Lazarus Group, North Korea’s state-sponsored hacker, has taken the identity of investment and financial companies to steal crypto assets.
According to security firm Kaspersky, BlueNorOff has been creating fake domains that look like they belong to legitimate banks and venture capital firms, according to Kaspersky.
“The actor often used fake domains like cloud hosting services to host malicious files or payloads. “
BlueNorOff’s interest is in Japanese financial entities, suggesting that hackers are attempting to imitate Japanese firms such as ANOBAKA and Angel Bridge, ABF Capitals, Sumitomo Mitsui Banking Corporations, Mitsubishi UFJ Financial Group, Z Venture, and Beyond Next Ventures.
“Most companies are Japanese companies which suggest that the actor is interested in Japanese markets. “
According to cybersecurity firm BlueNorOff’s victim appears to be a home-finance company based in the United Arab Emirates (UAE). Kaspersky said that the infection was caused by malware with a Japanese name. This indicates that the target is able to read Japanese.
Based upon the domain names and decoy documents we believe, with low confidence, that the entities in Japan have been identified by this group. One PowerPoint sample showed that the actor had taken advantage of a Japanese venture capital company.