No products in the cart.
- Latest
- Trending
ADVERTISEMENT
Microsoft reports that an attacker targeting cryptocurrency investment startups has been identified. One party, dubbed his DEV-0139 by Microsoft, masqueraded as a cryptocurrency investment firm on Telegram and used Excel files weaponized with “crafted” malware to infect and remotely access systems. did.
This threat is part of a trend of highly sophisticated attacks. In this case, the threat actor falsely identified himself with a fake profile of an OKX employee and joined a Telegram group used to facilitate communication between VIP clients and cryptocurrency exchange platforms. I have written In a Dec. 6 blog post. Microsoft explained:
“we are [] We review more complex attacks where threat actors demonstrate superior knowledge and preparation and take steps to gain the trust of their targets before deploying payloads.
In October, Target was invited to a new group and asked for feedback on an Excel document comparing VIP pricing structures from OKX, Binance and Huobi. While this document provided accurate information and demonstrated a high degree of awareness of the realities of cryptocurrency trading, it was found to invisibly create a malicious .dll (Dynamic Link library) files were sideloaded. The target was then asked to open the .dll file himself during the course of the fee discussion.
The infamous North Korean Lazarus Group has developed new and improved versions of its cryptocurrency-stealing malware AppleJeus. @nknewsorg @Ethan Jewel https://t.co/LjimOmPI5s
CSIS Korea Chair (@CSISKoreaChair) December 6, 2022
The attack technique itself has been known for some time. Microsoft has suggested that the threat actor is the same one found using .dll files for similar purposes in his June, possibly behind other incidents. According to Microsoft, DEV-0139 is the same actor as cybersecurity firm Volexity. linked It was sent to North Korea’s state-run Lazarus Group using a malware variant known as AppleJeus and an MSI (Microsoft Installer).U.S. Federal Cybersecurity and Infrastructure Security Agency documented AppleJeus in 2021, and Kaspersky Labs report in 2020.
RELATED: North Korean Lazarus Group Claimed Behind Ronin Bridge Hack
The US Treasury has officially linked the Lazarus Group to North Korea’s nuclear weapons program.
