UN Panel of Experts S/2024/215
“Konni APT exploits WinRAR vulnerability (CVE-2023-38831) targeting the cryptocurrency industry,” Chuangyu 404 Advanced Threat Intelligence Team · 14 September 2023
Annex 99 (Select reports of DPRK cyber actors targeting the cryptocurrency industry), report 3: “Konni APT exploits WinRAR vulnerability (CVE-2023-38831) targeting the cryptocurrency industry,” Chuangyu 404 Advanced Threat Intelligence Team, 14 September 2023. Summary: ScarCruft (APT 37) group has been identified using the WinRAR vulnerability (CVE-2023-38831) to attack the cryptocurrency industry, a significant shift in the group’s traditional targeting. ScarCruft used a malicious payload disguised as a wallet screenshot named “wallet_Screenshot_2023_09_06_Qbao_Network.zip,” likely a reference to Qbao Network, a smart cryptocurrency wallet service.