North Korean Lazarus Group is targeting crypto funds with a new spin on an old trick

cointelegraph.com:

Microsoft reports that a threat actor has been identified targeting cryptocurrency investment startups. A party Microsoft has dubbed DEV-0139 posed as a cryptocurrency investment company on Telegram and used an Excel file weaponized with “well-crafted” malware to infect systems that it then remotely accessed.

The threat is part of a trend in attacks showing a high level of sophistication. In this case, the threat actor, falsely identifying itself with fake profiles of OKX employees, joined Telegram groups “used to facilitate communication between VIP clients and cryptocurrency exchange platforms,” Microsoft wrote in a Dec. 6 blog post. Microsoft explained:

In October, the target was invited to join a new group and then asked for feedback on an Excel document that compared OKX, Binance and Huobi VIP fee structures. The document provided accurate information and high awareness of the reality of crypto trading, but it also invisibly sideloaded a malicious .dll (Dynamic Link Library) file to create a backdoor into the user’s system. The target was then asked to open the .dll file themselves during the course of the discussion on fees.

DPRK’s infamous Lazarus Group has developed new and improved versions of its cryptocurrency-stealing malware AppleJeus, marking the regime’s latest attempt to garner funds for Kim Jong-un’s weapons programs. @nknewsorg @EthanJewell https://t.co/LjimOmPI5s

The attack technique itself has long been known. Microsoft suggested the threat actor was the same as the one found using .dll files for similar purposes in June and that was probably behind other incidents as well. According to Microsoft, DEV-0139 is the same actor that cybersecurity firm Volexity linked to North Korea’s state-sponsored Lazarus