Lazarus continues to attack the cryptocurrency business with enhanced capabilities

guest · Jan 9, 2020

Lazarus Hackers Turn to Telegram in Search for New Targets
Cryptocurrency stealing pushed to the next level
January 9, 2020
https://news.softpedia.com/news/laz...legram-in-search-for-new-targets-528799.shtml

Lazarus hackers, which are known for their attacks specifically supposed to help steal cryptocurrency, is trying to infect Windows machines by sending victims malicious payloads through Telegram.
Hackers use a Windows version of UnionCryptoTrader that executes in memory, so it leaves no traces on the hard drive, other than the executable file that is stored in the Telegram folder.
Stealing cryptocurrency from compromised systems
Once it compromises a target, the malware then opens the door for additional payloads, including one targeting Internet Explorer and used to “carry out attacker’s commands,” Kaspersky explains.

Kaspersky believes Lazarus hackers will continue to make changes to their macOS and Windows malware using more sophisticated methods, with most of their attacks to remain focused on the cryptocurrency business.

“We believe the Lazarus group’s continuous attacks for financial gain are unlikely to stop anytime soon,” Kaspersky says.
Click to expand...

Kaspersky: Operation AppleJeus Sequel

guest · Feb 6, 2020

North Korean hacker group Lazarus is reportedly behind the DragonEx attack
February 7, 2020
https://www.fxstreet.com/cryptocurr...tedly-behind-the-dragonex-attack-202002070052

According to Chainalysis reports, the North Korean hacking group called Lazarus has targeted many crypto exchanges last year. One of these attacks involved the hack of DragonEx exchange.

In March 2019, the hackers stole around $7 million in various cryptos from the exchange. Lazarus used a sophisticated phishing attack where they created a website and social media presence for a fake firm called WFC Proof. This supposed firm then created a realistic training bot, which was offered to the employees of DragonEx.

Although the software looked like a real training bot, it contained malware that could hijack the computer it infected. Later, the software was installed in a machine that had the private keys to DragonEx’s hot wallet. This enabled Lazarus to steal the funds.
The hackers appeared to be well versed in cryptocurrencies and had issued an ironic warning asking people not to let anyone access personal private keys on the website.
Click to expand...

guest · Mar 2, 2020

US Treasury sanctions two Chinese nationals for laundering cryptocurrency for North Korean hackers
Two Chinese men laundered funds from two hacked cryptocurrency exchanges
March 2, 2020
https://www.zdnet.com/article/us-tr...ring-cryptocurrency-for-north-korean-hackers/

The US Treasury Department imposed sanctions today on two Chinese nationals on accusations of helping North Korean hackers launder cryptocurrency stolen during hacks of two cryptocurrency exchanges.

According to the Treasury Department, Tian Yinyin ( 田寅寅) and Li Jiadong (李家东) acted as intermediaries and money mules for Lazarus Group, a codename used by the cyber-security industry to describe hackers working on behalf of the North Korean government.
The Treasury claimed the hackers were helping North Korea skirt international sanctions by raising money through cyber-thefts, such as the use of ransomware and hacks of banks, ATM networks, gambling sites, online casinos, and cryptocurrency exchanges.
TIAN AND LI LAUNDERED FUNDS FROM TWO LAZARUS HACKS
In a press release published earlier today, the US Treasury said that Tian and Li were an important cog in this elaborate scheme.

The two would receive stolen funds and then work to launder the money either by converting it into Chinese fiat currency (yuan) or into Apple gift cards that could be used without being linked back to the stolen cryptocurrency.
Click to expand...

Treasury Sanctions Individuals Laundering Cryptocurrency for Lazarus Group

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) today sanctioned two Chinese nationals involved in laundering stolen cryptocurrency from a 2018 cyber intrusion against a cryptocurrency exchange. This cyber intrusion is linked to Lazarus Group, a U.S.-designated North Korean state-sponsored malicious cyber group.

“The North Korean regime has continued its widespread campaign of extensive cyber-attacks on financial institutions to steal funds,” said Secretary Steven T. Mnuchin. “The United States will continue to protect the global financial system by holding accountable those who help North Korea engage in cyber-crime.”
Click to expand...

guest · Aug 25, 2020

Lazarus hackers target cryptocurrency orgs with fake job offers
August 25, 2020
https://www.bleepingcomputer.com/ne...get-cryptocurrency-orgs-with-fake-job-offers/

North Korean hackers tracked as the Lazarus Group have been observed while using LinkedIn lures in an ongoing spear-phishing campaign targeting the cryptocurrency vertical in the United States, the United Kingdom, Germany, Singapore, the Netherlands, Japan, and other countries.

Earlier this year, in March, two Chinese nationals were charged by the U.S. with the laundering over $100 million worth of cryptocurrency out of the roughly $250 million stolen by the Lazarus Group in 2018 as part of a single cryptocurrency exchange hack.
LinkedIn phishing targeting cryptocurrency firm system admin
Today, F-Secure Labs security researchers said that they attributed a phishing attack targeting an organization in the cryptocurrency vertical to the Lazarus Group.
Click to expand...

This was possible due to signs of Lazarus activity discovered by F-Secure despite the threat actors' obvious efforts to remove any hint of their attacks — including disabling anti-malware solutions and removing their malicious implants from compromised devices.

"On all but a single host, which was powered off halfway through the intrusion and therefore unreachable, Lazarus Group was able to securely delete traces of any of the malware they employed as well as significant quantities of forensic evidence," the researchers found.
"Based on phishing artifacts recovered from Lazarus Group's attack, F-Secure's researchers were able to link the incident to a wider, ongoing campaign that's been running since at least January 2018," F-Secure said earlier today.
Click to expand...

Ongoing phishing campaign
Lazarus Group was also observed by F-Secure while disabling Credential Guard on infected devices to capture credentials from memory using the open-source Mimikatz post-exploitation tool.

"Lazarus Group’s activities are a continued threat: the phishing campaign associated with this attack has been observed continuing into 2020, raising the need for awareness and ongoing vigilance amongst organizations operating in the targeted verticals," the researchers conclude.
Click to expand...

F-Secure Labs: "Lazarus Group Campaign Targeting The Cryptocurrency Vertical"
(PDF): https://labs.f-secure.com/assets/BlogFiles/f-secureLABS-tlp-white-lazarus-threat-intel-report.pdf

guest · Aug 8, 2022

North Korean hackers target crypto experts with fake Coinbase job offers
August 7, 2022

A new social engineering campaign by the notorious North Korean Lazarus hacking group has been discovered, with the hackers impersonating Coinbase to target employees in the fintech industry.

A common tactic the hacking group uses is to approach targets over LinkedIn to present a job offer and hold a preliminary discussion as part of a social engineering attack.
Click to expand...

According to Hossein Jazi, a security researcher at Malwarebytes who has been following Lazarus activity closely since February 2022, the threat actors are now pretending to be from Coinbase, targeting candidates suitable for the role of "Engineering Manager, Product Security."
Coinbase is one of the world's largest cryptocurrency exchange platforms, allowing Lazarus to lay the ground for a lucrative and enticing job offer at a prestigious organization.

Once executed, the malware will use GitHub as a command and control server to receive commands to perform on the infected device.
This attack chain is similar to one documented by Malwarebytes in a blog post at the start of the year.
Click to expand...

Lazarus hackers targeting crypto
State-sponsored North Korean hacking groups are known for launching financially motivated attacks against banks, cryptocurrency exchanges, NFT marketplaces, and individual investors with significant holdings.

Earlier in the year, U.S. intelligence services warned about Lazarus spreading trojanized cryptocurrency wallets and investment apps that steal people's private keys and siphon their holdings.
In April, the U.S. Treasury and the FBI linked stolen cryptocurrency from the blockchain-based game Axie Infinity to Lazarus, holding them responsible for stealing over $617 million worth of Ethereum and USDC tokens.
Click to expand...

This same type of attack is likely what Lazarus is hoping to achieve in the latest Coinbase-lured campaign, as it would only take a single person in a company to open the PDF and enable the hackers to gain initial access to the corporate network.
Click to expand...

guest · Aug 8, 2022

deBridge Finance crypto platform targeted by Lazarus hackers
August 8, 2022

Hackers suspected to be from the North Korean Lazarus group tried their luck at stealing cryptocurrency from deBridge Finance, a cross-chain protocol that enables the decentralized transfer of assets between various blockchains.

The threat actor used a phishing email to trick company employees into launching malware that collected various information from Windows systems and allowed the delivery of additional malicious code for subsequent stages of the attack.
Click to expand...

Fake PDF and text files
The hackers targeted deBridge Finance employees on Thursday with an email purporting to be from the company co-founder, Alex Smirnov, allegedly sharing new information about salary changes.

Smirnov says that the malware used in the attack was flagged by a small number of antivirus solutions.
The email was sent to multiple deBridge employees but most of them reported it as suspicious. However, one of them took the bait and downloaded and opened the document, which allowed Smirnov to analyze the attack.
Click to expand...

Tied to North Korean Lazarus hackers
The connection to the North Korean hackers in the Lazarus group was possible due the overlap in file names and infrastructure used in a previous attack attributed to the threat actor.

Back in July, security researchers from PwC U.K. and Malwarebytes reported another campaign from the Lazarus hacker group - also referred to as CryptoCore and CryptoMimic - that used either the same same filenames or similar ones.
BleepingComputer has learned that the same campaign has targeting cryptocurrency firms even earlier, in March, when the hackers targeted the crypto trading platform Woo Network with a document pretending to be a job offer from Coinbase cryptocurrency exchange platform.
Click to expand...

One of the largest cryptocurrency heists attributed to this group is the theft of $620 million in Ethereum from Axie Infinity's Ronin network bridge.
Click to expand...

guest · Sep 8, 2022

US recovers $30 million stolen from Axie Infinity by Lazarus hackers
By Bill Toulas @billtoulas - September 8, 2022

With the help of blockchain analysts and FBI agents, the U.S. government seized $30 million worth of cryptocurrency stolen by the North Korean threat group 'Lazarus' from the token-based 'play-to-earn' game Axie Infinity earlier in the year.

The news about the retrieval was announced during the AxieCon event today, where the hosts highlighted it as a community achievement and the result of a large-scale collaboration between multiple law enforcement authorities and private entities.
Click to expand...

This is the first time stolen cryptocurrency has been seized from a North Korean hacking group, and according to a Chainalysis report, which had active involvement in the retrieval, it won't be the last.

"Chainalysis Crypto Incident Response team played a role in these seizures, utilizing advanced tracing techniques to follow stolen funds to cash out points and liaising with law enforcement and industry players to quickly freeze funds," the company reports.
The seized money will gradually move into Axie Infinity's treasury and back to the players' community, but the game's publishers explained this process might take several years.
Click to expand...

Lazarus laundering effort
As Chainalysis explains, the Korean hackers followed a typical five-stage laundering process laid down below:

Send stolen Ether to intermediary wallets

Mix Ether in batches using Tornado Cash

Swap Ether for Bitcoin

Mix Bitcoin with batches

Click to expand...

Chainalysis: $30 Million Seized: How the Cryptocurrency Community Is Making It Difficult for North Korean Hackers To Profit

By Erin Plante - September 8, 2022
One of the most troubling trends in crypto crime right now is the stunning rise in funds stolen from DeFi protocols, and in particular cross-chain bridges. Much of the value stolen from DeFi protocols can be attributed to bad actors affiliated with North Korea, especially elite hacking units like Lazarus Group. We estimate that so far in 2022, North Korea-linked groups have stolen approximately $1 billion of cryptocurrency from DeFi protocols.

With the help of law enforcement and leading organizations in the cryptocurrency industry, more than $30 million worth of cryptocurrency stolen by North Korean-linked hackers has been seized. This marks the first time ever that cryptocurrency stolen by a North Korean hacking group has been seized, and we’re confident it won’t be the last.
Click to expand...

guest · Jan 16, 2023

North Korean Hacking Group Tied to $100M Harmony Hack Moves 41,000 Ether Over Weekend
By Shaurya Malwa - January 16, 2023

Pseudonymous blockchain sleuth ZachXBT said on Monday that part of the funds tied to last year’s $100 million attack on the Harmony network were moved over the weekend.

“North Korea’s Lazarus Group had a very busy weekend, moving $63.5 million (~41,000 ETH) from the Harmony bridge hack through Railgun before consolidating funds and depositing on three different exchanges,” ZachXBT alerted on Twitter.
Click to expand...

The Lazarus Group, a North Korean hacking group [...] is likely behind last year’s hack of Harmony Bridge, according to analysis by blockchain research firm Elliptic, as previously reported by CoinDesk.

The attack drained the service, which enables crypto assets to be traded between the Harmony blockchain and other blockchains, of $100 million worth of crypto, including ether (ETH), tether (USDT) and wrapped bitcoin (wBTC) on the morning of June 24.
The Harmony Bridge hack is consistent with other hacks attributed to the Lazarus Group, including the $635 million Ronin Bridge hack in March, which is so far the largest hack in the history of decentralized finance (DeFi).
Click to expand...

Meanwhile, Binance founder Changpeng Zhao wrote Monday that addresses connected to the hack moved the stolen stash to crypto exchange Huobi, which blocked the transfers and froze the accounts. Over 124 bitcoin were recovered, Zhao said.
Click to expand...

guest · Jan 24, 2023

North Korea-linked hackers behind $100 million crypto heist, FBI says
By Arjun Kharpal @ArjunKharpal - January 24, 2023

KEY POINTS

The FBI said it was “able to confirm” that Lazarus Group and APT38, two hacking groups linked to North Korea, were responsible for the attack on the so-called Horizon bridge last year.

Hackers stole $100 million worth of cryptocurrencies in the attack on the Horizon bridge, which traders use to swap digital tokens between different blockchain networks.

The FBI also said that the North Korean cyber actors this month used the Railgun system to launder over $60 million worth of the token ether stolen during the June 2022 heist.

Click to expand...

North Korean-linked actors were behind the theft of $100 million through the hack of a crypto product last year, the Federal Bureau of Investigation said.

The FBI said it was “able to confirm” that Lazarus Group and APT38, two hacking groups linked to Pyongyang, were responsible for the attack on the so-called Horizon bridge in 2022.
Traders use a bridge to swap cryptocurrencies between different blockchain networks.
Click to expand...

The FBI also said that the North Korean cyber actors this month used the Railgun system to launder over $60 million worth of the token ether stolen during the June 2022 heist. Railgun is a system designed to help preserve the anonymity of people moving cryptocurrency.
A portion of the stolen ether was sent to several virtual asset service providers and converted to bitcoin, the FBI said.
Click to expand...

guest · Feb 2, 2023

Last year was the worst on record for crypto hacks, as North Korean groups cash in
By Jonathan Greig @jgreigj - February 2, 2023

Nearly $4 billion was stolen in cyberattacks on cryptocurrency platforms in 2022, fueled in large part by hackers working on behalf of the North Korean government.
Click to expand...

Blockchain research firm Chainalysis found that it was a banner year for hackers targeting cryptocurrency firms, with about $3.8 billion in total stolen from companies in the industry, up from $3.3 billion in 2021.

Most of the attacks centered on decentralized finance (DeFi) platforms – which made up more than four in every five victims in 2022. More than $3.1 billion was stolen from DeFi platforms last year.
Click to expand...

Chainalysis researchers told The Record that hackers especially targeted cross-chain bridge protocols – tools that let users port their cryptocurrency from one blockchain to another. Of the $3.1 billion stolen from DeFi platforms, 64% came from cross-chain bridge protocols.

“These events target the sinew between blockchains and DeFi projects, and often, they successfully compromise hundreds of millions of USD equivalent value,” they said.
Click to expand...

Chainalysis noted that much of the hacking activity was led by groups associated with the North Korean military, which has prioritized cryptocurrency hacks in an effort to fund their nuclear weapons program.

Hackers with North Korea’s Lazarus Group and others were responsible for $1.7 billion worth of cryptocurrency theft in 2022, shattering their own records. Chainalysis noted that in 2020, the country’s total exports were just $142 million, making the crypto hacks a “sizable chunk of the nation’s economy.”
Click to expand...

Chainalysis: 2022 Biggest Year Ever For Crypto Hacking with $3.8 Billion Stolen, Primarily from DeFi Protocols and by North Korea-linked Attackers

February 1, 2023
2022 was the biggest year ever for crypto hacking, with $3.8 billion stolen from cryptocurrency businesses.
Hacking activity ebbed and flowed throughout the year, with huge spikes in March and October, the latter of which became the biggest single month ever for cryptocurrency hacking, as $775.7 million was stolen in 32 separate attacks.

Below, we’ll dive into what kinds of platforms were most affected by hacks, and take a look at the role of North Korea-linked hackers, who drove much of 2022’s crypto hacking activity and shattered their own yearly record for most cryptocurrency stolen.
Click to expand...

Log in or Sign up

Lazarus continues to attack the cryptocurrency business with enhanced capabilities

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Lazarus continues to attack the cryptocurrency business with enhanced capabilities

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches