Monday, March 4, 2024

Lazarus APT Group Attack Cryptocurrency Exchange using macOS Malware Under the Operation AppleJeus

A cyber espionage APT group called Lazarus hits the cryptocurrency exchanges using fake installer and macOS malware using variously sophisticated techniques.

Lazarus group widely known for cyber attacks against various financial institutions and they have successfully compromised several banks and other financial sectors.

In this case attackers targeting various platform and developing malware based on the targets and currently they are using new macOS malware to compromise the cryptocurrency exchange and this is the first time Lazarus APT using macOS malware.

This attack is performing both windows as well as macOS platform  since many developers and engineers are switching to using macOS.

Attackers found a way to create a legitimate looking business and inject a malicious payload into a “legitimate looking” software update mechanism.

This Malware distributed through this Celas LLC Tool, but researchers said,” We cannot say with full certainty whether Celas LLC was compromised and the threat actor abused it to push malware through an update mechanism.

A researcher named this operation as AppleJeus because of the developer did this project under the name of Jeus.

Infection Process using macOS Malware 

The victim had been infected with the help of a trojanized cryptocurrency trading application and the user installed this program via a download link delivered over email.

Attackers distributing the malicious installer via update for a trading application called Celas Trade Pro which is one of the  legitimate-looking application developed by Celas Limited that is work as an all-in-one style cryptocurrency trading program.

But the installation package has performed a very suspicious updater at the end of the installation process where installer immediately runs the Updater.exe module with the “CheckUpdate” parameter.

Updater.exe is used to collect the victim’s host information and send it back to the server and the malware create a unique string for each infected system to the unique identifier of the infected Windows host.

In order to infect the macOS, A hidden updater called auto updater is being installed after the installation of trading program tool Celas.

Once the system rebooted then It keeps contacting the command and control (C2) server in order to download and run an additional executable from the server.

According to kaspersky researchers,The trojanized updater works similar to the Windows version in many ways. Both applications are implemented using a cross-platform QT framework. Upon launch, the downloader creates a unique identifier for the infected host using a “%09d-%06d” format string template. Next, the app collects basic system information.

later threat actor delivers the malicious payload and the main function of this malware is to implant the Fall chill backdoor loader linked to several files.

This backdoor contains full future to fully control the infected host and these backdoor capabilities are common as previous backdoors.

Also Read

Dangerous Android Malware that Steals Banking Credentials, Call Forwarding, Keylogging, and Ransomware Activities

Android Device With Open ADB Ports Exploited to Spread Satori Variant of Mirai Botnet

60,000 Android Devices are Infected with Malicious Battery Saver App that Steals Various Sensitive Data

Website

Latest articles

New Silver SAML Attack Let Attackers Forge Any SAML Response To Entra ID

SolarWinds cyberattack was one of the largest attacks of the century in which attackers...

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...

CWE Version 4.14 Released: What’s New!

The Common Weakness Enumeration (CWE) project, a cornerstone in the cybersecurity landscape, has unveiled...

RisePro Stealer Attacks Windows Users Steals Sensitive Data

A new wave of cyber threats has emerged as the RisePro information stealer targets...

Golden Corral Restaurant Chain Hacked: 180,000+ Users’ Data Stolen

The Golden Corral Corporation, a popular American restaurant chain, has suffered a significant data...

CISA Warns Of Hackers Exploiting Multiple Flaws In Ivanti VPN

Threat actors target and abuse VPN flaws because VPNs are often used to secure...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles