deBridge Finance crypto platform targeted by Lazarus hackers

Date (as written): 2022-08
Year: 2022
Actors (as written): Lazarus Group, Hidden Cobra, Labyrinth Chollima
Actor pages: Lazarus Group Hidden Cobra Labyrinth Chollima
Dollar figures (as written): $0

Source entries (5)

ThaiCERT Threat Group Cards

deBridge Finance crypto platform targeted by Lazarus hackers · 2022-08

deBridge Finance crypto platform targeted by Lazarus hackers https://www.bleepingcomputer.com/news/security/debridge-finance-crypto-platform-targeted-by-lazarus-hackers/

https://www.bleepingcomputer.com/news/security/debridge-finance-crypto-platform-targeted-by-lazarus-hackers/

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

deBridge Finance · 2022-08-05

Attackers suspected to be from the North Korean Lazarus group used a phishing email to trick company employees and steal cryptocurrency from deBridge Finance, a cross-chain protocol that enables the decentralized transfer of assets between various blockchains.

https://www.bleepingcomputer.com/news/security/debridge-finance-crypto-platform-targeted-by-lazarus-hackers/

tayvano/lazarus-bluenoroff-research

deBridge (Attempt) · 2022-08-05

Amt Stolen: $0

https://github.com/tayvano/lazarus-bluenoroff-research/blob/main/hacks-and-thefts/debridge.md

Hackmageddon cyber attacks timelines (Paolo Passeri)

deBridge Finance · 05/08/2022

Attackers suspected to be from the North Korean Lazarus group used a phishing email to trick company employees and steal cryptocurrency from deBridge Finance, a cross-chain protocol that enables the decentralized transfer of assets between various blockchains. [Date Occurred: 04/08/2022; Date Discovered: 04/08/2022]

https://www.hackmageddon.com/2022/09/08/1-15-august-2022-cyber-attacks-timeline/

https://www.bleepingcomputer.com/news/security/debridge-finance-crypto-platform-targeted-by-lazarus-hackers/

KISA cyber threat trend report, 2022 H2 (2022년 하반기 사이버 위협 동향 보고서)

deBridge Finance staff phished; attributed to Lazarus · 2022년 하반기

크로스체인 프로토콜 deBridge Finance의 직원들에게 회사의 공동설립자인 Alex Smirnov 명의로 급여 조정을 한다는 이메일 발송됨. 이는 피싱 메일로서 첨부 PDF 파일과 링크 파일의 실행을 통해 C&C 서버와 연결하고, 직원 PC의 username, OS, 실행 프로세스 등을 수집함. 이 공격은 파일 이름과 인프라의 중복성이 나타나며 라자루스의 소행으로 추정됨. [KISA report, page 13]

https://www.kisa.or.kr/20205/form?postSeq=1023

Suggest a correction on GitHub