Railgun

United

April

Security

Tornado

North Korean hackers have deployed a new malware variant called “Durian” to attack South Korean cryptocurrency firms.
According to a May 9 threat <a href="https://securelist.com/apt-trends-report-q1-2024/112473/" target="_blank" rel="noopener noreferrer nofollow">report </a>from cybersecurity firm Kaspersky, the North Korean hacking group Kimsuky used this malware in targeted attacks on at least two cryptocurrency firms.
The attacks were conducted by exploiting legitimate security software used exclusively by South Korean crypto firms. The previously undisclosed Durian malware serves as an installer, deploying a steady stream of spyware, including a backdoor called “AppleSeed,” a bespoke proxy tool called LazyLoad, and other genuine programs like Chrome Remote Desktop.
“Durian boasts comprehensive backdoor functionality, enabling the execution of delivered commands, additional file downloads, and exfiltration of files,” Kaspersky stated.
Furthermore, the cybersecurity firm discovered that LazyLoad was also used by Andariel, a sub-organization inside fellow North Korean hacking consortia Lazarus group, implying a “tenuous” link between Kimsuky and the more infamous hacking organization.
Having first surfaced in 2009, Lazarus has become one of the most notorious cryptocurrency hacker groups.
On April 29, ZachXBT, an independent blockchain investigator, <a href="https://crypto.news/lazarus-group-hackers-launch-new-method-for-cyber-attacks/" rel="noopener noreferrer nofollow">reported </a>that the Lazarus business had successfully laundered over $200 million in ill-gotten cryptocurrency between 2020 and 2023.
In May, The United Nations Security Council released a report indicating North Korea’s escalating involvement in cyberattacks, which now comprise almost half of its foreign currency earnings. Although investigations are still ongoing, the Lazarus Group is suspected of stealing more than $3 billion in cryptocurrency assets over the course of six years, culminating in 2023.
You might also like: <a href="https://crypto.news/lazarus-group-hackers-launch-new-method-for-cyber-attacks/" rel="noopener noreferrer nofollow"> Lazarus Group hackers launch new method for cyber attacks </a>
Lazarus was accused of stealing more than 17% — or slightly more than <a href="https://crypto.news/north-koreas-lazarus-behind-300m-in-2023-crypto-losses/" rel="noopener noreferrer nofollow">$300 million</a> — of all stolen funds in 2023. According to an Immunefi analysis released on December 28, more than<a href="https://downloads.ctfassets.net/t3wqy70tc3bv/ItxhGk5tgb1sj3DCC4ZoA/e3be78485ac665f585b77643d5dee001/Immunefi_Crypto_Losses_Final.pdf" target="_blank" rel="noopener noreferrer nofollow"> $1.8 billion</a> in cryptocurrency was lost due to attacks and exploits in 2023.
The notorious group Lazarus has been reported to use crypto mixers extensively in their operations to obscure the origins of stolen funds. As concerns about laundering through privacy protocols persist, Railgun, a popular protocol, has <a href="https://crypto.news/railgun-refutes-fbi-claims-of-north-korean-misuse-upholds-privacy/" rel="noopener noreferrer nofollow">refuted allegations</a> of being used by North Korean hackers or sanctioned individuals.
The claims came to light following a January 2023 FBI statement suggesting that North Korea’s Lazarus Group had laundered over $60 million in Ethereum through Railgun after a cyberattack in June 2022.
Following the U.S. sanctions on popular crypto mixer <a href="https://crypto.news/tornado-cash-co-founder-claps-back-laundering-charges/" rel="noopener noreferrer nofollow">Tornado Cash</a>, there were speculations that Railgun was becoming a preferred alternative for such operations.
Read more: <a href="https://crypto.news/lazarus-group-crypto-bull-market/" rel="noopener noreferrer nofollow"> Is Lazarus Group the biggest threat to crypto in this bull market? </a>

North Korean hackers target crypto firms with ‘Durian’ malware, Kaspersky confirms

crypto.news

Other articles published on May 13, 2024

May 13 Deadline: A Turning Point in the SEC vs Ripple Lawsuit

Crypto Analyst Marks Boring Sideways Movement as Whale Accumulation Phase, Trigger to Super Cycle...

FLOKI Price Surges 8% Following Bitpanda Index Listing

Next Cryptocurrency To Explode Monday, May 13 — Helium, Bitcoin Cash, Toncoin, FTX Token

Memecoin Investor Reaps Massive Profit

Tether Responds to Ripple: A Defense of Transparency and Compliance

Join our free newsletter for daily crypto updates!