Targeting of users of cryptocurrency applications · Dec 2022
North Korean hacking group Lazarus created a fake brand called BloxHolder to spread fake cryptocurrency apps that would infect users with AppleJeus malware to steal money and cryptocurrency. The campaign was active from June to at least October 2022.
Crypto users · 01/12/2022
Researchers from Volexity discover a new campaign by the North Korean 'Lazarus' hacking group, spreading fake cryptocurrency apps under the made-up brand, "BloxHolder," to install the AppleJeus malware for initial access to networks and steal crypto assets. [Date Occurred: Since at least June 2022; Date Discovered: -]
북 해킹조직, 암호화폐 사이트 복제해 해킹 시도 · 2022-12-05
attribution sentence(s): 앵커 : 북한의 해킹조직이 가짜 암호화폐 거래 사이트와 앱(어플:응용 프로그램)을 유포해 해킹을 시도한 정황이 나타났습니다. | 미국의 사이버 보안 업체 ‘볼렉시티(Volexity)’가 지난 1일 홈페이지에 공개한 보고서를 통해 북한의 해킹조직 라자루스가 가짜 사이트와 앱으로 암호화폐 사용자를 유인해 해킹을 시도하고 있다고 밝혔습니다. | / Volexity 볼렉시티에 따르면 라자루스는 지난 6월 ‘블록스홀더(BloxHolder[.]com)’라는 인터넷 사이트 주소를 등록하고 가짜 암호화폐 거래 사이트를 개설했습니다.
Fake “BloxHolder” cryptocurrency applications delivering AppleJeus · June 2022
Para 167: “Another cybersecurity company warned that the Lazarus Group had conducted a malware campaign targeting cryptocurrency users. The cyberthreat actors were observed spreading fake cryptocurrency applications under the non-existent brand “BloxHolder”. These would deliver the “AppleJeus” malware for initial access to networks that eventually would steal cryptocurrency. This campaign started in June 2022, when a clone domain of a legitimate website, HaasOnline (haasonline.com) by the name of “bloxholder.com” was set up.”
Lazarus Group AppleJeus campaign via fake BloxHolder cryptocurrency trading website and malicious Office documents · 2022-12-01T15:41:19+00:00 (published_time)
This activity notably involves a campaign likely targeting cryptocurrency users and organizations with a variant of the AppleJeus malware by way of malicious Microsoft Office documents. ... In June 2022, the Lazarus Group registered the domain name bloxholder[.]com, and then configured it to host a website related to automated cryptocurrency trading.