HomeCryptoNorth Korean Hackers Introduce Fresh Golang Malware 'Durian' Targeting Crypto Companies

North Korean Hackers Introduce Fresh Golang Malware ‘Durian’ Targeting Crypto Companies

-


North Korean Threat Actor Kimsuky Deploys Golang-Based Malware Durian in Cyber Attacks on South Korean Cryptocurrency Firms

North Korean Hackers Deploy Golang-Based Malware in Cyber Attacks on South Korean Cryptocurrency Firms

In a recent development, the North Korean threat actor known as Kimsuky has been identified using a new Golang-based malware called Durian to carry out targeted cyber attacks on two South Korean cryptocurrency firms. The attacks, which took place in August and November 2023, involved the use of legitimate South Korean software as an infection pathway.

According to Kaspersky’s APT trends report for Q1 2024, Durian is equipped with comprehensive backdoor functionality, allowing the attackers to execute commands, download additional files, and exfiltrate data from the compromised systems. The malware is designed to establish persistence on the host and introduce other malicious tools, including AppleSeed, LazyLoad, ngrok, and Chrome Remote Desktop.

One of the notable aspects of the attack is the use of LazyLoad, a tool previously associated with Andariel, a sub-cluster within the Lazarus Group. This raises the possibility of collaboration or tactical overlap between the two threat actors. Kimsuky, also known as APT43, Black Banshee, and other aliases, is believed to be a subordinate element of the 63rd Research Center within North Korea’s Reconnaissance General Bureau.

The U.S. Federal Bureau of Investigation (FBI) and the National Security Agency (NSA) have warned that Kimsuky’s primary mission is to steal data and gather geopolitical insights for the North Korean regime. The group has also been linked to campaigns involving a C#-based remote access trojan and an information stealer called TutorialRAT.

In a separate incident, another North Korean state-sponsored hacking group called ScarCruft, also known as APT37, has been targeting South Korean users with Windows shortcut files that lead to the deployment of RokRAT. This group, aligned with North Korea’s Ministry of State Security, is focused on covert intelligence gathering to support the nation’s strategic interests.

The cybersecurity community is closely monitoring these developments, highlighting the ongoing threat posed by North Korean hackers and the need for enhanced security measures to protect against such sophisticated cyber attacks.

LATEST POSTS

ETH has increased by 59.37% since the beginning of the year

Frequently asked questions (FAQs) The price of ethereum, one of the most popular cryptocurrencies, is currently trading at $3,803.73 as of 8 a.m. ET. This...

Bain Capital Crypto secures $35 million Series A funding for M^0, a platform for creating digital currency

M^0 Raises $35 Million in Series A Funding for Decentralized Stablecoin Protocol M^0, a cryptocurrency protocol, is making waves in the decentralized finance world with...

Bitcoin open interest skyrockets, traders caution of potential market volatility

Bitcoin's Open Interest Surges Over $2 Billion in Three Days, Triggers Speculation of Price Whipsaw The cryptocurrency market is buzzing with excitement as Bitcoin's open...

RZ Blockchain Revolutionizes Gaming Industry with MetaGamescoin, RANKING Platform, and Digital Asset Conversion

Introducing (RZ) Blockchain: Revolutionizing the Gaming Industry with MGC Token A new blockchain platform called (RZ) is making headlines in the gaming industry for its...

Most Popular