Elastic catches DPRK passing out KANDYKORN

[[correlate]]

Content source

https://www.elastic.co/security-labs/elastic-catches-dprk-passing-out-kandykorn

Elastic Security Labs is disclosing a novel intrusion targeting blockchain engineers of a crypto exchange platform. The intrusion leveraged a combination of custom and open source capabilities for initial access and post-exploitation.
We discovered this intrusion when analyzing attempts to reflectively load a binary into memory on a macOS endpoint. The intrusion was traced to a Python application posing as a cryptocurrency arbitrage bot delivered via a direct message on a public Discord server.
We attribute this activity to DPRK and recognize overlaps with the Lazarus Group based on our analysis of the techniques, network infrastructure, code-signing certificates, and custom Lazarus Group detection rules; we track this intrusion set as REF7001.

Elastic catches DPRK passing out KANDYKORN — Elastic Security Labs

Elastic Security Labs exposes an attempt by the DPRK to infect blockchain engineers with novel macOS malware.

www.elastic.co