{"id":15166,"date":"2022-12-05T15:15:11","date_gmt":"2022-12-05T15:15:11","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/north-korean-lazarus-group-linked-to-new-cryptocurrency-hacking-scheme-security-bitcoin-news\/"},"modified":"2022-12-05T15:15:11","modified_gmt":"2022-12-05T15:15:11","slug":"north-korean-lazarus-group-linked-to-new-cryptocurrency-hacking-scheme-security-bitcoin-news","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/north-korean-lazarus-group-linked-to-new-cryptocurrency-hacking-scheme-security-bitcoin-news\/","title":{"rendered":"North Korean Lazarus Group Linked to New Cryptocurrency Hacking Scheme \u2013 Security Bitcoin News"},"content":{"rendered":"

(Originally posted on : Bitcoin News )<\/b>
\n<\/p>\n

\n
\n<\/header>\n
\n<\/div>\n

The Lazarus group, a North Korean hacking organization previously linked to criminal activity, has been connected to a new attack scheme to breach systems and steal cryptocurrency from third parties. The campaign, which uses a modified version of an already existing malware product called Applejeus, uses a crypto site and even documents to gain access to systems.<\/strong><\/p>\n

Modified Lazarus Malware Used Crypto Site as Facade<\/h2>\n

Volexity, a Washington D.C.-based cybersecurity firm, has linked Lazarus, a North Korean hacking group already sanctioned by the U.S. government, with a threat involving the use of a crypto site to infect systems in order to steal info and cryptocurrency from third parties.<\/p>\n

A blog post issued<\/a> on Dec. 1 revealed that in June, Lazarus registered a domain called \u201cbloxholder.com,\u201d which would be later established as a business offering services of automatic cryptocurrency trading. Using this site as a facade, Lazarus prompted users to download an application that served as a payload to deliver the Applejeus malware, directed to steal private keys and other data from the users\u2019 systems.<\/p>\n

The same strategy has been used by Lazarus before. However, this new scheme uses a technique that allows the application to \u201cconfuse and slow down\u201d malware detection tasks.<\/p>\n

Document Macros<\/h2>\n

Volexity also found that the technique to deliver this malware to final users changed in October. The method morphed to use Office documents, specifically a spreadsheet containing macros, a sort of program embedded in the documents designed to install the Applejeus malware in the computer.<\/p>\n

The document, identified with the name \u201cOKX Binance & Huobi VIP fee comparision.xls,\u201d displays the benefits that each one of the VIP programs of these exchanges supposedly offers at their different levels. To mitigate this kind of attack, it is recommended to block the execution of macros in documents, and also scrutinize and monitor the creation of new tasks in the OS to be aware of new unidentified tasks running in the background. However, Veloxity did not inform on the level of reach that this campaign has attained.<\/p>\n

Lazarus was formally indicted<\/a> by the U.S. Department of Justice (DOJ) in Feb. 2021, involving an operative of the group linked to a North Korean intelligence organization, the Reconnaissance General Bureau (RGB). Before that, in March 2020, the DOJ indicted<\/a> two Chinese nationals for aiding in the laundering of more than $100 million in cryptocurrency linked to Lazarus\u2019 exploits.<\/p>\n

\n
\nTags in this story
\n<\/h6>\n
applejeus<\/a>, bloxholder<\/a>, Crypto<\/a>, data<\/a>, department of justice<\/a>, indicment<\/a>, indictment<\/a>, Lazarus<\/a>, Malware<\/a>, payload<\/a>, Theft<\/a>, volexity<\/a><\/div>\n<\/div>\n

What do you think about Lazarus\u2019 latest cryptocurrency malware campaign? Tell us in the comments section below.<\/strong><\/em><\/p>\n

\n
\n<\/div>\n
\n
\nSergio Goschenko <\/h6>\n

\nSergio is a cryptocurrency journalist based in Venezuela. He describes himself as late to the game, entering the cryptosphere when the price rise happened during December 2017. Having a computer engineering background, living in Venezuela, and being impacted by the cryptocurrency boom at a social level, he offers a different point of view about crypto success and how it helps the unbanked and underserved.<\/p>\n<\/div>\n<\/div>\n

Image Credits<\/b>: Shutterstock, Pixabay, Wiki Commons<\/em><\/p>\n

\n

Disclaimer<\/strong>: This article is for informational purposes only. It is not a direct offer or solicitation of an offer to buy or sell, or a recommendation or endorsement of any products, services, or companies. Bitcoin.com<\/a> does not provide investment, tax, legal, or accounting advice. Neither the company nor the author is responsible, directly or indirectly, for any damage or loss caused or alleged to be caused by or in connection with the use of or reliance on any content, goods or services mentioned in this article.<\/p>\n<\/div>\n

\n