Apple

Google Cloud’s threat intelligence department has discovered that North Korean government-backed cyber attackers are actively targeting Brazil’s cryptocurrency exchanges and fintech companies.
The June 13 Google threat intelligence report highlighted coordinated attempts to hijack, extort and defraud Brazilian individuals and organizations. 
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-06/5b3778b1-80c8-45fe-9f06-7bd6a1cbd591.png" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/Mandiant/status/1800890800286433298" target="_blank" rel="noopener nofollow">Mandiant (part of Google Cloud)</a>
 </figcaption>
</figure>
While North Korean groups focus primarily on cryptocurrency firms, aerospace and defense and government entities, cyber criminals backed by the Chinese government prefer attacking only the government organizations and the energy sector in Brazil.
<h2 data-ct-non-breakable="true" id="the-plot-behind-cyberattacks-in-brazil">The plot behind cyberattacks in Brazil</h2>
The notorious North Korean cybercriminal group Pukchong (also known as UNC4899) has targeted Brazilian citizens and organizations through the job market. They tricked unsuspecting job seekers into downloading malware onto their systems. According to the report:
<blockquote data-ct-non-breakable="true">
 “The project was a trojanized Python app for retrieving cryptocurrency prices that was modified to reach out to an attacker-controlled domain to retrieve a second stage payload if specific conditions were met.”
</blockquote>
Similar malware attacks perpetrated by GoPix and URSA were also found actively targeting Brazilian crypto firms.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-06/61a306f5-17b6-4545-849c-46dad097946f.jpg" alt="" title="">
 <figcaption style="text-align: center;">
 Government-backed phishing attacks targeting Brazil. Source: Google Cloud
 </figcaption>
</figure>
Check out Cointelegraph’s guide to l<a href="https://cointelegraph.com/news/what-is-crypto-malware-and-how-to-detect-it">earn more about crypto malware</a> and how to detect it.
Related: <a href="https://cointelegraph.com/news/sec-fines-nyse-parent-company-failing-report-cyberattack">SEC fines NYSE parent company $10M for failing to report cyberattack</a>
<h2 data-ct-non-breakable="true" id="attacks-beyond-borders">Attacks beyond borders</h2>
Recently, crypto wallet provider <a href="https://cointelegraph.com/news/apple-ios-imessage-zero-day-crypto-exploit-warning-trust-wallet">Trust Wallet asked Apple users to disable iMessage</a>, citing “credible intel” of a zero-day exploit that could allow hackers to take control of users’ phones.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-06/a36539ae-e638-407f-872e-6a1b5c934a7e.png" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/TrustWallet/status/1779961167537979775" target="_blank" rel="noopener nofollow">Trust Wallet</a>
 </figcaption>
</figure>
A zero-day exploit is a cyberattack vector that takes advantage of an unknown or unaddressed security flaw in computer software, hardware or firmware.
Cybersecurity firm Kaspersky recently uncovered that North Korean hacking group Kimsuky reportedly utilized a “striking” new malware variant dubbed “Durian” to launch attacks on South Korean crypto firms.
<figure data-ct-non-breakable="true">
 <img src="https://s3.cointelegraph.com/uploads/2024-06/c73c4001-9f0e-4e6c-86bf-987364b33981.png" alt="" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://twitter.com/kaspersky/status/1788614943018827969" target="_blank" rel="noopener nofollow">Kaspersky</a>
 </figcaption>
</figure>
“Durian boasts comprehensive backdoor functionality, enabling the execution of delivered commands, additional file downloads, and exfiltration of files,” wrote Kaspersky.
Additionally, Kaspersky noted that LazyLoad was also used by Andariel, a sub-group within fellow North Korean hacking consortium Lazarus Group — suggesting a “tenuous” connection between Kimsuky and the more notorious hacking group.
Magazine: <a href="https://cointelegraph.com/magazine/north-korean-hackers-private-keys-flash-loan-attacks/">Lazarus Group’s favorite exploit revealed — Crypto hacks analysis</a>

North Korean cyberattacks on Brazilian fintech firms exposed

Table of Contents

Cointelegraph

Other articles published on Jun 13, 2024

Paradigm Third Fund Hits $850M As The Most Recognized VCs

Altcoins Show Resilience Against Bitcoin’s Decline

Petoshi to Debut on Gate.io with Initial Free Offering

Binance Partners with Macao Law Enforcement to Combat Crypto Crime

MicroStrategy Plans $500M Convertible Notes Offering for Bitcoin Investment

Doge is finally coming to Bitcoin: Satoshi and Elon have agreed, BitDoge is here

Join our free newsletter for daily crypto updates!