Suspected North Korean hackers used a front company to spread a malicious cryptocurrency app to both Windows and Mac users, BleepingComputer reports. The APT known as the Lazarus Group stood up a company called “JMT Trading” that posed as a digital currency trading company. The company had a professional-looking website and Twitter account, which the attackers used to establish credibility and encourage users to download their app.
The attackers copied the code of the legitimate QT Bitcoin Trader program, added malicious functionality, and marketed it as a new application belonging to JMT Trading. They then placed it as an open-source app on GitHub. Since it was a clone of a legitimate program, it still worked as a cryptocurrency trading app. In the background, however, it gave the attackers complete control over the infected computer. Jamf security researcher Patrick Wardle noted that the malware tricks the user into giving it administrative privileges during the installation process.
BleepingComputer notes the similarity of this campaign to attacks identified by Kaspersky in August 2018. Those attacks used a different front company to distribute another Trojanized cryptocurrency trading application. That campaign was also attributed to the Lazarus Group.
According to the US Treasury Department, the Lazarus Group is controlled by North Korea’s Reconnaissance General Bureau (RGB), the country’s primary foreign intelligence service. The group is well-known for conducting financially motivated cybercrime around the world.
Both nation-state hackers and cybercriminals are well-resourced and capable of launching sophisticated cyberattacks that blend social engineering with technical expertise. New-school security awareness training can enable your users to exercise a necessary degree of caution when downloading programs from the Internet.
BleepingComputer has the story: https://www.bleepingcomputer.com/news/security/attackers-create-elaborate-crypto-trading-scheme-to-install-malware/