Defi Attacks: Protect Your Crypto Coins from Advanced Threat Actors

MetaversePlanet April 10, 2022

0 1 minute read

Lazarus, an advanced and persistent threat actor (APT) renowned for its financial operations, has recently been targeted through the deployment of Trojanized distributed finance (DeFi) applications aimed at augmenting revenue through cryptocurrency theft.

This strategy involves exploiting legitimate apps utilized for managing cryptocurrency wallets by distributing malware that takes control of victims’ systems. Operating since 2009, the Lazarus group stands out among state-sponsored APT entities due to its significant emphasis on financial gain.

Defi Attacks: Protect Your Crypto Coins from Advanced Threat Actors

In a notable development, Lazarus has adapted to the evolving cryptocurrency landscape, incorporating non-tradable tokens (NFTs) and the distributed finance (DeFi) markets into its schemes. In December 2021, cybersecurity researchers from Kaspersky identified a new malware operation orchestrated by Lazarus, leveraging a Trojan DeFi application.

This malicious application disguises itself as a legitimate program called “DeFi Wallet,” which is responsible for registering and managing cryptocurrency wallets. Upon execution, the Trojan installer initiates a stealthy malware deployment alongside the genuine app installer, discreetly compromising the victim’s system. The malware, effectively a Trojan Horse, is intricately overlaid onto the authentic app.

Seongsu Park, a Senior Security Researcher at Kaspersky Global Research and Analysis Team (GReAT), remarked on Lazarus’ persistent interest in the cryptocurrency industry. Over time, the group has demonstrated a capacity for devising sophisticated methods to entice victims while minimizing the likelihood of detection.

The cryptocurrency and blockchain sectors, being dynamic and increasingly lucrative, not only attract scammers and phishers but also garner the attention of formidable entities like financially motivated APT groups. As the cryptocurrency market expands, Lazarus’ engagement in this industry is anticipated to endure and potentially intensify.