The advanced and persistent actor, Lazarus – infamous for its growing financial motivations, has hit cryptocurrency businesses with new, Trojanized decentralized finance (DeFi) apps in order to increase profit.
Lazarus abuses legitimate applications used to manage cryptocurrency wallets by distributing malware that provides control over victims’ systems.
The Lazarus group is one of the world’s most active APT actors, operating since at least 2009. Unlike most state-sponsored APT groups, Lazarus and other threat actors associated with this APT have made financial gain one of their primary goals.
As the cryptocurrency market grows along with the non-fungible token (NFT) and decentralized finance (DeFi) markets, Lazarus continues to find new ways to target cryptocurrency users.
In December 2021, Kaspersky researchers uncovered a new malware campaign, using a Trojanized DeFi app delivered by the Lazarus group, against cryptocurrency business.
The application contains a legitimate program called DeFi Wallet, which saves and manages cryptocurrency wallets.
When executed, the app drops a malicious file alongside the installer for the legitimate application, launching the malware with a Trojanized installer path. This generated malware then overwrites the legitimate application with the Trojanized application.
The malware used in this infection scheme is a full-featured backdoor with the capability of controlling the victim’s systems remotely.
Once in control of the system, the attacker can delete files, gather information, connect to specific IP addresses and communicate with the C2 server.
Based on the history of Lazarus’s attacks, researchers assume the motivation behind this campaign is financial gain.
After looking into the functionalities of this backdoor, Kaspersky researchers have discovered numerous overlaps with other tools used by the Lazarus group, namely, the CookieTime and the ThreatNeedle malware clusters. The multistage…
