Security

<div class="sg-post-des">
 Lazarus members posed as engineers and fooled exchange employees into downloading difficult-to-detect malware.
</div>
<div class="cointelegraph">
 Lazarus Group used a new form of <a rel="noopener noreferrer nofollow" title="malware" href="https://thebittimes.com/tag/malware.html">malware</a> in an <a rel="noopener noreferrer nofollow" title="attempt" href="https://thebittimes.com/tag/attempt.html">attempt</a> to <a rel="noopener noreferrer nofollow" title="compromise" href="https://thebittimes.com/tag/compromise.html">compromise</a> a crypto <a rel="noopener noreferrer nofollow" title="exchange" href="https://thebittimes.com/tag/exchange.html">exchange</a>, according to an October 31 report from Elastic Security Labs.
 Elastic has named the new <a rel="noopener noreferrer nofollow" title="malware" href="https://thebittimes.com/tag/malware.html">malware</a> “KANDYKORN” and the loader program that loads it into memory “SUGARLOAD,” as the loader file has a novel “.sld” extension in its name. Elastic did not name the <a rel="noopener noreferrer nofollow" title="exchange" href="https://thebittimes.com/tag/exchange.html">exchange</a> that was targeted.
 Crypto exchanges have suffered a rash of private-key hacks in 2023, most of which have been traced to the North Korean cybercrime enterprise, Lazarus Group.
 <figure><img src="https://cdn.thebittimes.com/images/2023/11/02/ded3a813c53c5b20ac0fb7c910c66369.webp">
 <figcaption style="text-align: center;">KANDYKORN infection process. Source: Elastic Security Labs.
 </figcaption>
 </figure>
 According to Elastic, the attack began when Lazarus members posed as blockchain engineers and targeted engineers from the unnamed crypto exchange. The attackers made contact on Discord, claiming they had designed a profitable arbitrage bot that could profit from discrepancies between prices of cryptos on different exchanges.
 The attackers convinced the engineers to download this “bot.” The files in the program’s ZIP folder had disguised names like “config.py” and “pricetable.py” that made it appear to be an arbitrage bot.
 Once the engineers ran the program, it executed a “Main.py” file that ran some ordinary programs as well as a malicious file called “Watcher.py.” Watcher.py established a connection to a remote Google Drive account and began downloading content from it to another file named testSpeed.py. The malicious program then ran testSpeed.py a single time before deleting it in order to cover its tracks.
 During the single-time execution of testSpeed.py, the program downloaded more content and eventually executed a file that Elastic calls “SUGARLOADER.” This file was obfuscated using a “binary packer,” Elastic stated, allowing it to bypass most malware detection programs. However, they were able to discover it by forcing the program to stop after its initialization functions had been called, then snapshotting the process’ virtual memory.
 According to Elastic, they ran VirusTotal <a rel="noopener noreferrer nofollow" title="malware" href="https://thebittimes.com/tag/malware.html">malware</a> detection on SUGARLOADER, and the detector declared that the file was not malicious.
 Related: Crypto firms beware: Lazarus’ new malware can now bypass detection
 Once SUGARLOADER was downloaded into the computer, it connected to a remote server and downloaded KANDYKORN directly into the device’s memory. KANDYKORN contains numerous functions that can be used by the remote server to perform various malicious activities. For example, the command “0xD3” can be used to list the contents of a directory on the victim’s computer, and “resp_file_down” can be used to transfer any of the victim’s files to the attacker’s computer.
 Elastic believes that the attack occurred in April, 2023. It claims that the program is probably still being used to perform attacks today, stating:
 <blockquote>
 “This threat is still active and the tools and techniques are being continuously developed.”
 </blockquote>
 Centralized crypto <a rel="noopener noreferrer nofollow" title="exchange" href="https://thebittimes.com/tag/exchange.html">exchange</a>s and apps suffered a rash of attacks in 2023. Alphapo, CoinsPaid, Atomic Wallet, Coinex, Stake and others have been victims of these attacks, most of which seem to have involved the attacker stealing a private key off the victim’s device and using it to transfer customers’ cryptocurrency to the attacker’s address.
 The US Federal Bureau of Investigation (FBI) has accused the Lazarus Group of being behind the Coinex hack, as well as performing the Stake attack and others.
 <template data-name="subscription_form" data-type="defi_newsletter"></template>
</div>
Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/lazarus-used-kandykorn-malware-in-attempt-to-compromise-exchange-elastic-tbt68733.html">https://thebittimes.com/lazarus-used-kandykorn-malware-in-attempt-to-compromise-exchange-elastic-tbt68733.html</a>

Lazarus used ‘KANDYKORN’ malware in attempt to compromise exchange —Elastic

TheBitTimes

Other articles published on Nov 1, 2023

Whales Move Millions in XRP As Price Holds Recent Gains

Polkadot firm, dYdX launches on Cosmos while Everlodge investors are bullish

Onyx Protocol Victim of $2 Million Exploit: Reports

Invesco-Galaxy Bitcoin ETF ticker appears on DTCC

WalletConnect restricts service in Russia following OFAC guidance

Sentimen Positif Masif 2023, Arus Masuk ke Crypto Tembus Tertinggi Sejak Juli 2022

Join our free newsletter for daily crypto updates!