North Korea-linked APT BlueNoroff focuses on crypto theft

The North Korea-linked APT group BlueNoroff has been spotted targeting cryptocurrency startups with fake MetaMask browser extensions.

The North Korea-linked APT group BlueNoroff has been spotted targeting cryptocurrency startups with fake MetaMask browser extensions. The nation-state actor is considered a group that operates under the control of the notorious North Korea-linked Lazarus APT group.

The latest string of attacks targeted cryptocurrency startups in the US, Russia, China, India, the UK, Ukraine, Poland, Czech Republic, UAE, Singapore, Estonia, Vietnam, Malta, Germany, and Hong Kong.

BlueNoroff shifted focus from attacks against the banks and SWIFT-connected servers to cryptocurrency businesses, the researchers also spotted the attackers building fake cryptocurrency software development companies in order to trick victims into installing legitimate-looking applications that eventually receive trojanized updates

Kaspersky published a report that details the recent operations conducted by the APT group since November 2021.

BlueNoroff attempts to get in contact with specific people in target organizations that are identified through precise reconnaissance.

In an attack scenario described by Kaspersky, the attackers sent to the victims a notification of a shared document via Google Drive from one colleague/friend to another.

The attackers in some attacks compromised the LinkedIn account of an employee within an organization and used it to share the link to a weaponized document on the platform.

The APT group used a tiny “X” image to track their campaigns, they used the third-party tracking service (Sendgrid) to be notified when the victim opens the sent document.

Kaspersky shared a list of company names that have been impersonated by the attackers, such as CoinSquad, CoinBig, Anri, and Abies Ventures. The researchers are not aware of the compromise of these companies.

The analysis of the bait documents used in the attacks revealed that threat actors exploited a remote template injection vulnerability tracked as CVE-2017-0199.

Another attack chain used by the APT group relies on sending an archive that contains a password-protected document (Excel, Word, or PDF) and a shortcut file disguised as a text file containing the document’s password.c

The multi-stage infection process ends with the released of a backdoor that supports the following functionalities:

Directory/File manipulationProcess manipulationRegistry manipulationExecuting commandsUpdating configurationStealing stored data from Chrome, Putty, and WinSCP

The attackers used the malware BlueNoroff to steal user credentials make lateral movement and compromise the larger number of systems as possible in the victim’s network. In some cases, the attackers carefully monitored for weeks the user and data flow within the target network, while planning a strategy for financial theft, especially for prominent prominent targets.

“If the attackers realize that the target uses a popular browser extension to manage crypto wallets (such as the Metamask extension), they change the extension source from Web Store to local storage and replace the core extension component (backgorund.js) with a tampered version. At first, they are interested in monitoring transactions.” reads the analysis published by Kaspersky.

Kaspersky highlighted that the high skills of BlueNoroff group that was able to tamper with the Metamask Chrome extension by analyzing 170,000 lines of code.

The only was to discover that the the extension is fake is analyze the extension source in debugging mode and discover that it is pointing to a local directory rather than the online store.

In the attacks against hardware wallets, the threat actors hijack the transactions by changing the recipient’s address, attempting to steal the maximum amount available.

The attribution to the North Korea-linked APT is based on overlaps and similarities between PowerShell scripts and backdoors used in past campaigns.

Experts also found similarities in the C2 address acquisition process with 2016 attacks that use a hardcoded DWORD value to resolve an IP address via XORing.

The report includes the Indicators of Compromise (IoCs) for this attack.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, BlueNoroff APT)