Malware News New macOS 'KandyKorn' malware targets cryptocurrency engineers

[Gandalf_The_Grey]

Content source

https://www.bleepingcomputer.com/news/security/new-macos-kandykorn-malware-targets-cryptocurrency-engineers/

A new macOS malware dubbed 'KandyKorn' has been spotted in a campaign attributed to the North Korean Lazarus hacking group, targeting blockchain engineers of a cryptocurrency exchange platform.

The attackers impersonate members of the cryptocurrency community on Discord channels to spread Python-based modules that trigger a multi-stage KandyKorn infection chain.

Elastic Security discovered and attributed the attacks to Lazarus based on overlaps with past campaigns concerning the employed techniques, network infrastructure, code-signing certificates, and custom Lazarus detection rules.

The attack, which starts on Discord, starts with social engineering attacks on targets to trick them into downloading a malicious ZIP archive named 'Cross-platform Bridges.zip.'

The victim is misled into believing they are downloading a legitimate arbitrage bot designed for automated profit generation from cryptocurrency transactions.

Instead, the contained Python script ('Main.py') will import 13 modules from an equal number of scripts in the ZIP, launching the first payload, 'Watcher.py.'

Watcher.py is a downloader that unpacks and executes a second Python script named 'testSpeed.py' along with another Python file named 'FinderTools,' downloaded from a Google Drive URL.

FinderTools is a dropper that fetches and launches an obfuscated binary named 'SugarLoader,' which appears under two names and instances, as an .sld and a .log Mach-O executables.

Sugarloader establishes a connection with the command and control (C2) server to get and load the final payload, KandyKorn, into memory using reflective binary loading.

New macOS 'KandyKorn' malware targets cryptocurrency engineers

A new macOS malware dubbed 'KandyKorn' has been spotted in a campaign attributed to the North Korean Lazarus hacking group, targeting blockchain engineers of a cryptocurrency exchange platform.

www.bleepingcomputer.com

 

[CyberTech]

The notorious North Korean hacking group Lazarus has used new macOS and Windows malware in recent attacks, security researchers warn.

In one of the attacks, blockchain engineers at a cryptocurrency exchange platform were targeted with a Python application designed to provide initial access, ultimately resulting in the loading of binaries in memory.

As part of the attack, Lazarus impersonated members of the blockchain community on a public Discord channel, convincing the victim to download an archive containing malicious code.

At the end of a multi-stage process involving various evasion techniques and loaders, a new macOS malware named KandyKorn was executed on the target machine, allowing the attackers to access and exfiltrate data from the system.

Once installed, the malware would wait for its command-and-control (C&C) server to send commands enabling it to harvest information, list directories, list running processes, download files, upload files, archive directories and exfiltrate them, erase files, kill processes, execute commands using a terminal, spawn a shell, download a configuration from the server, sleep, and exit.

The rest

North Korean Hackers Use New 'KandyKorn' macOS Malware in Attacks

Security researchers uncover new macOS and Windows malware associated with the North Korea-linked Lazarus Group.

www.securityweek.com