According to Kaspersky, the recently discovered North Korea-related supply chain attacks were most likely devised to target cryptocurrency companies with backdoor malware.
A sophisticated, multi-stage campaign was thought to be designed to drop infostealers on targeted organizations. However, a Russian AV vendor has linked a backdoor he malware called “Gopuram” that it has been tracking since 2020 to the attack.
This confirmed that the threat group was likely North Korean Lazarus, and changed the actor’s suspected end goal from cyber espionage to theft of digital currency.
“In investigating attacks on cryptocurrency companies in Southeast Asia in 2020, we found Gopuram co-existing with the AppleJeus backdoor on the same machine, which is believed to be Lazarus,” said Kaspersky. wrote in a blog post.
“Over the years, Gopuram infected few victims, but in March 2023, the number of infections started to increase. The increase was directly related to the 3CX supply chain attack. It turned out.”
Read more about North Korea crypto attack: UN links North Korea to $281 million crypto exchange robbery.
The modular backdoor is introduced in the 3CX attack similar to the infostealer as a second stage payload via DLL sideloading. It is used to perform various actions on the affected machine, including manipulating the Windows registry and services, performing file timestamps, and injecting payloads into processes.
According to Kaspersky, the backdoor has been deployed on fewer than 10 machines so far, indicating a highly targeted campaign specifically focused on cryptocurrency companies.
“We believe Gopuram is the primary implant and final payload in the attack chain. Investigation into the 3CX campaign is not yet complete,” Kaspersky concluded. “Continuing our analysis of the deployed implants, we will look more closely at the toolset used in Supply’s chain attack.”
North Korean state-of-the-art hackers have targeted cryptocurrency companies for years and are suspected of stealing billions of dollars to fund the country’s nuclear weapons program.
