Bitcoin

Read

Lazarus Group intensifies its cyber assault on crypto market, deploying sophisticated malware through fake video apps and expanding its targeting of browser extensions. 
The notorious <a href="https://crypto.news/tag/north-korea/" target="_blank">North Korean</a> hacking gang Lazarus Group, known for its sophisticated cyber campaigns against the crypto industry, is ramping up its efforts to target crypto professionals and developers. The group has introduced new malware variants and expanded its focus to include video conferencing applications, according to a recent <a href="https://www.group-ib.com/blog/apt-lazarus-python-scripts?data=7sd78e8denis89h269omelchenko8yrjs8" target="_blank">research report</a> by Group-IB, a cybersecurity firm. 
In 2024, Lazarus expanded its attacks with the “Contagious Interview” campaign, deceiving job seekers into downloading malware disguised as job-related tasks. The scheme now features a fake video conferencing app called “FCCCall” that mimics real software and installs the BeaverTail malware, which then deploys the Python-based backdoor “InvisibleFerret.” 
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow"> 
 “The core functionality of BeaverTail remains unchanged: it exfiltrates credentials from browsers, and data from cryptocurrency wallets browser extension.” 
 Group-IB 
</blockquote> 
 You might also like: <a rel="" href="https://crypto.news/lazarus-group-hackers-launch-new-method-for-cyber-attacks/"> Lazarus Group hackers launch new method for cyber attacks </a> 
Group-IB researchers have also identified a new suite of Python scripts dubbed “CivetQ” as part of Lazarus’s evolving toolkit. The group’s tactics now include using <a href="https://crypto.news/tag/telegram/" target="_blank">Telegram</a> for data exfiltration and expanding their reach to gaming-related repositories, trojanizing Node.js-based projects to spread their malware. 
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow"> 
 “After making initial contact, they would often attempt to move the conversation onto Telegram, where they [hackers] would then ask the potential interviewees to download a video conferencing application, or a Node.js project, to perform a technical task as part of the interview process.” 
 Group-IB 
</blockquote> 
Lazarus’s latest campaign highlights their increasing focus on crypto wallet browser extensions, analysts at Group-IB emphasize, adding that the bad actors are now targeting a growing list of applications including MetaMask, Coinbase, BNB Chain Wallet, TON Wallet, and Exodus Web3, among others. 
The group has also developed more sophisticated methods to obscure their malicious code, making detection more challenging. 
The escalation mirrors broader trends highlighted by the FBI, which has recently <a href="https://www.ic3.gov/Media/Y2024/PSA240903" target="_blank">cautioned</a> that North Korean cyber actors are targeting employees in decentralized finance and cryptocurrency sectors with highly specialized social engineering campaigns. According to the FBI, these sophisticated tactics are crafted to penetrate even the most secure systems, representing an ongoing threat to organizations with substantial crypto assets. 
 Read more: <a rel="" href="https://crypto.news/lazarus-group-allegedly-moves-stolen-funds-from-308m-dmm-bitcoin-hack/"> Lazarus Group allegedly moves stolen funds from $308m DMM Bitcoin hack </a>

Lazarus Group intensifies attacks on crypto browser extensions: Group-IB

crypto.news

Other articles published on Sep 4, 2024

Satoshi Tells NBA Legend Pippen That Bitcoin Is Going to $84K...in His Dream

Further downswings for ADA, XRP; New presale token defies bearish trends

What is Ethervista?

Binance to Launch BNSOL Solana Staking in September 2024

Bitcoin ATM Scams Surge Tenfold Since 2020, FTC Reports

Analyst Predicts a Bright Future for Ethereum ETFs – What’s Next?

Join our free newsletter for daily crypto updates!