North Korean Hackers Distributing Trojanized DeFi Wallet Apps to Steal Crypto
The app is designed to trigger the launch of the implant that can take control of the infected host. Russian cybersecurity firm Kaspersky said it first encountered the rogue application in mid-December 2021. Kaspersky GReAT researchers highlighted. The infection scheme initiated by the app also results in the deployment of the installer for a legitimate application, which gets overwritten with a trojanized version in an effort to cover its tracks. The spawned malware launches a wallet app built for the DeFiChain, while also establishing connections to a remote attacker-controlled domain and awaiting further instructions from the server. Based on the response received from the command-and-control (C2) server, the trojan proceeds to execute a wide range of commands, granting it the ability to collect system information, enumerate and terminate processes, delete files, launch new processes, and save arbitrary files on the machine. The C2 infrastructure used in this campaign exclusively consisted of previously compromised web servers located in South Korea, prompting the cybersecurity company to work with the country’s computer emergency response team (KrCERT) to dismantle the servers. So beware while using any such app. Check Also: Hackers Pose as Law Enforcement Authorities to Get Access to Apple and Meta’s Data Source: Digital Trend
