when

Microsoft cybersecurity researchers identified a zero-day vulnerability in Chromium, the engine that powers the Chrome web browser and others, that had been exploited by the North Korean hacker group they call Citrine Sleet. The vulnerability was patched on Aug. 21, so it is important for users to update their browsers.
Microsoft <a data-ct-non-breakable="null" href="https://www.microsoft.com/en-us/security/blog/2024/08/30/north-korean-threat-actor-citrine-sleet-exploiting-chromium-zero-day/" rel="noopener noreferrer nofollow" target="null" text="null">identified</a> Citrine Sleet with “medium confidence.” The group is known to target the cryptocurrency sector and is the developer of the AppleJeus trojan malware that has also been used by the Lazarus Group of hackers.
<h2 id="third-zero-day-vulnerability-of-the-year">Third zero-day vulnerability of the year</h2>
Microsoft has notified targeted and compromised customers, but it did not say how many customers were affected. This was the third exploited vulnerability of this type that has been patched in Chromium this year. Google, the owner of the Chromium engine, patched the vulnerability two days after it was reported.
The hackers used FudModule rootkit malware to gain remote code execution. To do so, they used sophisticated social engineering tactics:
<blockquote>
 “The threat actor creates fake websites masquerading as legitimate cryptocurrency trading platforms and uses them to distribute fake job applications or lure targets into downloading a weaponized cryptocurrency wallet or trading application based on legitimate applications.”&nbsp;
</blockquote>
After that, the group commonly installed AppleJeus, which gathered the information needed to take control of the target’s crypto assets. Chrome versions prior to 128.0.6613.84 are vulnerable to attack.
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/critical-bug-identified-remedied-circle-noble-cctp" rel="noopener noreferrer nofollow" target="null" text="null">Critical bug identified and remedied in Circle’s Noble-CCTP</a>
<h3 id="hackers-trod-a-familiar-path">Hackers trod a familiar path</h3>
Citrine Sleet <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/north-korean-lazarus-group-is-targeting-crypto-funds-with-a-new-spin-on-an-old-trick" rel="noopener noreferrer nofollow" target="null" text="null">was first spotted</a> in December 2022, when Microsoft dubbed it DEV-0139. At that time, it created false identities on Telegram posing as employees of the OKX cryptocurrency exchange. Targets were asked to evaluate an Excel document that contained accurate information on various exchanges’ fee structures, as well as a malicious file that created a backdoor into the target’s computer.
<figure><img alt="Zero-day vulnerability in Chrome exploited by North Korean hackers" name="" src="https://s3.cointelegraph.com/uploads/2024-08/0191a4dc-cb68-7112-a930-28da97b26b65">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/MsftSecIntel/status/1829550899766653064" rel="noopener noreferrer nofollow" target="_blank" text="null">Microsoft Threat Intelligence</a>
 </figcaption>
</figure>
Citrine Street has been called Chollima by other investigators. Under that name, Kaspersky Labs found that it had <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/north-korean-lazarus-group-is-targeting-crypto-funds-with-a-new-spin-on-an-old-trick" rel="noopener noreferrer nofollow" target="null" text="null">infected the 3CX softphone</a> app, targeting cryptocurrency investment startups using AppleJeus.
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/4-out-of-10-nft-sales-are-fake-learn-to-spot-the-signs-of-wash-trading/" rel="noopener noreferrer nofollow" target="null" text="null">4 out of 10 NFT sales are fake: Learn to spot the signs of wash trading</a>
&nbsp;

Zero-day vulnerability in Chrome exploited by North Korean hackers

Table of Contents

Cointelegraph

Other articles published on Aug 30, 2024

Is Ethereum (ETH) Destined to Plunge Below $2.4K?

What is the New Ethereum Layer-2 Network Corn?

Spot Bitcoin ETFs See BlackRock’s IBIT Log first Outflows since May

How To Cashout CS2 Skins With Cryptocurrencies

What Was the Real Motive Behind French President Emmanuel Macron’s Dinner with Telegram CEO Pavel...

Building a Blockchain Application with Simplicity

Join our free newsletter for daily crypto updates!