Friday, June 21, 2024

Lazarus APT Group Attack Cryptocurrency Exchange using macOS Malware Under the Operation AppleJeus

A cyber espionage APT group called Lazarus hits the cryptocurrency exchanges using fake installer and macOS malware using variously sophisticated techniques.

Lazarus group widely known for cyber attacks against various financial institutions and they have successfully compromised several banks and other financial sectors.

In this case attackers targeting various platform and developing malware based on the targets and currently they are using new macOS malware to compromise the cryptocurrency exchange and this is the first time Lazarus APT using macOS malware.

This attack is performing both windows as well as macOS platform  since many developers and engineers are switching to using macOS.

Attackers found a way to create a legitimate looking business and inject a malicious payload into a “legitimate looking” software update mechanism.

This Malware distributed through this Celas LLC Tool, but researchers said,” We cannot say with full certainty whether Celas LLC was compromised and the threat actor abused it to push malware through an update mechanism.

A researcher named this operation as AppleJeus because of the developer did this project under the name of Jeus.

Infection Process using macOS Malware 

The victim had been infected with the help of a trojanized cryptocurrency trading application and the user installed this program via a download link delivered over email.

Attackers distributing the malicious installer via update for a trading application called Celas Trade Pro which is one of the  legitimate-looking application developed by Celas Limited that is work as an all-in-one style cryptocurrency trading program.

But the installation package has performed a very suspicious updater at the end of the installation process where installer immediately runs the Updater.exe module with the “CheckUpdate” parameter.

Updater.exe is used to collect the victim’s host information and send it back to the server and the malware create a unique string for each infected system to the unique identifier of the infected Windows host.

In order to infect the macOS, A hidden updater called auto updater is being installed after the installation of trading program tool Celas.

Once the system rebooted then It keeps contacting the command and control (C2) server in order to download and run an additional executable from the server.

According to kaspersky researchers,The trojanized updater works similar to the Windows version in many ways. Both applications are implemented using a cross-platform QT framework. Upon launch, the downloader creates a unique identifier for the infected host using a “%09d-%06d” format string template. Next, the app collects basic system information.

later threat actor delivers the malicious payload and the main function of this malware is to implant the Fall chill backdoor loader linked to several files.

This backdoor contains full future to fully control the infected host and these backdoor capabilities are common as previous backdoors.

Also Read

Dangerous Android Malware that Steals Banking Credentials, Call Forwarding, Keylogging, and Ransomware Activities

Android Device With Open ADB Ports Exploited to Spread Satori Variant of Mirai Botnet

60,000 Android Devices are Infected with Malicious Battery Saver App that Steals Various Sensitive Data

Website

Latest articles

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from Promokit.eu for...

Beware Of Illegal OTT Platforms That Exposes Sensitive Personal Information

A recent rise in data breaches from illegal Chinese OTT platforms exposes that user...

Beware Of Zergeca Botnet with Advanced Scanning & Persistence Features

A new botnet named Zergeca has emerged, showcasing advanced capabilities that set it apart...

Mailcow Mail Server Vulnerability Let Attackers Execute Remote Code

Two critical vulnerabilities (CVE-2024-31204 and CVE-2024-30270) affecting Mailcow versions before 2024-04 allow attackers to...

Hackers Attacking Vaults, Buckets, And Secrets To Steal Data

Hackers target vaults, buckets, and secrets to access some of the most classified and...

Hackers Weaponizing Windows Shortcut Files for Phishing

LNK files, a shortcut file type in Windows OS, provide easy access to programs,...

New Highly Evasive SquidLoader Attacking Employees Mimic As Word Document

Researchers discovered a new malware loader named SquidLoader targeting Chinese organizations, which arrives as...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles