Lazarus hackers are using malicious cryptocurrency apps, FBI warns
People working in cryptocurrency businesses are being targeted by Lazarus, a well-known threat actor with strong ties to the government of North Korea, law enforcement groups have warned.
The CISA, the FBI, and the US Treasury Department have banded together to issue a warning to firms in the cryptocurrency industry, urging them to be on their guard.
According to the warning, Lazarus is looking to infect endpoints in crypto firms with trojans, in order to try and drain them of their funds.
Multiple fake apps being distributed
As usual, the attacks start by threat actors assuming the identity of someone close, or of interest, to the victim.
“Intrusions begin with a large number of spearphishing messages sent to employees of cryptocurrency companies—often working in system administration or software development/IT operations (DevOps)—on a variety of communication platforms,” it says in the warning.
“The messages often mimic a recruitment effort and offer high-paying jobs to entice the recipients to download malware-laced cryptocurrency applications, which the U.S. government refers to as TraderTraitor.”
TraderTraitor, it was said, is an Electron-based, cross-platform utility built on JavaScript and the Node.js runtime environment. Depending on the device it targets, TraderTraitor can carry different variants of a Remote Access Trojan (RAT) called Manuscrypt.
“Observed payloads include updated macOS and Windows variants of Manuscrypt, a custom remote access trojan (RAT), that collects system information and has the ability to execute arbitrary commands and download additional payloads,” the federal agencies added.
There are multiple apps that are being referred to, by the security agencies, as TraderTraitor: DAFOM (cryptocurrency portfolio application for macOS), TokenAIS (portfolio builder for AI-based crypto trading for macOS), CryptAIS (portfolio builder for AI-based crypto trading for macOS), AlticGO (crypto price tracker and predictor for Windows), Esilet (crypto price tracker and predictor for macOS), and CreAI Deck (AI and deep learning platform for Windows and macOS).
Crypto companies are under a constant barrage of cyberattacks. Only recently, a flaw in the operations of Beanstalk Farms, a stablecoin protocol, has allowed an unknown threat actor to siphon $182 million from the network.
Before that, hundreds of millions of dollars in cryptocurrency were stolen after the Ronin Network, which provides the blockchain “bridge” that powers NFT game Axie Infinity, was compromised.
Via: BleepingComputer
Audio player loading… People working in cryptocurrency businesses are being targeted by Lazarus, a well-known threat actor with strong ties to the government of North Korea, law enforcement groups have warned. The CISA, the FBI, and the US Treasury Department have banded together to issue a warning to firms in…
Recent Posts
- Quordle today – hints and answers for Thursday, May 16 (game #843)
- Samsung’s customizable Music Frame speaker is receiving its first discount
- NYT Strands today — hints, answers and spangram for Thursday, May 16 (game #74)
- iOS 17.5 is reportedly resurfacing once deleted photos for some users
- Arizona accuses Amazon of being a monopoly and deceiving consumers with ‘dark patterns’
Archives
- May 2024
- April 2024
- March 2024
- February 2024
- January 2024
- December 2023
- November 2023
- October 2023
- September 2023
- August 2023
- July 2023
- June 2023
- May 2023
- April 2023
- March 2023
- February 2023
- January 2023
- December 2022
- November 2022
- October 2022
- September 2022
- August 2022
- July 2022
- June 2022
- May 2022
- April 2022
- March 2022
- February 2022
- January 2022
- December 2021
- November 2021
- October 2021
- September 2021
- August 2021
- July 2021
- June 2021
- May 2021
- April 2021
- March 2021
- February 2021
- January 2021
- December 2020
- November 2020
- October 2020
- September 2020
- August 2020
- July 2020
- June 2020
- May 2020
- April 2020
- March 2020
- February 2020
- January 2020
- December 2019
- November 2019
- December 2011