Arkham

Tornado Cash

Read

Security

Tornado

<p class="is-style-lead">SlowMist reveals a sophisticated APT attack by North Korea’s Lazarus Group targeting the cryptocurrency industry.</p> 
<p>Blockchain security firm <a href="https://twitter.com/SlowMist_Team/status/1701507138932416841" target="_blank" rel="noopener">SlowMist</a> has recently revealed an alarming revelation: The infamous North Korean Lazarus Group is actively targeting the cryptocurrency industry through an advanced persistent threat (APT) attack.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">🚨SlowMist Security Alert🚨<br><br>Recently, we and our partners discovered a large-scale APT attack directed by the North Korean <a href="https://twitter.com/hashtag/LazarusGroup?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener">#LazarusGroup</a> against the cryptocurrency industry. <br><br>The attack method is as follows:👇<br><br>The attacker first disguises his identity, deceives the auditor… <a href="https://t.co/XsM7F0bPcV" target="_blank">pic.twitter.com/XsM7F0bPcV</a></p>— SlowMist (@SlowMist_Team) <a href="https://twitter.com/SlowMist_Team/status/1701507138932416841?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">September 12, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<h2 class="wp-block-heading" id="what-are-apt-attacks">What are APT Attacks?</h2> 
<p>An advanced persistent threat (APT) is a prolonged, targeted cyberattack where an intruder gains access to a network and remains undetected for an extended period. This kind of attack is generally state-sponsored or carried out by well-funded criminal organizations. What distinguishes APTs from other cyberattacks is the level of sophistication and the attacker’s intent to maintain persistent, unauthorized access to a network. The objective is usually espionage, data theft, or financial gain.</p> 
<h2 class="wp-block-heading" id="inside-the-lazarus-apt-operation-against-crypto-companies">Inside the Lazarus APT operation against crypto companies&nbsp;</h2> 
<p>Initially, they impersonate legitimate customers, fooling auditors through real-person authentication to create a customer profile. Then, with that trusted identity, they make genuine deposits to further solidify their façade.</p> 
<p> You might also like: <a href="https://crypto.news/tornado-cash-creators-deny-laundering-1b-for-north-korea-hackers/"> Tornado Cash creators deny laundering $1b for North Korea hackers </a> </p> 
<p>Their sophisticated attack doesn’t stop there. Armed with customer status, they engage with company personnel through Mac or Windows Trojans, which are strategically aimed at employees. Once a Trojan infiltrates the system, the attackers secure permissions that allow them to move laterally within the network. From there, they lie in wait—sometimes for a considerable period—before seizing funds.</p> 
<p>The Lazarus group is becoming increasingly threatening to the wider crypto industry. Just last week, the group <a href="https://crypto.news/fbi-lazarus-group-hacked-and-stole-41m-from-crypto-casino-stake/">stole</a> $41 million worth of digital assets from leading crypto casino Stake.&nbsp;</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Wallet Addresses of the <a href="https://t.co/Ysm8KOCBL1" target="_blank">https://t.co/Ysm8KOCBL1</a> Hacker are live on the Arkham Platform.<br><br>The Stake Hacker removed ~$41M from Stake Hot Wallets in a series of “unauthorized transactions” on Monday.<br><br>Since then the hacker has begun moving the funds cross-chain. <a href="https://t.co/mCSIWNEX3K" target="_blank">https://t.co/mCSIWNEX3K</a> <a href="https://t.co/XNGKQy5Z0k" target="_blank">pic.twitter.com/XNGKQy5Z0k</a></p>— Arkham (@ArkhamIntel) <a href="https://twitter.com/ArkhamIntel/status/1699762880105824596?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">September 7, 2023</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>Lazarus is one of the most infamous North Korean state-backed ransomware groups. North Korea has been actively using stolen crypto assets to fund its illicit weapons program. Recently, South Korea has developed a new <a href="https://crypto.news/seoul-to-target-north-koreas-illicit-crypto-assets-with-a-new-cyber-bill/">cyber bill</a> to stop North Korea’s crypto heists.&nbsp;</p> 
<p> Read more: <a href="https://crypto.news/seoul-to-target-north-koreas-illicit-crypto-assets-with-a-new-cyber-bill/"> Seoul to target North Korea’s illicit crypto assets with a new cyber bill </a> </p>

North Korean Lazarus Group is targeting crypto companies with APT attacks

Table of Contents

crypto.news

Other articles published on Sep 13, 2023

Emurgo to invest and fill 21 areas 'missing' from Cardano: Emurgo CEO

Premia Blue, the Future proof DeFi Options Exchange, is now live on Arbitrum

Stellar’s Price and Social Metrics Move in Opposite Directions

Official IDO Timeline

Crypto Market Fell Between 2% and 4% Ahead of US Inflation Report

India announces 5 revolutionary measures for the crypto sector at the G20

Join our free newsletter for daily crypto updates!