Lazarus Hacker Group Launches New Method – Details
Lazarus Hacker Group, an alleged North Korea-sponsored cybercrime group is still targeting cryptocurrencies and adopting new tactics. This is according to a new report from cybersecurity and anti-virus company Kaspersky Lab.
The report reveals that allegedly state-sponsored hacker group Lazarus has been active with a new operation since last November, wherein the group uses PowerShell that allows them to manage and control Windows and macOS malware. The Lazarus team has reportedly developed custom PowerShell scripts that interact with C2 malicious servers and execute commands from the operator.
C2 server script names, in their turn, are misrepresented as WordPress files, and other open source projects. Once the malware control session with the server is created, the malware is able to download and upload files, update malware configuration and collect basic host information, among others.
Kaspersky said the hackers are still targeting systems involved in the cryptocurrency and fintech industries, and advised players in those sectors to exercise caution:
“If you’re part of the booming cryptocurrency or technological startup industry, exercise extra caution when dealing with new third parties or installing software on your systems. And never ‘Enable Content’ in Microsoft Office documents received from new or untrusted sources…”
Lazarus is purported to be responsible for $571 million of the $882 million in cryptocurrency that was stolen from online exchanges from 2017–2018; almost 65 percent of the total sum. The industry’s record-breaking $532 million NEM hack of Japan’s Coincheck is also attributed to them.