{"id":35488,"date":"2022-08-01T13:16:43","date_gmt":"2022-08-01T10:16:43","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=35488"},"modified":"2026-03-28T01:25:50","modified_gmt":"2026-03-27T22:25:50","slug":"naivecopy-kaspersky-discovers-highly-active-apt-campaign-targeting-cryptocurrency-industry","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/naivecopy-kaspersky-discovers-highly-active-apt-campaign-targeting-cryptocurrency-industry\/","title":{"rendered":"NaiveCopy: Kaspersky discovers highly active APT campaign targeting cryptocurrency industry"},"content":{"rendered":"\n
\"david<\/a><\/figure>\n\n\n\n

In the second quarter of 2022, Kaspersky researchers witnessed Advanced Persistent Threat (APT) actors increasingly targeting the cryptocurrency industry. Using cryptocurrency-related content and warnings from law enforcements as bait, the actor behind this new and highly active campaign, dubbed \u201cNaiveCopy\u201d, attacked stock and cryptocurrency investors in South Korea. Further analysis of NaiveCopy\u2019s tactics and techniques revealed another related campaign active the year before which targeted unknown entities in both Mexico and the UK. This, along with other discoveries,\u00a0is revealed in Kaspersky\u2019s latest\u00a0<\/strong>quarterly threat intelligence summary<\/strong><\/a>.<\/strong><\/p>\n\n\n\n

APT actors are continuously changing their tactics, sharpening their toolsets and developing new techniques. To help users and businesses keep up with these changes and stay informed about the potential threats they might face, Kaspersky\u2019s Global Research and Analysis (GReAT) team provides quarterly reports about the most important developments across the advanced persistent threat landscape. The three-month APT trends report<\/a> is created using Kaspersky\u2019s private threat intelligence research and includes major developments and cyber-incidents that researchers believe everyone should be aware of.<\/p>\n\n\n\n

In the second quarter of 2022, Kaspersky researchers discovered a new, highly active campaign that had started in March and targeted stock and cryptocurrency investors. This is unusual, considering most APT actors do not pursue financial gain. The actor used cryptocurrency-related content and complaints from law enforcement as themes to lure its victims. The infection chains involved remote template injection, spawning a malicious macro that starts a multi-stage infection procedure using Dropbox. After beaconing the victim\u2019s host information, the malware attempts to fetch the final stage payload.<\/p>\n\n\n\n

Luckily, Kaspersky experts had a chance to acquire the final stage payload, consisting of several modules used for exfiltrating sensitive information from the victim. By analyzing this payload, Kaspersky researchers found additional samples that had been used a year ago during another campaign against entities in Mexico and UK.<\/p>\n\n\n\n

Kaspersky experts do not see any precise connections to known threat actors, however, they believe that they are familiar with the Korean language and have utilized a similar tactic previously used by the Konni group to steal the login credentials for a renowned Korean portal. The Konni group is a threat actor which has been active since mid-2021, mostly targeting Russian diplomatic entities.<\/p>\n\n\n\n

\u201cOver the course of several quarters, we have seen APT actors turn their attention to the cryptocurrency industry. Using various techniques, the actors seek not only information, but money as well. This is an unusual, but increasing, tendency for the APT landscape. To combat the threats, organizations need to gain visibility across the recent cyberthreat landscape.\u00a0Threat intelligence\u00a0is an essential component that enables reliable and timely anticipation of such attacks,\u201d\u00a0<\/em>comments David\u00a0Emm,\u00a0principal security researcher at Kaspersky\u2019s GReAT.\u00a0<\/p>\n\n\n\n

To read the full APT Q2 2022 trends report, please visit Securelist.com<\/a><\/p>\n\n\n\n

To avoid falling victim to a targeted attack by a known or unknown threat actor, Kaspersky researchers recommend implementing the following measures:<\/p>\n\n\n\n