2024

Wally

April

Security

<h2 class="wp-block-heading" id="north-korean-crypto-hacking-group-targeting-linkedin-users">North Korean Crypto Hacking Group Targeting LinkedIn Users</h2>
<p>North Korea’s state-sponsored hacking collective, known as the <a href="https://twitter.com/im23pds/status/1782984061369405878" target="_blank" rel="noopener noreferrer nofollow">Lazarus</a> Group, is reportedly focusing its efforts on LinkedIn users involved in the digital asset industry. According to a statement from blockchain security firm SlowMist on April 24, the group has been creating fake profiles to connect with human resources personnel and hiring managers at various blockchain-related organizations. The goal? To send links containing malware disguised as coding samples.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet" data-width="500" data-dnt="true">
   <p lang="zh" dir="ltr"><a href="https://twitter.com/hashtag/Lazarus?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">#Lazarus</a> <a href="https://twitter.com/hashtag/APT?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">#APT</a> The Lazarus group appears to be currently reaching out to targets via LinkedIn and steal employee privileges or assets through malware. <a href="https://twitter.com/hashtag/Lazarus?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">#Lazarus</a> <a href="https://twitter.com/hashtag/APT?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">#APT</a> Lazarus 组织目前正通过 LinkedIn 联系加密货币行业的目标，并通过恶意软件窃取员工权限或资产。<img src="https://s.w.org/images/core/emoji/15.0.3/72x72/1f9d0.png" alt="🧐" class="wp-smiley" style="height: 1em; max-height: 1em;"></p>— 23pds (@im23pds) <a href="https://twitter.com/im23pds/status/1782984061369405878?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">April 24, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
 </div>
</figure>
<h2 class="wp-block-heading" id="tactics-and-techniques-unveiled">Tactics and Techniques Unveiled</h2>
<p>SlowMist revealed that the malware initiates by throwing errors through its initial declarations and <a href="https://btc-pulse.com/understanding-rpc-protocols-lava-networks-ceo/" rel="noopener noreferrer nofollow">dependency </a>loading scripts, likely intended to confuse automatic analysis tools. It includes several Node.js modules and manipulates environment variables to extract as much data as possible, including the operating system’s hostname, platform type, and directories. The function named “stealEverything” aims to harvest vast amounts of user data and upload it to servers under the hackers’ control.</p>
<h2 class="wp-block-heading" id="lazarus-group-s-ties-to-north-korea-s-wmd-program">Lazarus Group’s Ties to North Korea’s WMD Program</h2>
<p>A report from a U.N. panel last month estimated that 40% of North Korea’s weapons of mass destruction (WMD) program has been funded through illicit cyber activities, including those perpetrated by the Lazarus Group. This group has reportedly stolen over $3 billion in <a href="https://btc-pulse.com/irs-releases-draft-2025-asset-reporting-us-taxpayers/" rel="noopener noreferrer nofollow">digital </a>assets globally, with more than $600 million stolen in 2023 alone.</p>
<h2 class="wp-block-heading" id="international-response-and-security-concerns">International Response and Security Concerns</h2>
<p>The persistent cyber threats posed by North Korea have prompted <a href="https://btc-pulse.com/sec-prosecutors-resign-amid-allegations/" rel="noopener noreferrer nofollow">discussions </a>among security officials in the U.S. and its allies, concerning the potential national security risks. In December, a meeting among U.S. National Security Advisor Jake Sullivan and counterparts from South Korea and Japan focused on the North Korean WMD program and its funding through cybercrime.</p>
<h2 class="wp-block-heading" id="u-s-actions-against-north-korean-cyber-operations">U.S. Actions Against North Korean Cyber Operations</h2>
<p>In response to these ongoing threats, the U.S. last year <a href="https://btc-pulse.com/tether-takes-action-to-freeze-sanction-oil-trade/" rel="noopener noreferrer nofollow">sanctioned </a>the crypto mixer Sinbad, described as a significant money-laundering tool for North Korea’s regime. Deputy Secretary of the Treasury Wally Adeyemo emphasized the U.S. government’s readiness to use all available tools to prevent virtual currency mixers from facilitating illicit activities, underscoring a commitment to responsible innovation within the digital asset ecosystem while combating illicit use.</p>
<h2 class="wp-block-heading" id="uncertain-future-for-lazarus-group">Uncertain Future for Lazarus Group</h2>
<p>As international scrutiny increases, the future actions and potential political repercussions for the Lazarus Group remain uncertain. The international community continues to watch closely as developments unfold in this high-stakes cyber warfare arena.</p>

Lazarus Group Targeting LinkedIn Users As Part of North Korea Crypto Hacking Scheme

Table of Contents

BTC-Pulse

Other articles published on Apr 24, 2024

This is Why 390,000 Bitcoin Cash (BCH) Investors Could Be Coming Back

Bitcoin Cash Falls More Than 5% In 24 hours

Cryptos That Will Make You Rich in 2024-2025

Exploring Investment Signals in the Crypto Market

Will Bitcoin Repeat Its 721% Gain Post-Halving? Optimistic Growth Predicted for Chainlink Challenger

Daily Market Review: BTC, ETH, HBAR, BONK, ALGO

Join our free newsletter for daily crypto updates!