Crypto Hack Group Upgrades Previous Hacking Methods

An alleged North Korean supported hacker group, Lazarus, has systematically distributed new viruses to steal cryptocurrencies.

Prominent cybersecurity company Kaspersky disclosed in a news report on the 8th of January that Lazarus can now corrupt both Mac and Windows computer systems.

Sometime in August 2018, Kaspersky recounted that the hackers were using an altered crypto trading platform known as QtBitcoinTrader to install and activate its illicit code. This code was known as “Operation AppleJeus”. The company now notes that Lazarus has begun adding upgrades to the malware.

Kaspersky has pointed out a new virus that runs on both macOS and Windows labeled UnionCryptoTrader, which is an upgrade of previous versions. There’s also another malware in circulation which is targeted at Mac devices known as MarkMakingBot.

Investigators also discovered Windows devices that were corrupted by a malicious software dubbed WFCUpdater but haven’t been able to name the original installer. Kaspersky recounts that the virus began from a .NET malware which was masked as a WFC wallet updater and was circulated through a false website.

The virus got into the computers in different stages before implementing the pre-set orders and permanently initiating the baggage.

What Channel did the Group Use in Transmitting the Virus?
The UnionCryptoTrader uncovered on Windows systems were believed to have been implemented from Telegram’s download folder, which led investigators to conclude without a doubt that the perpetrators transmitted the false installer through a popular messaging app, Telegram.

The Windows-versioned virus launched a corrupted Internet Explorer procedure, which then carries out the assailant’s orders. The activity illustrated above has been observed in the UK, Poland, Russia, and China.

Lazarus has been famous for attacking crypto users for a while now. Sometime in 2018, announcements showed that the hacking organization had stolen a whopping $570 million in cryptocurrencies since 2017.

The antivirus company warned in March 2019 that the group still rob unsuspecting victims of crypto and that they were now using even more refined hacking methods. Also, the company stated that the macOS malware was upgraded in October last year.