Source

United

Ronin

ZachXBT

Security

North Korea’s Lazarus Group created a blockchain game to exploit a vulnerability in Google’s Chrome browser, install spyware and steal crypto wallet credentials, along with other user data.&nbsp; 
In an Oct. 23 <a href="https://securelist.com/lazarus-apt-steals-crypto-with-a-tank-game/114282/" rel="nofollow noopener" target="_blank">report</a>, cybersecurity firm Kaspersky Labs analysts Vasily Berdnikovand and Boris Larin said they found the&nbsp;Lazarus Group exploit in May and reported it to Google, which has since fixed the issue. 
According to Berdnikov and Larin, hackers in the Lazarus Group used the game to coax users to a malicious website and infect computers with its malware Manuscript, which it has been using since at least 2013. 
The code allowed the hackers to corrupt Chrome’s memory, eventually giving them access to users’ cookies, authentication tokens, saved passwords, and browsing history—everything they needed to steal user funds. 
<figure id="attachment_604769" aria-describedby="caption-attachment-604769" style="width: 100%" class="wp-caption alignnone">
 <img loading="lazy" decoding="async" class="wp-image-604769 size-large" src="https://www.cryptopolitan.com/wp-content/uploads/2024/10/Lazarus_APT_for_SAS_02-1200x675.png" alt="" width="1200" height="675" srcset="https://www.cryptopolitan.com/wp-content/uploads/2024/10/Lazarus_APT_for_SAS_02-1200x675.png 1200w, https://www.cryptopolitan.com/wp-content/uploads/2024/10/Lazarus_APT_for_SAS_02-300x169.png 300w, https://www.cryptopolitan.com/wp-content/uploads/2024/10/Lazarus_APT_for_SAS_02-768x432.png 768w, https://www.cryptopolitan.com/wp-content/uploads/2024/10/Lazarus_APT_for_SAS_02-1536x864.png 1536w, https://www.cryptopolitan.com/wp-content/uploads/2024/10/Lazarus_APT_for_SAS_02.png 1920w" sizes="(max-width: 1200px) 100vw, 1200px">
 <figcaption id="caption-attachment-604769" class="wp-caption-text">
 Kaspersky Labs discovered the Lazarus Group plot back in May and promptly reported it to Google. Source: Kaspersky Labs
 </figcaption>
</figure> 
Another issue with the Javascript security mechanism V8 sandbox allowed Lazarus to access PCs to investigate whether continuing a cyber attack was worthwhile. 
“We were able to extract the first stage of the attack — an exploit that performs remote code execution in the Google Chrome process,” &nbsp;Berdnikov and&nbsp;Larin said. 
“After confirming that the exploit was based on a zero-day vulnerability targeting the latest version of Google Chrome, we reported our findings to Google the same day.” 
Two days after Google became aware of the exploit, it released an updated patch to solve the issue. 
<h2 id="stolen-source-code-used-to-create-game">Stolen source code used to create game</h2> 
The game itself, DeTankZone or DeTankWar, was a fully playable play-to-earn multiplayer online battle arena game with non-fungible tokens (NFT) tanks. Players could battle each other in online competition. 
Berdnikov and&nbsp;Larin said Lazarus stole the source code from another legitimate game and promoted the pirated version heavily on social media. 
The fake game had a website and promotional images generated using artificial intelligence. 
<figure id="attachment_604770" aria-describedby="caption-attachment-604770" style="width: 100%" class="wp-caption alignnone">
 <img loading="lazy" decoding="async" class="wp-image-604770 size-large" src="https://www.cryptopolitan.com/wp-content/uploads/2024/10/Lazarus_APT_for_SAS_09-1200x635.png" alt="" width="1200" height="635" srcset="https://www.cryptopolitan.com/wp-content/uploads/2024/10/Lazarus_APT_for_SAS_09-1200x635.png 1200w, https://www.cryptopolitan.com/wp-content/uploads/2024/10/Lazarus_APT_for_SAS_09-300x159.png 300w, https://www.cryptopolitan.com/wp-content/uploads/2024/10/Lazarus_APT_for_SAS_09-768x406.png 768w, https://www.cryptopolitan.com/wp-content/uploads/2024/10/Lazarus_APT_for_SAS_09.png 1315w" sizes="(max-width: 1200px) 100vw, 1200px">
 <figcaption id="caption-attachment-604770" class="wp-caption-text">
 The Lazarus Group stole the source code of a legitimate game to help coax users to the website with the malware. Source Kaspersky Labs
 </figcaption>
</figure> 
“On the surface, this website resembled a professionally designed product page for a decentralized finance (DeFi) NFT-based (non-fungible token) multiplayer online battle arena (MOBA) tank game, inviting users to download a trial version,” &nbsp;Berdnikov and&nbsp;Larin said. 
“But that was just a disguise. Under the hood, this website had a hidden script that ran in the user’s Google Chrome browser, launching a zero-day exploit and giving the attackers complete control over the victim’s PC.” 
Microsoft Security also flagged the game in a May <a href="https://x.com/MsftSecIntel/status/1795486443428630894" rel="nofollow" target="_blank">post</a> on X, noting that the malicious game DeTankWar was delivering new custom ransomware that Microsoft dubbed FakePenny. 
“Microsoft has identified a new North Korean threat actor, Moonstone Sleet (Storm-1789), that combines many tried-and-true techniques used by other North Korean threat actors with unique attack methodologies for financial and cyberespionage objectives,” Microsoft Security said. 
“Moonstone Sleet is observed to set up fake companies and job opportunities to engage with potential targets, employ trojanized versions of legitimate tools, create a malicious game called DeTankWar, and deliver a new custom ransomware that Microsoft has named FakePenny.” 
<h2 id="losses-to-lazarus-group-estimated-to-be-over-3-billion">Losses to Lazarus Group estimated to be over $3 billion</h2> 
Lazarus has become arguably the most notorious crypto hacker group since coming onto the scene in 2009. United States cybersecurity firm Recorded Future <a href="https://x.com/RecordedFuture/status/1730217724091982058" rel="nofollow" target="_blank">estimated</a> in 2023 that North Korean hackers stole over $3 billion in crypto in the six years leading up to 2023. 
A United Nations report also found North Korean hackers stole a significant amount of crypto assets in 2022, with estimates between $630 million and more than $1 billion, after groups started targeting networks of foreign aerospace and defense companies. 
Blockchain detective ZachXBT <a href="https://x.com/zachxbt/status/1784935501935390930" rel="nofollow" target="_blank">estimates</a> Lazarus laundered over $200 million in crypto from 25 hacks between 2020 and 2023. In an Aug. 15&nbsp;<a href="https://x.com/zachxbt/status/1824047425822310580" target="_blank" rel="noopener nofollow">post</a> on X, he also claimed to have uncovered evidence of a sophisticated network of North Korean developers earning $500,000 a month working for “established” crypto projects. 
At the same time, the US Treasury Department has also accused Lazarus of being the main culprit behind the 2022 attack on Ronin Bridge, which netted the hackers over $600 million in crypto.

North Korean Lazarus Group created NFT game to exploit Chrome users

Table of Contents

Cryptopolitan_News

Other articles published on Oct 24, 2024

Uniswap (UNI) Approaches Key Resistance, While Celestia (TIA) Prepares for a Potential Breakout

GraFun Partners with Floki and DWF Labs to Support Emerging Memecoins

Qubetics’ 1465% ROI Opportunity Amid Solana’s and Polkadot’s Recent Market Developments

Ripple and IBM Enhance Garanti BBVA Kripto’s Secure Crypto Trading Platform

‘DeFi Days’ launched by RARI Chain and Arbitrum with $80k rewards

Ecrox Chain: Pioneering the Fusion of Real-World Assets and the Metaverse

Join our free newsletter for daily crypto updates!