SnatchCrypto campaign carried out by North Korean APT 38 subsidiary BlueNoroff

For a detailed advisory, download the pdf file here.

BlueNoroff, an advanced persistent threat (APT) group that’s part of the larger Lazarus Group associated with North Korea, is behind a series of attacks against small and medium-sized companies that have led to serious cryptocurrency losses.

The campaign, dubbed SnatchCrypto, is aimed at various companies that, by the nature of their work, deal with cryptocurrencies and smart contracts, DeFi, Blockchain, and the FinTech industry. An elaborate social engineering attack is carried out by Attackers. Actors send these startup employees a full-featured phishing email having Windows backdoor with surveillance functions, disguised as a contract or another business file. If the file is opened on a device connected to the Internet, another macro-enabled document would be obtained to deploy malware.

The malware is exploiting the vulnerability CVE-2017-0199 which initially allowed automatic execution of a remote script linked to a weaponized document. This malware sends the target’s general information and PowerShell agent to the attackers, creating a backdoor. From there, BlueNoroff deploys additional tools, including a keylogger and screenshot taker, to monitor victims. After weeks or months of tracking, the attackers find a prominent target and use the data they’ve collected to steal large amounts of cryptocurrency from them.

The TTPs used by BlueNoroff include:

T1192 – Spear phishing LinkT1059.005 – Visual BasicT1059.001 – PowerShellT1055.001 – Dynamic-link Library InjectionT1056.001 – KeyloggingT1113 – Screen CaptureT1132 – Data EncodingT1027 – Obfuscated Files or InformationT1119 – Automated CollectionT1176 – Browser Extensions

Actor Details

Vulnerability Details

Indicators of Compromise (IoCs)

Patch Link

https://msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199

References

The BlueNoroff cryptocurrency hunt is still on – AlienVault – Open Threat Exchange

https://usa.kaspersky.com/about/press-releases/2022_bluenoroff-threat-actor-drains-cryptocurrency-startups-accounts

https://www.darkreading.com/attacks-breaches/bluenoroff-threat-group-targets-cryptocurrency-startups