Vulnerabilities / Threats

2/13/2018
02:45 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Lazarus Group Attacks Banks, Bitcoin Users in New Campaign

A new Lazarus Group cyberattack campaign combines spear-phishing techniques with a cryptocurrency scanner designed to scan for Bitcoin wallets.

The Lazarus Group has been discovered behind a new cyberattack campaign dubbed HaoBao targeting banks and Bitcoin users via spear phishing lures that deliver a new cryptocurrency scanner that hunts for Bitcoin wallets.

The attack campaign uses spear-phishing emails impersonating job recruiters, a tactic previously seen from the group - widely believed by researchers to operate out of North Korea - last year. From April through October 2017, researchers at McAfee Advanced Threat Research (ATR) saw Lazarus Group using job descriptions to target a range of organizations in English and Korean, gain access to their environments, and then steal sensitive data or money.

In January 2018, researchers detected the start of a new campaign when they found a malicious document disguised as job recruitment for a business development executive located in Hong Kong. More malicious files with the same "Windows User" author appeared from January 16-24.

While the fake job recruitment messages are similar to those seen last year, the implants in this campaign have never been previously seen in the wild or used in previous Lazarus Group attacks, says Ryan Sherstobitoff, McAfee senior analyst of malware campaigns.

When a victim selects "enable content," the malicious document launches one of two payloads on the system via a Visual Basic macro. The first is a lightweight cryptocurrency scanner, which gathers data on processes and users then scans for a registry key and Bitcoin wallet. Attackers can observe traffic sent to the C&C server to determine whether a machine uses Bitcoin or not.

"It's being more focused and filtering out targets of interest," Sherstobitoff explains. "They're getting more aggressive with Bitcoin stealing, and more aggressive in the way they target."

If the malware detects a machine has a Bitcoin wallet, it deploys and installs another payload. The secondary payload is a long-term implant intended to gain persistence on the machine. While researchers weren't able to observe this directly, he says this second stage probably has capabilities to steal private keys or siphon from the victim's Bitcoin wallet.

Shrinking Footprints

Sherstobitoff says this campaign demonstrates Lazarus Group is moving toward smaller implants as opposed to large files and installations it used in the past. HaoBao loads directly into memory to scan information, making forensics recovery more difficult.

"They're going fileless, and going for reduced implants, and reducing the footprint overall on the machine and cleaning up more quickly," he says of their change in tactics. Moving forward, he expects they'll continue to shrink their presence so it's as small as needed to be successful.

Antivirus tools would detect this implant but overall, discovery is difficult because the attack is fairly targeted, says Sherstobitoff. "If your AV products aren't totally up-to-date, there's high potential these things can go for a number of days or months without being seen."

Further, attackers may use data from the initial scan to tailor their secondary payload. For example, he continues, if the scanner determines a system is running a certain type of antivirus software, attackers could craft the second stage to evade detection.

There have been signs of increased activity from Lazarus Group, which researchers believe is based in North Korea. The US-CERT today published an advisory stating the DHS and FBI have detected Trojan malware variants HARDRAIN and BADCALL used by the North Korean government. The US government refers to North Korean cyber activity as Hidden Cobra, another term for the group.

Going for Gold

Previous Lazarus Group campaigns from 2017 focused on both money and data theft. This time, it seems their focus is exclusively on Bitcoin. HaoBao is used to target financial organizations and institutions that use or trade Bitcoin, which might have wallets, Sherstobitoff says.

He points out that only two organizations were used as a lure in the spear-phishing emails used in this attack. The job descriptions used in fraudulent emails are legitimate positions taken from real career sites. While the targets are unknown, all are related to cryptocurrency.

Cryptocurrency is a growing target for attackers because it's highly anonymous, and there aren't many regulations that make catching crypto theft east. Many attackers have found it's more lucrative for them to steal compute power for mining cryptocurrencies, as opposed to stealing data, says RedLock CEO Varun Badhwar. Cryptojacking attacks on businesses often go unnoticed.

Related Content:

 

 

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: White Privelege Day
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17282
PUBLISHED: 2018-09-20
An issue was discovered in Exiv2 v0.26. The function Exiv2::DataValue::copy in value.cpp has a NULL pointer dereference.
CVE-2018-14592
PUBLISHED: 2018-09-20
The CWJoomla CW Article Attachments PRO extension before 2.0.7 and CW Article Attachments FREE extension before 1.0.6 for Joomla! allow SQL Injection within download.php.
CVE-2018-15832
PUBLISHED: 2018-09-20
upc.exe in Ubisoft Uplay Desktop Client versions 63.0.5699.0 allows remote attackers to execute arbitrary code. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of URI ha...
CVE-2018-16282
PUBLISHED: 2018-09-20
A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/net_WebCADELETEGetValue URI.
CVE-2018-16752
PUBLISHED: 2018-09-20
LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases.