{"id":33010,"date":"2022-03-31T15:22:56","date_gmt":"2022-03-31T12:22:56","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=33010"},"modified":"2026-03-28T00:42:23","modified_gmt":"2026-03-27T21:42:23","slug":"lazarus-distributes-trojanized-defi-app-to-steal-cryptocurrency","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/lazarus-distributes-trojanized-defi-app-to-steal-cryptocurrency\/","title":{"rendered":"Lazarus distributes Trojanized DeFi app to steal cryptocurrency"},"content":{"rendered":"\n

The advanced and persistent actor, Lazarus \u2013 infamous for its growing financial motivations, has hit cryptocurrency businesses with new, Trojanized decentralized finance (DeFi) apps in order to increase profit. Lazarus abuses legitimate applications used to manage cryptocurrency wallets by distributing malware that provides control over victims\u2019 systems.<\/strong><\/p>\n\n\n\n

The Lazarus group is one of the world\u2019s most active APT actors, operating since at least 2009. Unlike most state-sponsored APT groups, Lazarus and other threat actors associated with this APT have made financial gain one of their primary goals. As the cryptocurrency market grows along with the non-fungible token (NFT) and decentralized finance (DeFi) markets, Lazarus has continues to find new ways to target cryptocurrency users.<\/p>\n\n\n\n

In December 2021, Kaspersky researchers uncovered a new malware campaign, using a Trojanized DeFi app delivered by the Lazarus group, against cryptocurrency business. The application contains a legitimate program called DeFi Wallet, which saves and manages cryptocurrency wallets. When executed, the app drops a malicious file alongside the installer for the legitimate application, launching the malware with a Trojanized installer path. This generated malware then overwrites the legitimate application with the Trojanized application.<\/p>\n\n\n\n

The malware used in this infection scheme is a full-featured backdoor with the capability of controlling the victim\u2019s systems remotely. Once in control of the system, the attacker can delete files, gather information, connect to specific IP addresses and communicate with the C2 server. Based on the history of Lazarus\u2019s attacks, researchers assume the motivation behind this campaign is financial gain. After looking into the functionalities of this backdoor, Kaspersky researchers have discovered numerous overlaps with other tools used by the Lazarus group, namely, the CookieTime<\/a> and the ThreatNeedle<\/a> malware clusters. The multistage infection scheme is also heavily used in Lazarus\u2019s infrastructure.<\/p>\n\n\n\n

\u201cWe have observed Lazarus\u2019s interest in the cryptocurrency industry for a while now and have seen that they have developed sophisticated methods for luring their victims in without drawing attention to the infection process. Cryptocurrency and blockchain-based industries continue to evolve and attract higher levels of investment. Therefore, they attract not only scammers and phishers, but also \u2018big game hunters\u2019, including financially motivated APT groups. With the cryptocurrency market growing, we strongly believe Lazarus\u2019s interest in the industry will not diminish any time soon. In a recent campaign, Lazarus abused a legitimate DeFi app by mimicking it and dropping malware, which is a common tactic used in crypto-hunting. That is why we urge companies to remain vigilant about unknown links and email attachments, as they may well be fraudulent, even if they appear familiar and safe,\u201d<\/em> comments Seongsu Park, senior security researcher at Kaspersky\u2019s Global Research and Analysis Team (GReAT).<\/p>\n\n\n\n

Learn more about Lazarus\u2019s new campaign on Securelist.com<\/a>.<\/p>\n\n\n\n

To avoid falling victim to targeted attacks by known or unknown threat actors, Kaspersky researchers recommend implementing the following measures:<\/p>\n\n\n\n