Lazarus Group Deploys Its First Mac Malware in Cryptocurrency Exchange Hack

guest · Aug 23, 2018

Lazarus Group Deploys Its First Mac Malware in Cryptocurrency Exchange Hack
August 22, 2018
https://www.bleepingcomputer.com/ne...-mac-malware-in-cryptocurrency-exchange-hack/

Lazarus Group, the North Korean hackers who hacked Sony Films a few years back, have deployed their first Mac malware ever, according to Russian antivirus vendor Kaspersky Lab.

In a report shared with Bleeping Computer in advance, Kaspersky researchers reveal that Lazarus Group penetrated the IT systems of an Asia-based cryptocurrency exchange platform.
The mystery of the malware's certificate
Furthermore, the trojanized cryptocurrency trading software was also signed by a valid digital certificate, allowing it to bypass security scans.

The big mystery surrounding this certificate is that it was issued by a company that Kaspersky experts said they weren't able to prove it ever existed at the address in the certificate's information.

Kaspersky did not reveal the name of the cryptocurrency exchange at the center of its report, nor did it respond to a request for comment for additional information from Bleeping Computer.
Click to expand...

Report
Operation AppleJeus: Lazarus hits cryptocurrency exchange with fake installer and macOS malware
August 23, 2018
https://securelist.com/operation-applejeus/87553/

guest · Mar 26, 2019

Cryptocurrency businesses still being targeted by Lazarus
March 26, 2019
https://securelist.com/cryptocurrency-businesses-still-being-targeted-by-lazarus/90019/

It’s no secret that Apple products are now very popular among successful internet startups and fintech companies, and this is why the malicious actor built and used macOS malware. While investigating earlier Lazarus incidents, we anticipated this actor would eventually expand its attacks to macOS.
It appears that Lazarus is using the same developers to expand to other platforms, because some of the features have remained consistent as its malware evolves.

Based on our telemetry, we found a cryptocurrency exchange company attacked with a malicious document containing the same macro.
The payloads show that Lazarus keeps exploring more ways to evade detection to stay under the radar longer. The group builds malware for 32-bit and 64-bit Windows separately to support both platforms and have more variety in terms of compiled code.

We’d therefore like to ask Windows and macOS users to be more cautious and not fall victim to Lazarus. If you’re part of the booming cryptocurrency or technological startup industry, exercise extra caution when dealing with new third parties or installing software on your systems.
Click to expand...

And never ‘Enable Content’ (macro scripting) in Microsoft Office documents received from new or untrusted sources. [...] if you need to try out new applications, it’s better do so offline or on an isolated network virtual machine which you can erase with a few clicks.
Click to expand...

Log in or Sign up

Lazarus Group Deploys Its First Mac Malware in Cryptocurrency Exchange Hack

guest Guest

guest Guest

Log in or Sign up

Lazarus Group Deploys Its First Mac Malware in Cryptocurrency Exchange Hack

guest Guest

guest Guest

Useful Searches