Elastic catches DPRK passing out KANDYKORN · 2023-10
Elastic catches DPRK passing out KANDYKORN
https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn
https://www.sentinelone.com/blog/dprk-crypto-theft-macos-rustbucket-droppers-pivot-to-deliver-kandykorn-payloads/
Targeting of blockchain engineers at a cryptocurrency exchange · Oct 2023
Lazarus Group distributed a compromised cryptocurrency arbitrage bot on public services on the chat service Discord. The attack was highly targeted, with the goal of gaining access to the network of a cryptocurrency company.
Blockchain engineers of a cryptocurrency exchange platform · 01/11/2023
Researchers from Elastic reveal the details of REF7001, a campaign using a new macOS malware dubbed 'KandyKorn,' targeting blockchain engineers of a cryptocurrency exchange platform. [Date Occurred: -; Date Discovered: -]
https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn · October
Annex 59: List of DPRK Cyberthreat actors’ malicious activities monitored by the Panel in 2023 (row 49 of 75, PDF p. 328). DPRK cyber actor: Lazarus Group; Report Name: https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn; Case Summary: A novel DPRK intrusion has been identified on a macOS system that targets blockchain engineers of a crypto exchange platform, lures them with a Python application to gain initial access, and deploys multiple complex stages of the attack, each with deliberate defensive evasion techniques.; Publication Month: October
“Elastic catches DPRK passing out KANDYKORN,” Elastic Security Labs · 31 October 2023
Annex 99 (Select reports of DPRK cyber actors targeting the cryptocurrency industry), report 5: “Elastic catches DPRK passing out KANDYKORN,” Elastic Security Labs, 31 October 2023. Summary: A novel DPRK intrusion has been identified on a macOS system that targets blockchain engineers of a crypto exchange platform, lures blockchain engineers with a Python application to gain initial access ... Attackers impersonated blockchain engineering community members on a public Discord ... The victim believed they were installing an arbitrage bot ...
“DPRK Crypto Theft | macOS RustBucket Droppers Pivot to Deliver KandyKorn Payloads,” SentinelOne · 27 November 2023
Annex 99 (Select reports of DPRK cyber actors targeting the cryptocurrency industry), report 10: “DPRK Crypto Theft | macOS RustBucket Droppers Pivot to Deliver KandyKorn Payloads,” SentinelOne, 27 November 2023. Summary: DPRK cyber actors have continued efforts to target macOS users associated with the cryptocurrency industry through two major campaigns in 2023, RustBucket and KandyKorn.
Elastic catches DPRK passing out KANDYKORN · Wed, 01 Nov 2023 00:00:00 GMT
Elastic Security Labs exposes an attempt by the DPRK to infect blockchain engineers with novel macOS malware.
DPRK Crypto Theft | macOS RustBucket Droppers Pivot to Deliver KandyKorn Payloads | SentinelOne · 2023-11-27T13:01:34.000Z
Two apparently separate North Korean crypto theft campaigns targeting macOS users appear to be linked as threat actors mix and match droppers and payloads.