Diamond

Solana

Tornado

<p class="is-style-lead">North Korean hackers, known as Citrine Sleet, have exploited a severe zero-day vulnerability in the Chromium browser to attack crypto financial institutions.</p>
<p>Citrine Sleet targeted financial institutions and crypto entities to steal digital assets. By creating fake crypto trading platforms, the <a href="https://crypto.news/tag/North-Korea" data-type="link" data-id="https://crypto.news/tag/North-Korea" target="_blank" rel="noopener noreferrer nofollow">North Korean</a> hackers tricked victims into downloading malicious software, such as the AppleJeus trojan, which siphons off crypto funds, <a href="https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/" data-type="link" data-id="https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/" target="_blank" rel="noopener noreferrer nofollow">according</a> to Microsoft.</p>
<p>This flaw allowed attackers to execute remote code, giving them control over infected systems. <a href="https://crypto.news/tag/microsoft/" target="_blank" data-type="link" data-id="https://crypto.news/tag/microsoft/" rel="noopener noreferrer nofollow">Microsoft</a> identified the attack on August 19, and it has been linked to efforts targeting the crypto industry.&nbsp;</p>
<p>The vulnerability, tracked as CVE-2024-7971, was a type of confusion flaw in Chromium’s V8 JavaScript engine, permitting attackers to bypass browser security and execute code within the browser’s sandbox, according to Microsoft.</p>
<p>In other words, the Chromium browser, which is the foundation for browsers like Google Chrome and Microsoft Edge, had a severe zero-day vulnerability. This means hackers discovered a serious flaw in Chromium before its own developers did. Hackers could use this flaw for malicious intentions — especially against crypto financial institutions.</p>
<p><a href="https://crypto.news/tag/Google/" target="_blank" data-type="link" data-id="https://crypto.news/tag/Google/" rel="noopener noreferrer nofollow">Google</a> addressed this vulnerability two days after the attack with a patch released on August 21.</p>
<p>You might also like: <a href="https://crypto.news/crypto-fraud-mbappes-x-account-hacked-trader-loses-over-1m/" rel="noopener noreferrer nofollow"> Crypto fraud: Mbappé’s X account hacked, trader loses over $1m&nbsp; </a></p>
<h2 class="wp-block-heading" id="other-malware">Other malware</h2>
<p>Alongside CVE-2024-7971, the hackers deployed malware titled ‘FudModule’ rootkit, which was designed to manipulate Windows’s security measures, according to Microsoft.</p>
<p>This rootkit was previously associated with Diamond Sleet, another North Korean group, suggesting that the same advanced tools are being shared among various North Korean threat actors.</p>
<p>Microsoft stated that Diamond Sleet had been observed using FudModule since October 2021.</p>
<h2 class="wp-block-heading" id="other-north-korean-hacks">Other North Korean hacks&nbsp;</h2>
<p>On August 15, Cybersecurity expert ZachXBT <a href="https://crypto.news/north-korean-workers-tied-to-1-3m-crypto-theft-zachxbt/" target="_blank" rel="noopener noreferrer nofollow">uncovered</a> a sophisticated North Korean scheme involving IT workers posing as crypto developers. This operation resulted in a $1.3 million theft from a project’s treasury and revealed over 25 compromised crypto projects.&nbsp;</p>
<p>The stolen funds were laundered through multiple transactions, including bridging from Solana to Ethereum and depositing into Tornado Cash. Investigations connected these activities to a network of 21 developers and traced funds back to North Korean IT workers.</p>
<p>You might also like: <a href="https://crypto.news/malaysian-police-arrest-21-in-crypto-fraud-scheme-targeting-japanese-investors/" rel="noopener noreferrer nofollow"> Malaysian police arrest 21 in crypto fraud scheme targeting Japanese investors </a></p>
<h2 class="wp-block-heading" id="crypto-hacks">Crypto hacks</h2>
<p>The crypto sector, already a frequent target of cyber attacks, <a href="https://crypto.news/crypto-hacks-binance-recovers-73m-in-stolen-funds/" target="_blank" rel="noopener noreferrer nofollow">faces increased risks</a> as these sophisticated threat actors exploit vulnerabilities in widely used software.&nbsp;Microsoft <a href="https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/" target="_blank" rel="noopener noreferrer nofollow">advised</a> users and organizations to update their systems promptly, use secure and updated web browsers, and enable advanced security features like Microsoft Defender to safeguard against such threats.</p>

North Korean hackers target crypto institutions via Chromium browser

Table of Contents

crypto.news

Other articles published on Aug 30, 2024

Spot Bitcoin ETFs See BlackRock’s IBIT Log first Outflows since May

Banks face new risks from permissionless blockchains, BIS warns

Analysts Forecast Ethereum’s Price Bottom

THORChain Price (RUNE): Can It Hit $6 Mark?

DOGE Price Dips 0.9%: Is a Bullish Turn on the Horizon?

Singapore Bags Top Spot in Global Cryptocurrency Adoption

Join our free newsletter for daily crypto updates!