HomeCryptoNorth Korean Hackers Introduce Fresh Golang Malware 'Durian' Targeting Crypto Companies

North Korean Hackers Introduce Fresh Golang Malware ‘Durian’ Targeting Crypto Companies

-


North Korean Threat Actor Kimsuky Deploys Golang-Based Malware Durian in Cyber Attacks on South Korean Cryptocurrency Firms

North Korean Hackers Deploy Golang-Based Malware in Cyber Attacks on South Korean Cryptocurrency Firms

In a recent development, the North Korean threat actor known as Kimsuky has been identified using a new Golang-based malware called Durian to carry out targeted cyber attacks on two South Korean cryptocurrency firms. The attacks, which took place in August and November 2023, involved the use of legitimate South Korean software as an infection pathway.

According to Kaspersky’s APT trends report for Q1 2024, Durian is equipped with comprehensive backdoor functionality, allowing the attackers to execute commands, download additional files, and exfiltrate data from the compromised systems. The malware is designed to establish persistence on the host and introduce other malicious tools, including AppleSeed, LazyLoad, ngrok, and Chrome Remote Desktop.

One of the notable aspects of the attack is the use of LazyLoad, a tool previously associated with Andariel, a sub-cluster within the Lazarus Group. This raises the possibility of collaboration or tactical overlap between the two threat actors. Kimsuky, also known as APT43, Black Banshee, and other aliases, is believed to be a subordinate element of the 63rd Research Center within North Korea’s Reconnaissance General Bureau.

The U.S. Federal Bureau of Investigation (FBI) and the National Security Agency (NSA) have warned that Kimsuky’s primary mission is to steal data and gather geopolitical insights for the North Korean regime. The group has also been linked to campaigns involving a C#-based remote access trojan and an information stealer called TutorialRAT.

In a separate incident, another North Korean state-sponsored hacking group called ScarCruft, also known as APT37, has been targeting South Korean users with Windows shortcut files that lead to the deployment of RokRAT. This group, aligned with North Korea’s Ministry of State Security, is focused on covert intelligence gathering to support the nation’s strategic interests.

The cybersecurity community is closely monitoring these developments, highlighting the ongoing threat posed by North Korean hackers and the need for enhanced security measures to protect against such sophisticated cyber attacks.

LATEST POSTS

Solana Surpasses Ethereum in Important Metric

Top Solana-based DEXes Lead in Daily Trading Volume, Surpassing Ethereum Solana-based decentralized exchanges (DEXes) are making waves in the cryptocurrency market, with five of them...

Investors May Need to Pay Taxes in Bitcoin Sooner Than Expected

Crypto Payments for Taxes: A Closer Look at the Potential Changes Ahead The possibility of paying taxes with cryptocurrency, specifically bitcoin, is gaining traction in...

Pepe Unchained: Layer 2 Blockchain Drives Meme Coin Surge Through Successful Presale

Pepe Unchained: Revolutionizing the Meme Coin Market with Layer 2 Blockchain Technology The Pepe meme is back in the spotlight with the launch of Pepe...

SEC files lawsuit against Binance staking, BNB price rises despite legal challenges

Federal Judge Allows Majority of SEC Lawsuit Against Binance to Proceed In a recent court ruling, Judge Amy Berman Jackson of the District Court for...

Most Popular