Dream

Steve

Chainlink

Meta

The Lazarus Group, a North Korean hacking collective, has employed a new and highly sophisticated malware variant known as LightlessCan in its fraudulent employment schemes, which poses a significant challenge to detection compared to its predecessor. 
ESET’s senior malware researcher, Peter Kálnai, revealed these findings in a post on September 29, following an analysis of a fake job attack targeting a Spanish aerospace firm. 
Lazarus Group’s typical modus operandi involves luring victims with enticing employment offers at reputable companies and tricking them into downloading malicious payloads disguised as documents. 
However, LightlessCan represents a notable advancement over its precursor, BlindingCan. Kálnai explained that LightlessCan can mimic various native Windows commands, enabling discreet execution within the Remote Access Trojan (RAT) itself, minimizing noisy console executions. 
This enhanced stealthiness makes it challenging for real-time monitoring solutions like EDRs and postmortem digital forensic tools to detect. 
READ MORE:<a href="https://www.cryptointelligence.co.uk/venture-capital-firm-paradigm-criticizes-secs-unconventional-approach-in-binance-case/">Venture Capital Firm Paradigm Criticizes SEC’s Unconventional Approach in Binance Case</a> 
Furthermore, the new malware incorporates “execution guardrails” to ensure that only the intended victim’s machine can decrypt the payload, preventing unintended decryption by security researchers. 
One known case involving this new malware targeted a Spanish aerospace firm when an employee received a message from a fake Meta recruiter named Steve Dawson in 2022. Subsequently, the hackers sent two coding challenges embedded with the malware. 
Lazarus Group’s primary motive for the attack on the Spanish aerospace firm was cyberespionage. 
Notably, North Korean hackers have been responsible for stealing an estimated $3.5 billion from cryptocurrency projects since 2016, as reported by blockchain forensics firm Chainalysis on September 14. 
In September 2022, cybersecurity firm SentinelOne issued a warning about a fake job scam on LinkedIn, part of a campaign known as “Operation Dream Job,” offering potential victims positions at Crypto.com. 
Simultaneously, the United Nations has been actively working to curb North Korea’s cybercrime tactics on an international scale, as it is believed that the stolen funds are being used to support North Korea’s nuclear missile program. 
This ongoing effort underscores the global impact and consequences of cyberattacks orchestrated by groups like Lazarus. 
Other Stories: 
<a href="https://www.cryptointelligence.co.uk/sec-delays-decision-on-spot-bitcoin-etf-proposals-amid-looming-government-shutdown/">SEC Delays Decision on Spot Bitcoin ETF Proposals Amid Looming Government Shutdown</a> 
<a href="https://www.cryptointelligence.co.uk/venture-capital-firm-paradigm-criticizes-secs-unconventional-approach-in-binance-case/">Venture Capital Firm Paradigm Criticizes SEC’s Unconventional Approach in Binance Case</a> 
<a href="https://www.cryptointelligence.co.uk/space-and-time-integrates-its-proof-of-sql-verifier-into-chainlink-nodes/">Space and Time Integrates Its Proof of SQL Verifier Into Chainlink Nodes</a>

North Korean Hacking Group Lazarus Unleashes Advanced Malware in New Employment Scams

Crypto Intelligence

Other articles published on Oct 5, 2023

Sam Bankman-Fried’s first day of trial had five highlights.

KDIC Seizes Crypto from Debtors Linked to Losses at Financial Firms

Ethereum Supply in Exchanges Alarms! Bullish Signal for ETH?

Hong Kong VC Firm Announces $100M Fund for Asian Crypto Startups

Exploring The World Of NFT Funko

Banks to disclose cryptocurrency holdings amid 2023 bank failures

Join our free newsletter for daily crypto updates!