North Korean Lazarus Group is targeting crypto funds with a new spin on an old trick

Microsoft and cybersecurity firm Volexity have traced a new version of AppleJeus malware to the hackers behind the Ronin exploit and numerous other online heists.Microsoft reports that a threat actor has been identified targeting cryptocurrency investment startups. A party Microsoft has dubbed DEV-0139 posed as a cryptocurrency investment company on Telegram and used an Excel file weaponized with “well-crafted” malware to infect systems that it then remotely accessed.

The threat is part of a trend in attacks showing a high level of sophistication. In this case, the threat actor, falsely identifying itself with fake profiles of OKX employees, joined Telegram groups “used to facilitate communication between VIP clients and cryptocurrency exchange platforms,” Microsoft“We are […] seeing more complex attacks wherein the threat actor shows great knowledge and preparation, taking steps to gain their target’s trust before deploying payloads.

In October, the target was invited to join a new group and then asked for feedback on an Excel document that compared OKX, Binance and Huobi VIP fee structures. The document provided accurate information and high awareness of the reality of crypto trading, but it also invisibly sideloaded a malicious .dll file to create a backdoor into the user’s system. The target was then asked to open the .dll file themselves during the course of the discussion on fees.

DPRK’s infamous Lazarus Group has developed new and improved versions of its cryptocurrency-stealing malware AppleJeus, marking the regime’s latest attempt to garner funds for Kim Jong-un’s weapons programs.

The threat is part of a trend in attacks showing a high level of sophistication [...] The threat actor, falsely identifying itself with fake profiles of OKX, joined Telegram groups “used to facilitate communication between VIP clients and cryptocurrency exchange platforms.”

I didn’t notice that it somehow sowed excitement in the community

Coin Coin Latest News, Coin Coin Headlines

Similar News:You can also read news stories similar to this one that we have collected from other news sources.

North Korean Lazarus Group Linked to New Cryptocurrency Hacking Scheme – Security Bitcoin NewsCybersecurity firm Volexity also found Lazarus changed the technique to deliver this malware to final users in October, using excel documents to infect third parties and steal cryptocurrency. AIRDROP TAKE NICE
Source: BTCTN - 🏆 531. / 51 Read more »