More Attacks on Cryptocurrency Businesses

ThaiCERT Threat Group Cards

More Attacks on Cryptocurrency Businesses Target: Some of the documents (for instance one entitled “sample document for business plan evaluation of venture company”) were prepared in Korean, presumably to target South Korean businesses. Another contains a business overview of what seems to be a Chinese technology consulting group named LAFIZ (“we couldn’t confirm if it’s a legitimate business or another fake company made up by Lazarus,” Kaspersky Lab researchers said). Yet another provided information for coin listings with a translation in Korean, researchers said. Method: Documents containing weaponized macros, “carefully prepared to attract the attention of cryptocurrency professionals.” It utilizes PowerShell to control Windows systems and macOS malware for Apple users. https://securelist.com/cryptocurrency-businesses-still-being-targeted-by-lazarus/90019/

Hackmageddon cyber attacks timelines (Paolo Passeri)

Researchers from Kaspersky Lab discover a new operation by the Lazarus Group targeting businesses in the in cryptocurrency space, active since at least November 2018.

Kaspersky Securelist

Further tracking of Lazarus activities targeting the financial sector enabled us to discover a new operation, active since at least November 2018, which utilizes PowerShell to control Windows systems and macOS malware for Apple users.

Some of the documents (for instance one entitled “sample document for business plan evaluation of venture company”) were prepared in Korean, presumably to target South Korean businesses.