The North Korean hacking collective Lazarus BlueNoroff is making strides into the crypto market with the deployment of macOS-based malware.

Security researchers at Jamf Jamf has come across macOS malware thought to be the work of the notorious North Korean hacker group. Lazarus BlueNoroff .

This discovery follows recent malware incidents involving KandyKorn, which is also linked to North Korean cyber operatives.

In an innovative move, the BlueNoroff group created a website that mimics a legitimate cryptocurrency exchange's blog, hosted on a domain strikingly similar to the authentic one, in order to gain legitimacy. Swissborg To outsmart detection systems, the malware cleverly divides the command and control URL into two different parts before combining them again.

Deception and Delivery from Hackers

BlueNoroff operatives often pose as investors or recruiters to approach potential targets, offering enticing job opportunities. Once trust is established, they deploy a Trojan specifically crafted for macOS users. Operators of cryptocurrency platforms are advised to closely monitor access logs to identify any irregularities that may suggest a security breach.

The malware identified by Jamf, dubbed ObjCShellz, is believed to play a crucial role in the RustBucket Campaign, operating as a final-stage tool in a layered offensive. Despite its seemingly straightforward nature, it offers a remote shell that allows attackers to stealthily execute commands on macOS machines.

When researchers began their investigation, the C2 server was quickly taken offline, a tactic often used to obstruct forensic analysis. However, its deactivation could also indicate that the malware has already met its aims.

The BlueNoroff hacking faction has found its way into Macs through the introduction of the new ObjCShellz malware. @serghei https://t.co/tGQruRNCu8 https://t.co/tGQruRNCu8

— BleepingComputer (@BleepinComputer) November 7, 2023

Implications for the Crypto Industry

The domain name they used resembles that of the Swissborg cryptocurrency exchange, indicating a phishing effort typical of BlueNoroff's RustBucket campaign. This incident highlights the group's ongoing commitment to evolving their cyber warfare techniques by developing malware that can slip past established security measures.

Even though the C2 server is not currently active, stakeholders in the industry shouldn't underestimate the ongoing threat. To reduce vulnerabilities, it's critical for users to block any communications with known malicious IP addresses and to remain vigilant for signs of potential reactivation that might ignite dormant malware.

The continuous progression of the Lazarus/BlueNoroff group is a stark reminder of the ever-present and evolving cyber threats out there. The crypto industry must stay alert and proactive, implementing robust cybersecurity measures to safeguard their assets and user data from such malicious attacks.