Operation AppleJeus: North Korea’s Cryptocurrency Malware
cryptocurrencyLazarusNorth Korea
After releasing Operation AppleJeus, the Lazarus group continued to use a similar modus operandi in order to compromise cryptocurrency businesses.
Indicators of Compromise
celasllc.comAlienVault2022-11-05
wfcwallet.comAlienVault2022-11-05
cyptian.comAlienVault2022-11-05
index.doAlienVault2022-11-05
aeroplans.infoAlienVault2022-11-05
www.private-kurier.comAlienVault2022-11-05
www.jmttrading.orgAlienVault2022-11-05
beastgoc.comAlienVault2022-11-05
unioncrypto.vipAlienVault2022-11-05
www.buckfast-zucht.deAlienVault2022-11-05
invesuccess.comAlienVault2022-11-05
www.wb-invest.netAlienVault2022-11-05
www.wb-bot.orgAlienVault2022-11-05
mydealoman.comAlienVault2022-11-05
www.chainfun365.comAlienVault2022-11-05
a8332f3a.bitcoin-dns.hostingAlienVault2022-11-05
1a7ea920.bitcoin-dns.hostingAlienVault2022-11-05
www.celasllc.comAlienVault2022-11-05
www.domains4bitcoins.comAlienVault2022-11-05
libertyvps.netAlienVault2022-11-05
black.hostAlienVault2022-11-05
njal.laAlienVault2022-11-05
cellasllc.comAlienVault2022-11-05
c358ea2d.bitcoin-dns.hostingAlienVault2022-11-05
ad636824.bitcoin-dns.hostingAlienVault2022-11-05
APT Groups1
Lazarus GroupKorea, Democratic People's Republic of
Labyrinth ChollimaHidden CobraDiamond SleetGroup 77Whois Hacking TeamAPT-C-26NewRomanic Cyber Army TeamUNC2970UNC577TraderTraitorTA404SectorA01ATK 3Gods DisciplesApplewormGuardians of PeaceUNC4736DEV-0139ITG03Lazarus GroupUNC4034Jade SleetZincHastati GroupUNC4899Gods Apostles
Campaign Guidance
Remediation, mitigation, notes, history and related intelligence
- Initiate your organization’s incident response plan.
- Generate new keys for wallets, and/or move to new wallets.
- Introduce a two-factor authentication solution as an extra layer of verification.
- Use hardware wallets, which keep the private keys in a separate, secured storage area.
- To move funds out off a compromised wallet:
- Do not use the malware listed in this advisory to transfer funds, and
- Form all transactions offline and then broadcast them to the network all at once in a short online session, ideally prior to the attacker accessing them.
- Remove impacted hosts from network.
- Assume the threat actors have moved laterally within the network and downloaded additional malware.
- Change all passwords to any accounts associated with impacted hosts.
- Reimage impacted host(s).
- Install anti-virus software to run daily deep scans of the host.
- Ensure your anti-virus software is setup to download the latest signatures daily.
- Install a Host Based Intrusion Detection (HIDS)-based software and keep it up to date.
- Ensure all software and hardware is up to date, and all patches have been installed.
- Ensure network-based firewall is installed and/or up to date.
- Ensure the firewall’s firmware is up to date.
Reports & References1
Observed Countries29
AR (265)
AU (675)
BE (70)
BR (973)
CN (592)
DE (697)
DK (803)
EE (322)
ES (359)
GB (511)
HK (339)
HU (383)
IL (285)
IN (404)
IT (378)
JP (65)
LU (753)
MT (924)
NL (683)
NZ (88)
PL (397)
RU (315)
SA (25)
SE (652)
SG (568)
SI (527)
TR (180)
UA (383)
US (313)