The intrusions, detected earlier this January, commenced with a suspicious HTM file received either as a link in a phishing email or downloaded from the internet that, when opened, triggers an infection sequence, ultimately leading to the retrieval of a second-stage payload from a remote server to facilitate further incursions. In another cyber offensive disclosed by Broadcom Symantec this week, the actor has been observed targeting South Korean organizations operating within the chemical sector in what appears to be a continuation of a malware campaign dubbed " Operation Dream Job," corroborating findings from Google's Threat Analysis Group in March 2022.
#Lazarus group windows
government on the hacking collective, recent campaigns undertaken by the group have capitalized on trojanized decentralized finance (DeFi) wallet apps to backdoor Windows systems and misappropriate funds from unsuspecting users. ERC-20 tokens and other altcoins constitute the remaining 22%.ĭespite sanctions imposed by the U.S. The group is known to have plundered an estimated $400 million worth of digital assets from crypto platforms in 2021, marking a 40% jump from 2020, according to Chainalysis, with only 20% of those stolen funds associated with Bitcoin and Ether accounting for a 58% majority. Cybersecurity and Infrastructure Security Agency (CISA) has painted the cyber actors as an increasingly sophisticated collective that has developed and deployed a wide range of malware tools around the world to facilitate these activities. "The country's espionage operations are believed to be reflective of the regime's immediate concerns and priorities, which is likely currently focused on acquiring financial resources through crypto heists, targeting of media, news, and political entities, information on foreign relations and nuclear information," Mandiant pointed out in a recent deep dive. Lazarus Group, an umbrella name assigned to prolific state-sponsored actors operating on behalf of North Korean strategic interests, has a track record of conducting cryptocurrency thefts since at least 2017 to bypass sanctions and fund the country's nuclear and ballistic missile programs. Nearly $80.3 million of the laundered funds have involved the use of Tornado Cash, a mixing service on the Ethereum blockchain designed to obscure the trail of funds, with another $9.7 million worth of ETH likely to be laundered in the same manner. "By converting the tokens at DEXs, the hacker avoided the anti-money laundering (AML) and 'know your customer' (KYC) checks performed at centralized exchanges." "First, the stolen USDC was swapped for ETH through decentralized exchanges (DEXs) to prevent it from being seized," Elliptic noted. An analysis by Elliptic has found that the actor has already managed to launder 18% of the siphoned digital funds (about $97 million) as of April 14. individuals and entities from transacting with it to ensure that the state-sponsored group can't cash out any further funds.
"The attacker used hacked private keys in order to forge fake withdrawals," the Ronin Network explained in its disclosure report a week later after the incident came to light.īy sanctioning the wallet address, the move prohibits U.S. The cryptocurrency heist, the second-largest cyber-enabled theft to date, involved the siphoning of 173,600 Ether (ETH) and 25.5 million USD Coins from the Ronin cross-chain bridge, which allows users to transfer their digital assets from one crypto network to another, on March 23, 2022. government partners, will continue to expose and combat the DPRK's use of illicit activities – including cybercrime and cryptocurrency theft – to generate revenue for the regime," the intelligence and law enforcement agency said in a statement. "The FBI, in coordination with Treasury and other U.S. On Thursday, the Treasury tied the Ethereum wallet address that received the stolen digital currency to the threat actor and sanctioned the funds by adding the address to the Office of Foreign Assets Control's (OFAC) Specially Designated Nationals ( SDN) List.
Treasury Department has implicated the North Korea-backed Lazarus Group (aka Hidden Cobra) in the theft of $540 million from video game Axie Infinity's Ronin Network last month.
0 kommentar(er)
