{"id":43087,"date":"2021-05-24T18:57:04","date_gmt":"2021-05-24T15:57:04","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=43087"},"modified":"2025-08-31T02:03:25","modified_gmt":"2025-08-30T23:03:25","slug":"report-lazarus-hackers-behind-cryptocore-attacks-on-bitcoin-exchanges","status":"publish","type":"post","link":"https:\/\/u1f987.com\/en\/report-lazarus-hackers-behind-cryptocore-attacks-on-bitcoin-exchanges\/","title":{"rendered":"Report: Lazarus hackers behind CryptoCore attacks on Bitcoin exchanges"},"content":{"rendered":"

The Lazarus hacking group, linked to the North Korean authorities, has for several years been compromising Bitcoin exchanges worldwide under the banner of CryptoCore. arrived at<\/a> this conclusion, security researchers from ClearSky said.<\/p>\n

The attackers drained wallets of users and trading-platform staff through targeted phishing. In interactions with victims, the hackers urged them to download a malicious file.<\/p>\n

Experts from ClearSky compared reports of these attacks from F-Secure, CERT JPCERT\/CC and NTT Security. In addition to similarities in behavior and the original code, the CryptoCore malware exhibits distinctive traits contained in [simple_tooltip content=’tool for identifying and classifying malware’]YARA rules[\/simple_tooltip] by ESET and Kaspersky for Lazarus.<\/p>\n

\"Report:<\/p>\n

The YARA rule matches the Lazarus RAT in the ESET report. Data: ClearSky.<\/p>\n<\/div>\n

One of the YARA rules corresponds to an old remote access Trojan (RAT) that Kaspersky reported in 2016.<\/p>\n

\"Report:<\/p>\n

Data: ClearSky.<\/p>\n<\/div>\n

Overall, between F-Secure, NTT Security and JPCERT\/CC reports, ClearSky found 40 common indicators of compromise (IoCs), a nearly identical VBS script, and similar RATs and stagers.<\/p>\n

\"Report:<\/p>\n

Lazarus VBS script used in several campaigns. Data: ClearSky.<\/p>\n<\/div>\n

\n

“Taking all similarities into account, ClearSky attributes the CryptoCore campaign to Lazarus with a high degree of probability,” according to the conclusion.<\/p>\n<\/blockquote>\n

CryptoCore began operating in mid-2018. During this period it hacked cryptocurrency exchanges in the United States, Israel, Europe and Japan.<\/p>\n

According to ClearSky, by June 2020 the hackers’ activities had caused about $200 million in losses in cryptocurrency.<\/p>\n

Subscribe to ForkLog news on Telegram: ForkLog Feed<\/a> \u2014 the full news feed, ForkLog<\/a> \u2014 the most important news, infographics, and opinions.<\/p>\n","protected":false},"excerpt":{"rendered":"

The Lazarus hacking group, linked to North Korean authorities, has for several years been compromising Bitcoin exchanges worldwide under the CryptoCore banner.<\/p>\n","protected":false},"author":1,"featured_media":43088,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1154,1125],"class_list":["post-43087","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-crimes","tag-lazarus"],"aioseo_notices":[],"amp_enabled":true,"views":"19","promo_type":"1","layout_type":"1","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/43087","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/comments?post=43087"}],"version-history":[{"count":1,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/43087\/revisions"}],"predecessor-version":[{"id":43089,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/43087\/revisions\/43089"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media\/43088"}],"wp:attachment":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media?parent=43087"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/categories?post=43087"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/tags?post=43087"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}