Future

2024

United

Bitcoin

Security

The North Korean Lazarus Group of hackers used a fake blockchain-based game to exploit a zero-day vulnerability in Google’s Chrome browser and install spyware that stole wallet credentials. Kaspersky Labs analysts noticed the exploit in May and reported it to Google, which has fixed it.
<h2 id="play-at-a-big-risk">Play at a big risk</h2>
The hacker’s play-to-earn multiplayer online battle arena game was fully playable and had been promoted on LinkedIn and X. The game was called DeTankZone or DeTankWar and used non-fungible tokens (NFTs) as tanks in a worldwide competition. 
Users were infected from the website, even if they did not download the game. The hackers modeled the game on the existing DeFiTankLand.
The hackers&nbsp;<a data-ct-non-breakable="null" href="https://securelist.com/lazarus-apt-steals-crypto-with-a-tank-game/114282/" rel="null" target="null" text="null" title="null">used</a>&nbsp;malware called Manuscrypt followed by a previously unknown “type confusion bug in the V8 JavaScript engine.” It was the seventh zero-day vulnerability found in Chrome in 2024 through mid-May. 
Kaspersky principal security expert Boris Larin said:
<blockquote>
 “The significant effort invested in this campaign suggests they had ambitious plans, and the actual impact could be much broader, potentially affecting users and businesses worldwide.”
</blockquote>
The fake game was&nbsp;<a data-ct-non-breakable="null" href="https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/" rel="null" target="null" text="null" title="null">noticed</a>&nbsp;by Microsoft Security in February, though the hackers removed the exploit from the website before Kaspersky could analyze it. The lab informed Google of it anyway and Google fixed the vulnerability in Chrome before the hackers could use it again.
<figure>
 <img alt="Lazarus Group exploited Chrome vulnerability with fake NFT game" src="https://s3.cointelegraph.com/uploads/2024-10/0192bb3f-131a-792a-b1fd-63dee90f8b3b" title="">
 <figcaption style="text-align: center;">
 Screenshot from Lazarus Group’s fake game. Source: <a data-ct-non-breakable="null" href="https://securelist.com/lazarus-apt-steals-crypto-with-a-tank-game/114282/" rel="nofollow noopener" target="_blank" text="null" title="https://securelist.com/lazarus-apt-steals-crypto-with-a-tank-game/114282/">SecureList</a>
 </figcaption>
</figure>
Related:&nbsp;<a data-ct-non-breakable="null" href="https://cointelegraph.com/news/bitcoin-crypto-fbi-flags-6-bitcoin-wallets-linked-to-north-korea" rel="null" target="null" text="null" title="null">FBI flags 6 Bitcoin wallets linked to North Korea, urges vigilance in crypto firms</a>
<h3 id="north-korea-loves-crypto">North Korea loves crypto</h3>
Zero-day vulnerabilities take the vendor by surprise and there is no ready patch for them. It took Google 12 days to patch the vulnerability in question. 
Another North Korean hacker group harnessed a different zero-day vulnerability in Chrome to target crypto holders earlier this year.
<figure>
 <img alt="Lazarus Group exploited Chrome vulnerability with fake NFT game" src="https://s3.cointelegraph.com/uploads/2024-10/0192bb42-2432-7801-aef8-28cf44facc51" title="">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/MsftSecIntel/status/1795486443428630894" rel="nofollow noopener" target="_blank" text="null" title="https://x.com/MsftSecIntel/status/1795486443428630894">Microsoft Threat Intelligence</a>
 </figcaption>
</figure>
Lazarus Group is fond of crypto. Between 2020 and 2023, it&nbsp;<a data-ct-non-breakable="null" href="https://cointelegraph.com/news/lazarus-group-laundered-200m-crypto-since-2020" rel="null" target="null" text="null" title="null">laundered over $200 million</a>&nbsp;in crypto from 25 hacks, according to crypto crime watcher ZachXBT. 
The United States Treasury Department also alleged Lazarus Group&nbsp;<a data-ct-non-breakable="null" href="https://cointelegraph.com/news/north-korean-lazarus-group-allegedly-behind-ronin-bridge-hack" rel="null" target="null" text="null" title="null">to be behind the attack on</a>&nbsp;Ronin Bridge that netted crypto worth over $600 million in 2022.&nbsp;
US cybersecurity firm Recorded Future found that North Korean hackers as a whole&nbsp;<a data-ct-non-breakable="null" href="https://cointelegraph.com/news/north-korean-hackers-stolen-crypto" rel="null" target="null" text="null" title="null">stole over $3 billion in crypto</a>&nbsp;between 2017 and 2023.
Magazine:&nbsp;<a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/north-korean-hackers-private-keys-flash-loan-attacks/" rel="null" target="null" text="null" title="null">Lazarus Group’s favorite exploit revealed — Crypto hacks analysis</a>
&nbsp;

Lazarus Group exploited Chrome vulnerability with fake NFT game

Table of Contents

Cointelegraph

Other articles published on Oct 23, 2024

Sui Foundation Denies Insider Trading Allegations Amid $400M Token Sale Claims

Why Are Sweepstakes Casinos Popular Despite Numerous Real-Money iGaming Sites?

Dreaming About New Tesla? These Altcoins Could Get You To Your Dream in the Upcoming Bull Market

TON Clicker Game COINFISH Launches on Oct 23, Telegram Channel Reaches 130K Users

Why These 3 Cryptos are Exploding in Value Amid Uptober Rally Hopes

Expert Warns of Potential ONDO Price Drop: Here’s the Outlook

Join our free newsletter for daily crypto updates!