Lazarus Group: a surge in crypto heists
The Lazarus Group is a cybercrime syndicate linked to North Korea. It has pushed hard into the cryptocurrency and blockchain sector, stealing over $3 Billion worth of crypto in the past 6 years. Its attacks on crypto companies show tactics and tooling that keep changing.
In the past year Lazarus has already been identified as responsible for stealing almost $240 million in cryptoassets from Atomic Wallet ($100 million), CoinsPaid ($37.3 million), Alphapo ($60 million), and Stake.com ($41 million).
In 2022, the group was implicated in several significant hacks, notably the breaches of Harmony’s Horizon Bridge and Axie Infinity’s Ronin Bridge, both in the first half of the year. After those attacks Lazarus seemed to go quiet, with no major crypto heists publicly attributed to them until mid-2023. Then the attacks started again.
Atomic Wallet breach
On June 3, 2023, users of Atomic Wallet, a non-custodial decentralized cryptocurrency wallet, lost more than $100 million. By June 6, blockchain analysis firm Elliptic had linked the hack to Lazarus, identifying multiple indicators pointing to the North Korean group. The FBI later confirmed the attribution.
CoinsPaid compromise
On July 22, 2023, Lazarus carried out a social engineering attack on the crypto payment platform CoinsPaid. The breach let the attackers make authorized withdrawal requests, and they stole approximately $37.3 million in crypto assets. CoinsPaid’s own report, published on July 26, named Lazarus as the culprits, and the FBI later corroborated this.
Alphapo attack
On the same day, July 22, Lazarus hit Alphapo, a centralized crypto payment provider. The attackers took $60 million in crypto assets, likely using previously compromised private keys. The FBI’s investigation confirmed Lazarus’s role in this attack as well.
Stake.com heist
On September 4, 2023, around $41 million in virtual currency was stolen from the online crypto casino Stake.com. The breach may have been made possible by a stolen private key. The FBI confirmed Lazarus’s involvement in a press release issued on September 6.
CoinEx breach
Finally, on September 12, 2023, the centralized crypto exchange CoinEx was hacked and $54 million was stolen. Multiple indicators consistent with how Lazarus operates pointed to their involvement.
Other notable crypto and blockchain attacks
1. Operation AppleJeus (2018):
One of the group’s significant early moves into cryptocurrency was Operation AppleJeus, which targeted cryptocurrency exchanges and trading platforms worldwide. The attack began with a fake cryptocurrency trading application called Celas Trade Pro. Once users downloaded the app, it installed a Trojanized version of a legitimate software, giving Lazarus control over the infected systems.
Methodology: Lazarus used spear-phishing emails to lure victims into downloading the malware. The malicious software could bypass macOS defenses by using a valid Apple developer certificate, which made it particularly hard to spot.
2. TraderTraitor campaign (2021 - 2022):
In the TraderTraitor campaign, Lazarus Group targeted blockchain and cryptocurrency companies with malicious applications posing as tools for trading and portfolio management.
Tools used:
TokenAIS and CryptAIS: These applications, disguised as AI-based trading tools, contained malicious code that would steal user credentials and other sensitive information. The malware used Node.js functions to communicate with command-and-control (C2) servers, decrypt responses, and execute malicious commands on infected systems.
3. AlticGO: Packaged as an Electron application for Windows, this tool carried out similar malicious activity, which shows that Lazarus can attack across platforms.
Attack methods, techniques, and infrastructure
Lazarus Group uses a range of techniques:
1. Spear phishing and social engineering:
Many Lazarus attacks begin with spear-phishing emails designed to deceive recipients into downloading malware or giving up sensitive information. The emails are often tailored to look like legitimate communications from trusted sources within the targeted industry.
2. Trojanized software:
Lazarus frequently uses Trojanized versions of legitimate software to gain access to victim systems. They embed malicious code in applications that look harmless and rely on the trust users place in those tools.
3. Exploitation of software vulnerabilities:
The group is known for exploiting unpatched vulnerabilities in widely used software. For example, they exploited a vulnerability in Zoho’s ManageEngine ServiceDesk to compromise corporate networks in their latest campaigns.
4. Command-and-control (C2) servers:
Lazarus maintains C2 infrastructure to manage their malware. These servers communicate with infected systems, issuing commands and extracting stolen data. Even though security researchers have documented it well, Lazarus continues to reuse much of the same infrastructure, which suggests they are confident in their operational security and obfuscation techniques.
5. Custom malware and tools:
The group uses a variety of custom malware, including Remote Access Trojans (RATs) and data exfiltration tools. Examples include QuiteRAT, MagicRAT, and DeimosC2, all of which have been linked to Lazarus through shared infrastructure and coding similarities.
6. False flags and misdirection:
To evade detection and attribution, Lazarus often plants false flags in their operations. They may leave misleading clues, such as Romanized Russian words in their malware, to divert investigators from their true origins.
Defense and mitigation
HYDN’s Advanced Adversarial Simulation service enables companies to simulate a tailored attack aimed at circumventing traditional network controls. HYDN’s team uses the same tactics, tools, techniques and mindsets as attackers such as Lazarus Group to uncover weaknesses and help you fix vulnerabilities, so that you can protect your data and your customers’ data.
HYDN uses stealth and evasion techniques to compromise your organization and achieve predetermined goals. After the simulation, our red team will provide a full debrief including an explanation of the processes used, along with recommendations to close gaps.
To protect against Lazarus Group’s attacks, organizations in the crypto and blockchain sectors should have these measures in place:
- Regular software updates: keep all software and operating systems up to date with the latest patches to mitigate known vulnerabilities.
- Network monitoring: deploy advanced network monitoring to detect unusual activity and potential intrusions.
- Endpoint security: use endpoint security that can detect and block malware.
- Employee training: run regular training sessions on the dangers of spear-phishing and social engineering tactics.
- Incident response planning: develop and maintain an incident response plan so that any breach can be dealt with quickly.
Conclusion
Lazarus Group keeps refining its methods and widening its targets in cryptocurrency and blockchain. Organizations that understand its tactics and put the measures above in place are much better placed to defend themselves.
