BlueNoroff Threat Group Targets Cryptocurrency Startups
A series of attacks against small and medium-sized businesses has led to major cryptocurrency losses for the victims.
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
BlueNoroff, an advanced persistent threat (APT) group that's part of the larger Lazarus Group associated with North Korea, is behind a series of attacks against small and medium-sized companies that have led to serious cryptocurrency losses.
The campaign, dubbed SnatchCrypto, targets organizations that deal with cryptocurrencies and smart contracts, decentralized finance, blockchain, and the financial technology industry in their work, report the Kaspersky researchers who observed it. These companies were targeted for a reason, they said: Startups often receive messages and documents from unfamiliar senders.
"As most cryptocurrency businesses are small or medium-sized startups, they cannot invest lots of money into their internal security system," researchers wrote in a blog post. "The actor understands this and takes advantage by using elaborate social engineering schemes."
In this campaign, the attackers attempt to manipulate the victim by pretending to be an existing venture capital firm. Researchers saw the names of more than 15 venture businesses used in these attacks but believe the actual organizations have nothing to do with the threat.
Attackers send these startup employees a "full-featured Windows backdoor with surveillance functions, disguised as a contract or another business file," researchers report. If the file is opened on a device connected to the Internet, another macro-enabled document would be obtained to deploy malware.
This malware sends the target's general information and PowerShell agent to the attackers, creating a backdoor. From there, BlueNoroff deploys additional tools, including a keylogger and screenshot taker, to monitor victims. After weeks or months of tracking, the attackers find a prominent target and use the data they've collected to steal large amounts of cryptocurrency from them.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024