HomeCryptoNorth Korean Hackers Introduce Fresh Golang Malware 'Durian' Targeting Crypto Companies

North Korean Hackers Introduce Fresh Golang Malware ‘Durian’ Targeting Crypto Companies

-


North Korean Threat Actor Kimsuky Deploys Golang-Based Malware Durian in Cyber Attacks on South Korean Cryptocurrency Firms

North Korean Hackers Deploy Golang-Based Malware in Cyber Attacks on South Korean Cryptocurrency Firms

In a recent development, the North Korean threat actor known as Kimsuky has been identified using a new Golang-based malware called Durian to carry out targeted cyber attacks on two South Korean cryptocurrency firms. The attacks, which took place in August and November 2023, involved the use of legitimate South Korean software as an infection pathway.

According to Kaspersky’s APT trends report for Q1 2024, Durian is equipped with comprehensive backdoor functionality, allowing the attackers to execute commands, download additional files, and exfiltrate data from the compromised systems. The malware is designed to establish persistence on the host and introduce other malicious tools, including AppleSeed, LazyLoad, ngrok, and Chrome Remote Desktop.

One of the notable aspects of the attack is the use of LazyLoad, a tool previously associated with Andariel, a sub-cluster within the Lazarus Group. This raises the possibility of collaboration or tactical overlap between the two threat actors. Kimsuky, also known as APT43, Black Banshee, and other aliases, is believed to be a subordinate element of the 63rd Research Center within North Korea’s Reconnaissance General Bureau.

The U.S. Federal Bureau of Investigation (FBI) and the National Security Agency (NSA) have warned that Kimsuky’s primary mission is to steal data and gather geopolitical insights for the North Korean regime. The group has also been linked to campaigns involving a C#-based remote access trojan and an information stealer called TutorialRAT.

In a separate incident, another North Korean state-sponsored hacking group called ScarCruft, also known as APT37, has been targeting South Korean users with Windows shortcut files that lead to the deployment of RokRAT. This group, aligned with North Korea’s Ministry of State Security, is focused on covert intelligence gathering to support the nation’s strategic interests.

The cybersecurity community is closely monitoring these developments, highlighting the ongoing threat posed by North Korean hackers and the need for enhanced security measures to protect against such sophisticated cyber attacks.

LATEST POSTS

Donald Trump scheduled to address Bitcoin conference

Trump to Speak at Bitcoin Conference in Nashville: Will Crypto Community Support Him in the Election? The upcoming Bitcoin Conference in Nashville, Tennessee is set...

Exploring the Impact of Blockchain Technology on Payment Gateways: The Hype Magazine Dives into Urban Culture with Stories from Hip Hop to Hollywood! Discover...

Blockchain Technology: Revolutionizing Payment Gateways in Biz/Tech/NFTs Blockchain Technology Revolutionizing Payment Gateways In a world where traditional payment systems are often slow, expensive, and limited in...

Kamala Harris is learning about cryptocurrency

Vice President Kamala Harris and Crypto: A Closer Look at Her Emerging Interest Vice President Kamala Harris is making waves in the crypto world as...

Ethereum ETFs See $107 Million in Net Inflows on Debut Day

United States Ether ETFs See Strong Inflows on First Day of Trading On their first day of trading, United States Ether exchange-traded funds (ETFs) made...

Most Popular