SnatchCrypto campaign carried out by North Korean APT 38 subsidiary BlueNoroff

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. BlueNoroff, an advanced persistent threat (APT) group that's part of the larger Lazarus Group associated with North Korea, is behind a series of attacks against small and medium-sized companies that have led to serious cryptocurrency losses. The campaign, dubbed SnatchCrypto, is aimed at various companies that, by the nature of their work, deal with cryptocurrencies and smart contracts, DeFi, Blockchain, and the FinTech industry. An elaborate social engineering attack is carried out by Attackers. Actors send these startup employees a full-featured phishing email having Windows backdoor with surveillance functions, disguised as a contract or another business file. If the file is opened on a device connected to the Internet, another macro-enabled document would be obtained to deploy malware. The malware is exploiting the vulnerability CVE-2017-0199 which initially allowed automatic execution of a remote script linked to a weaponized document. This malware sends the target's general information and PowerShell agent to the attackers, creating a backdoor. From there, BlueNoroff deploys additional tools, including a keylogger and screenshot taker, to monitor victims. After weeks or months of tracking, the attackers find a prominent target and use the data they've collected to steal large amounts of cryptocurrency from them. The TTPs used by BlueNoroff include: T1192 - Spear phishing Link T1059.005 - Visual Basic T1059.001 - PowerShell T1055.001 - Dynamic-link Library Injection T1056.001 - Keylogging T1113 - Screen Capture T1132 - Data Encoding T1027 - Obfuscated Files or Information T1119 - Automated Collection T1176 - Browser Extensions Actor Details Vulnerability Details Indicators of Compromise (IoCs) Patch Link https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199 References The BlueNoroff cryptocurrency hunt is still on - AlienVault - Open Threat Exchange https://usa.kaspersky.com/about/press-releases/2022_bluenoroff-threat-actor-drains-cryptocurrency-startups-accounts https://www.darkreading.com/attacks-breaches/bluenoroff-threat-group-targets-cryptocurrency-startups