Kaspersky’s Global Research and Analysis Team (GReAT) published findings on AppleJeus, an operation to aproach in stealing cryptocurrency carried out by prolific threat actor, Lazarus Group back in 2018. 

Now, new findings show that their operations continue with more careful steps from the infamous threat actor, improved tactics and procedures and the use of Telegram as one of its new attack vectors. Victims in the UK, Poland, Russia and China, in addition to several business entities connected to cryptocurrency, were affected during the operation. 

Lazarus is one of the most active and prolific advanced persistent threat (APT) actors who have experience in carrying out number of campaigns targeting cryptocurrency-related organisations. During their initial 2018 AppleJeus operation, the threat actor created a fake cryptocurrency company in order to deliver their manipulated application and exploit a high level of trust among potential victims. This operation was marked by Lazarus building its first macOS malware. Users downloaded the application from third-party websites and the malicious payload was delivered via a disguised regular application update. The payload enabled the attacker to gain full control of the users’ device and steal cryptocurrency. 

Kaspersky researchers recently have identified changes occurred on the group's attack tactics in their so called 'sequel' operation. The attack vector in Lazarus’ 2019 attacks mimicked the one from the previous year, but with some improvements. This time, Lazarus created fake cryptocurrency-related websites, which hosted links to fake organization Telegram channels and delivered malware via the messenger. 

In this AppleJeus operation, the attack consisted of two phases. Users would first download an application, and the associated downloader would fetch the next payload from a remote server, enabling the attacker to fully control the infected device with a permanent backdoor. However, this time the payload was delivered carefully in order to evade detection by behavior-based detection solutions. In attacks against macOS-based targets, an authentication mechanism was added to the macOS downloader and the development framework was changed. In addition, a file-less infection technique was adopted this time. When targeting Windows users, the attackers avoided the use of Fallchill malware (which was employed in the first AppleJeus operation) and created a malware that only ran on specific systems after checking them against a set of given values. These changes showcase that the threat actor have become more diligent and careful with their approach to attack, by creating new methods to avoid detection.

Lazarus also made significant modifications in macOS malware and expanded the number of versions. Unlike in the previous attack, during which Lazarus used open source QtBitcoinTrader to build a crafted macOS installer, this time the threat actor started to use their homemade code to build a malicious installer. These developments signify that the threat actor will continue to create modifications of the macOS malware and our most recent detection was an intermediate result of these changes.

Seongsu Park, Kaspersky security researcher said “The AppleJeus sequel operation demonstrates that, despite significant stagnation in the cryptocurrency markets, Lazarus continues to invest in cryptocurrency-related attacks by making them more sophisticated. Further changes and diversification of their malware demonstrates that there is no reason to believe that these attacks will not continue to grow in numbers and become a more serious threat.”

The Lazarus group, known for its sophisticated operations and links to North Korea, is notorious not only for its cyber-espionage and cybersabotage attacks, but also for financially-motivated attacks. A number of researchers, including those at Kaspersky, have previously reported on this group targeting banks and other large financial enterprises.

Thank you for Signing Up

Please correct the marked field(s) below.

CSA

E-News

 

1,true,6,Contact Email,2 1,false,1,First Name,2 1,false,1,Last Name,2