BlueNoroff Threat Group Targets Cryptocurrency Startups

BlueNoroff, an advanced persistent threat (APT) group that’s part of the larger Lazarus Group associated with North Korea, is behind a series of attacks against small and medium-sized companies that have led to serious cryptocurrency losses.

The campaign, dubbed SnatchCrypto, targets organizations that deal with cryptocurrencies and smart contracts, decentralized finance, blockchain, and the financial technology industry in their work, report the Kaspersky researchers who observed it. These companies were targeted for a reason, they said: Startups often receive messages and documents from unfamiliar senders.

“As most cryptocurrency businesses are small or medium-sized startups, they cannot invest lots of money into their internal security system,” researchers wrote in a blog post. “The actor understands this and takes advantage by using elaborate social engineering schemes.”

In this campaign, the attackers attempt to manipulate the victim by pretending to be an existing venture capital firm. Researchers saw the names of more than 15 venture businesses used in these attacks but believe the actual organizations have nothing to do with the threat.

Attackers send these startup employees a “full-featured Windows backdoor with surveillance functions, disguised as a contract or another business file,” researchers report. If the file is opened on a device connected to the Internet, another macro-enabled document would be obtained to deploy malware.

This malware sends the target’s general information and PowerShell agent to the attackers, creating a backdoor. From there, BlueNoroff deploys additional tools, including a keylogger and screenshot taker, to monitor victims. After weeks or months of tracking, the attackers find a prominent target and use the data they’ve collected to steal large amounts of cryptocurrency from them.

Read more details here and here.