North Korean Threat Actor Kimsuky Deploys Golang-Based Malware Durian in Cyber Attacks on South Korean Cryptocurrency Firms

North Korean Hackers Deploy Golang-Based Malware in Cyber Attacks on South Korean Cryptocurrency Firms

In a recent development, the North Korean threat actor known as Kimsuky has been identified using a new Golang-based malware called Durian to carry out targeted cyber attacks on two South Korean cryptocurrency firms. The attacks, which took place in August and November 2023, involved the use of legitimate South Korean software as an infection pathway.

According to Kaspersky’s APT trends report for Q1 2024, Durian is equipped with comprehensive backdoor functionality, allowing the attackers to execute commands, download additional files, and exfiltrate data from the compromised systems. The malware is designed to establish persistence on the host and introduce other malicious tools, including AppleSeed, LazyLoad, ngrok, and Chrome Remote Desktop.

One of the notable aspects of the attack is the use of LazyLoad, a tool previously associated with Andariel, a sub-cluster within the Lazarus Group. This raises the possibility of collaboration or tactical overlap between the two threat actors. Kimsuky, also known as APT43, Black Banshee, and other aliases, is believed to be a subordinate element of the 63rd Research Center within North Korea’s Reconnaissance General Bureau.

The U.S. Federal Bureau of Investigation (FBI) and the National Security Agency (NSA) have warned that Kimsuky’s primary mission is to steal data and gather geopolitical insights for the North Korean regime. The group has also been linked to campaigns involving a C#-based remote access trojan and an information stealer called TutorialRAT.

In a separate incident, another North Korean state-sponsored hacking group called ScarCruft, also known as APT37, has been targeting South Korean users with Windows shortcut files that lead to the deployment of RokRAT. This group, aligned with North Korea’s Ministry of State Security, is focused on covert intelligence gathering to support the nation’s strategic interests.

The cybersecurity community is closely monitoring these developments, highlighting the ongoing threat posed by North Korean hackers and the need for enhanced security measures to protect against such sophisticated cyber attacks.