker group known as Lazarus is highly likely targeting Japanese crypto asset-related operators in its cyberattacks.
OthersThe infamous North Korean hackers known as the ‘Lazarus Group’ are at it again.
FinboldEl Salvador, the first country to adopt Bitcoin as legal tender, has seen explosive growth in tourism numbers in the first half of 2022.
Cointelegraph
