HomeCryptoNorth Korean Hackers Introduce Fresh Golang Malware 'Durian' Targeting Crypto Companies

North Korean Hackers Introduce Fresh Golang Malware ‘Durian’ Targeting Crypto Companies

-


North Korean Threat Actor Kimsuky Deploys Golang-Based Malware Durian in Cyber Attacks on South Korean Cryptocurrency Firms

North Korean Hackers Deploy Golang-Based Malware in Cyber Attacks on South Korean Cryptocurrency Firms

In a recent development, the North Korean threat actor known as Kimsuky has been identified using a new Golang-based malware called Durian to carry out targeted cyber attacks on two South Korean cryptocurrency firms. The attacks, which took place in August and November 2023, involved the use of legitimate South Korean software as an infection pathway.

According to Kaspersky’s APT trends report for Q1 2024, Durian is equipped with comprehensive backdoor functionality, allowing the attackers to execute commands, download additional files, and exfiltrate data from the compromised systems. The malware is designed to establish persistence on the host and introduce other malicious tools, including AppleSeed, LazyLoad, ngrok, and Chrome Remote Desktop.

One of the notable aspects of the attack is the use of LazyLoad, a tool previously associated with Andariel, a sub-cluster within the Lazarus Group. This raises the possibility of collaboration or tactical overlap between the two threat actors. Kimsuky, also known as APT43, Black Banshee, and other aliases, is believed to be a subordinate element of the 63rd Research Center within North Korea’s Reconnaissance General Bureau.

The U.S. Federal Bureau of Investigation (FBI) and the National Security Agency (NSA) have warned that Kimsuky’s primary mission is to steal data and gather geopolitical insights for the North Korean regime. The group has also been linked to campaigns involving a C#-based remote access trojan and an information stealer called TutorialRAT.

In a separate incident, another North Korean state-sponsored hacking group called ScarCruft, also known as APT37, has been targeting South Korean users with Windows shortcut files that lead to the deployment of RokRAT. This group, aligned with North Korea’s Ministry of State Security, is focused on covert intelligence gathering to support the nation’s strategic interests.

The cybersecurity community is closely monitoring these developments, highlighting the ongoing threat posed by North Korean hackers and the need for enhanced security measures to protect against such sophisticated cyber attacks.

LATEST POSTS

Potential for Ethereum Price to Surpass $10,000 Due to Market Dynamics

Ethereum's Price Prediction: Could it Reach $10,000? Market Dynamics and Developments Unveiled! Title: Ethereum Price Predicted to Soar Above $10,000 by Cryptocurrency Expert Cryptocurrency expert Ash...

Crypto Advocates Present Policy Recommendations for UK Election

Stand With Crypto Outlines Seven UK Crypto Policy Recommendations Ahead of General Election Stand With Crypto, an advocacy group started by Coinbase, has put forth...

Second Cohort Chosen for European Blockchain Sandbox

European Blockchain Sandbox Second Cohort Use Cases Selected The European Blockchain Sandbox has announced the selection of use cases for its second cohort of sandbox...

Binance Announces Support for Chiliz (CHZ) Network Upgrade and Hard Fork

Binance to Support Chiliz (CHZ) Network Upgrade and Hard Fork - Announcement and Impact on Trading Binance to Support Chiliz (CHZ) Network Upgrade and Hard...

Most Popular