www.bleepingcomputer.com
Open in
urlscan Pro
104.20.59.209
Public Scan
URL:
https://www.bleepingcomputer.com/news/security/lazarus-group-deploys-its-first-mac-malware-in-cryptocurrency-exchange-hack/
Submission: On April 19 via api from US — Scanned from DE
Submission: On April 19 via api from US — Scanned from DE
Form analysis 6 forms found in the DOM
https://www.bleepingcomputer.com/search/
<form title="Search site" action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>https://www.bleepingcomputer.com/search/
<form action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" name="EMAIL" aria-label="Enter email address" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" aria-label="Enter email address" name="EMAIL" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST https://www.bleepingcomputer.com/forums/index.php?app=core&module=global§ion=login&do=process&return=https://www.bleepingcomputer.com/news/security/lazarus-group-deploys-its-first-mac-malware-in-cryptocurrency-exchange-hack/
<form
action="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&do=process&return=https://www.bleepingcomputer.com/news/security/lazarus-group-deploys-its-first-mac-malware-in-cryptocurrency-exchange-hack/"
method="post">
<div class="bc_form_feild">
<label for="ips_username">Username</label>
<input aria-label="Enter login name" title="Enter login name" type="text" id="ips_username" name="ips_username" autocomplete="username">
</div>
<div class="bc_form_feild">
<label for="ips_password">Password</label>
<input aria-label="Enter login password" title="Enter login passwod" type="password" id="ips_password" name="ips_password" autocomplete="current-password">
</div>
<div class="bc_form_feild">
<div class="bc_remember">
<input id="remember" type="checkbox" name="rememberMe" value="1" checked="checked">
<label for="remember">Remember Me</label>
</div>
<div class="bc_anon">
<input id="anonymous" type="checkbox" name="anonymous" value="1">
<label for="anonymous">Sign in anonymously</label>
</div>
</div>
<div class="bc_btn_wrap">
<input type="hidden" name="auth_key" value="880ea6a14ea49e853634fbdc5015a024">
<input type="submit" aria-label="Login to site" title="Login" value="Login" class="bc_sub_btn">
<a aria-label="Sign in with Twitter" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&serviceClick=twitter&return=https://www.bleepingcomputer.com/news/security/lazarus-group-deploys-its-first-mac-malware-in-cryptocurrency-exchange-hack/" class="bc_twitter_btn"><img src="https://www.bleepstatic.com/images/site/login/twitter.png" width="28" height="24" alt="Sign in with Twitter button"> Sign in with Twitter</a>
<hr>
<p>Not a member yet? <a aria-label="Register account" title="Register account" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register">Register Now</a></p>
</div>
</form><form>
<input type="hidden" id="comment-id-report" value="0">
<ul>
<li>
<label><input type="radio" name="comment-report-reason" value="Spam">Spam</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Abusive or Harmful">Abusive or Harmful</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Inappropriate content">Inappropriate content</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Strong language">Strong language</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Other">Other</label>
</li>
<li id="comment-report-other-reason-wrap" style="display:none;">
<textarea aria-label="Enter other reason for reporting the comment" rows="2" cols="2" id="comment-report-other-reason"></textarea>
</li>
</ul>
<p>Read our <a href="https://www.bleepingcomputer.com/posting-guidelines/">posting guidelinese</a> to learn what content is prohibited.</p>
</form>Text Content
WE VALUE YOUR PRIVACY
We and our partners store and/or access information on a device, such as cookies
and process personal data, such as unique identifiers and standard information
sent by a device for personalised ads and content, ad and content measurement,
and audience insights, as well as to develop and improve products.
With your permission we and our partners may use precise geolocation data and
identification through device scanning. You may click to consent to our and our
partners’ processing as described above. Alternatively you may access more
detailed information and change your preferences before consenting or to refuse
consenting. Please note that some processing of your personal data may not
require your consent, but you have a right to object to such processing. Your
preferences will apply to this website only. You can change your preferences at
any time by returning to this site or visit our privacy policy.
MORE OPTIONSAGREE
*
*
*
*
*
*
* News
* Featured
* Latest
* US warns of Lazarus hackers using malicious cryptocurrency apps
* Hackers steal $655K after picking MetaMask seed from iCloud backup
* Newly found zero-click iPhone exploit used in NSO spyware attacks
* Windows 10 21H2 now in broad deployment, available to everyone
* CISA warns of attackers now exploiting Windows Print Spooler bug
* Emotet botnet switches to 64-bit modules, increases activity
* QNAP urges customers to disable UPnP port forwarding on routers
* Microsoft disables SMB1 by default for Windows 11 Home Insiders
* Downloads
* Latest
* Most Downloaded
* Qualys BrowserCheck
* STOPDecrypter
* AuroraDecrypter
* FilesLockerDecrypter
* AdwCleaner
* ComboFix
* RKill
* Junkware Removal Tool
* Virus Removal Guides
* Latest
* Most Viewed
* Ransomware
* How to remove the PBlock+ adware browser extension
* Remove the Toksearches.xyz Search Redirect
* Remove the Smashapps.net Search Redirect
* Remove the Smashappsearch.com Search Redirect
* Remove Security Tool and SecurityTool (Uninstall Guide)
* How to remove Antivirus 2009 (Uninstall Instructions)
* How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
* How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using
TDSSKiller
* Locky Ransomware Information, Help Guide, and FAQ
* CryptoLocker Ransomware Information Guide and FAQ
* CryptorBit and HowDecrypt Information Guide and FAQ
* CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
* Tutorials
* Latest
* Popular
* How to make the Start menu full screen in Windows 10
* How to install the Microsoft Visual C++ 2015 Runtime
* How to open an elevated PowerShell Admin prompt in Windows 10
* How to Translate a Web Page in Google Chrome
* How to start Windows in Safe Mode
* How to remove a Trojan, Virus, Worm, or other Malware
* How to show hidden files in Windows 7
* How to see hidden files in Windows
* Deals
* Categories
* eLearning
* IT Certification Courses
* Gear + Gadgets
* Security
* Forums
* More
* Startup Database
* Uninstall Database
* File Database
* Glossary
* Chat on Discord
* Send us a Tip!
* Welcome Guide
* Home
* News
* Security
* Lazarus Group Deploys Its First Mac Malware in Cryptocurrency Exchange Hack
* AddThis Sharing Buttons
Share to FacebookFacebookShare to TwitterTwitterShare to
LinkedInLinkedInShare to RedditRedditShare to Hacker NewsHacker NewsShare to
EmailEmail
*
LAZARUS GROUP DEPLOYS ITS FIRST MAC MALWARE IN CRYPTOCURRENCY EXCHANGE HACK
By
CATALIN CIMPANU
* August 23, 2018
* 04:00 AM
* 0
Lazarus Group, the North Korean hackers who hacked Sony Films a few years back,
have deployed their first Mac malware ever, according to Russian antivirus
vendor Kaspersky Lab.
In a report shared with Bleeping Computer in advance, Kaspersky researchers
reveal that Lazarus Group penetrated the IT systems of an Asia-based
cryptocurrency exchange platform.
The hack of this platform was not reported in the media as of yet, a Kaspersky
spokesperson told Bleeping Computer.
PLAY Top Articles Video Settings Full Screen About Connatix V159343 Read More
Read More Read More Read More Read More Read More CISA warns of attackers now
exploitingWindows Print Spooler bug 1/1 Skip Ad Continue watching after the ad
Visit Advertiser websiteGO TO PAGE
"The company was breached successfully, but we are not aware of any financial
loss," Vitaly Kamluk, Head of GReAT APAC at Kaspersky Lab told Bleeping Computer
via email today. "We assume the threat was contained based on our notification."
EXCHANGE HACKED AFTER EMPLOYEE DOWNLOADS TROJANIZED APP
The hack, which Kaspersky Lab analyzed under the codename of Operation
AppleJeus, took place after one of the exchange's employees downloaded an app
from a legitimate-looking website that claimed to be from a company that
develops cryptocurrency trading software.
But the app was a fake and infected with malware. On Windows, the app downloaded
and infected users with Fallchill, a remote access trojan (RAT) known to be
associated with the Lazarus Group since at least 2016, when it was deployed for
the first time in live campaigns.
But unlike previous Lazarus operations, the hackers also deployed a Mac malware
strain, something they have not done before. The malware was hidden inside the
Mac version of the same cryptocurrency trading software.
Experts say that both the Windows and Mac malware wasn't visible inside the
tainted app. Lazarus operators did not embed the malware inside the third-party
app directly but merely modified its update component to download the malware at
a later date.
THE MYSTERY OF THE MALWARE'S CERTIFICATE
Furthermore, the trojanized cryptocurrency trading software was also signed by a
valid digital certificate, allowing it to bypass security scans.
The big mystery surrounding this certificate is that it was issued by a company
that Kaspersky experts said they weren't able to prove it ever existed at the
address in the certificate's information.
"The fact that they developed malware to infect macOS users in addition to
Windows users and – most likely – even created an entirely fake software company
and software product in order to be able to deliver this malware undetected by
security solutions, means that they see potentially big profits in the whole
operation, and we should definitely expect more such cases in the near future,"
Kamluk says.
KASPERSKY DIDN'T NAME THE HACKED CRYPTOCURRENCY EXCHANGE
Several cyber-security firms have pointed out many times this year that since
the start of 2017, North Korean hackers have shown great interest in penetrating
cryptocurrency exchanges and financial institutions, from where they steal funds
that they later bring back into North Korea.
In the past year, several Asian cryptocurrency exchange platforms suffered
security incidents, primarily exchange platforms located in South Korea. Hacks
have been reported at Bithumb, Yapizon, YouBit, Coinrail, and Bithumb again.
Kaspersky did not reveal the name of the cryptocurrency exchange at the center
of its report, but told Bleeping Computer
This week, US cyber-security firm Trend Micro reported a supply-chain attack on
South Korean organizations, but did not attribute the hack to North Korea, nor
did it specify that the hack targeted a cryptocurrency exchange platform.
"We are aware of waves of attacks on supply chains in South Korea this year,
but AppleJeus is unrelated to these attacks," Kamluk told Bleeping Computer.
"The victim was not located in South Korea."
Article updated post-publication with additional comments from Kaspersky.
RELATED ARTICLES:
US warns of Lazarus hackers using malicious cryptocurrency apps
FBI links largest crypto hack ever to North Korean hackers
Bitcoin.org hackers steal $17,000 in 'double your cash' scam
Beanstalk DeFi platform loses $182 million in flash-loan attack
Hackers steal $655K after picking MetaMask seed from iCloud backup
* APT
* CryptoCurrency
* Cybercrime
* Lazarus Group
* Facebook
* Twitter
* LinkedIn
* Email
*
CATALIN CIMPANU
Catalin Cimpanu is the Security News Editor for Bleeping Computer, where he
covers topics such as malware, breaches, vulnerabilities, exploits, hacking
news, the Dark Web, and a few more. Catalin previously covered Web & Security
news for Softpedia between May 2015 and October 2016. The easiest way to reach
Catalin is via his XMPP/Jabber address at campuscodi@xmpp.is. For other contact
methods, please visit Catalin's author page.
* Previous Article
* Next Article
POST A COMMENT COMMUNITY RULES
YOU NEED TO LOGIN IN ORDER TO POST A COMMENT
Not a member yet? Register Now
YOU MAY ALSO LIKE:
Popular Stories
* Customize your Windows 11 experience with these apps
* Unofficial Windows 11 upgrade installs info-stealing malware
NEWSLETTER SIGN UP
To receive periodic updates and news from BleepingComputer, please use the form
below.
NEWSLETTER SIGN UP
* Follow us:
*
*
*
*
MAIN SECTIONS
* News
* Downloads
* Virus Removal Guides
* Tutorials
* Startup Database
* Uninstall Database
* File Database
* Glossary
COMMUNITY
* Forums
* Forum Rules
* Chat
USEFUL RESOURCES
* Welcome Guide
* Sitemap
COMPANY
* About BleepingComputer
* Contact Us
* Send us a Tip!
* Advertising
* Write for BleepingComputer
* Social & Feeds
* Changelog
Terms of Use - Privacy Policy - Ethics Statement
Copyright @ 2003 - 2022 Bleeping Computer® LLC - All Rights Reserved
LOGIN
Username
Password
Remember Me
Sign in anonymously
Sign in with Twitter
--------------------------------------------------------------------------------
Not a member yet? Register Now
REPORTER
HELP US UNDERSTAND THE PROBLEM. WHAT IS GOING ON WITH THIS COMMENT?
* Spam
* Abusive or Harmful
* Inappropriate content
* Strong language
* Other
*
Read our posting guidelinese to learn what content is prohibited.
Submitting...
SUBMIT