{"id":81174,"date":"2024-06-13T07:20:54","date_gmt":"2024-06-13T11:20:54","guid":{"rendered":"https:\/\/coinscreed.com\/staging\/?p=81174"},"modified":"2024-06-13T07:20:57","modified_gmt":"2024-06-13T11:20:57","slug":"north-korean-cyberattacks-expose-brazilian-fintech-firms","status":"publish","type":"post","link":"https:\/\/coinscreed.com\/staging\/north-korean-cyberattacks-expose-brazilian-fintech-firms\/","title":{"rendered":"North Korean Cyberattacks Expose Brazilian Fintech Firms"},"content":{"rendered":"\n

Google Cloud's threat intelligence reveals North Korean-backed cyber attackers targeting Brazil's cryptocurrency exchanges<\/a> and fintech firms for hijacking, extortion, and fraud.<\/p>\n\n\n\n

The threat intelligence department of Google Cloud has identified that cyber assailants affiliated with the North Korean government are currently conducting an active campaign against Brazil's fintech companies and cryptocurrency exchanges.<\/p>\n\n\n\n

The coordinated endeavors to commandeer, extort, and defraud Brazilian individuals and organizations were emphasized in the June 13 Google threat intelligence report.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Although North Korean groups concentrate on cryptocurrency firms, aerospace and defense, and government entities, cyber criminals who are supported by the Chinese government prefer to target only the energy sector and government organizations in Brazil.<\/p>\n\n\n\n

The employment market has been the target of the notorious North Korean cybercriminal group, Pukchong (also known as UNC4899), which has targeted Brazilian citizens and organizations. They deceived job seekers into downloading malware onto their devices. In accordance with the report:<\/p>\n\n\n\n

\n

\u201cThe project was a trojanized Python app for retrieving cryptocurrency prices<\/a> that was modified to reach out to an attacker-controlled domain to retrieve a second stage payload if specific conditions were met.\u201d<\/p>\n<\/blockquote>\n\n\n\n

Similarly, GoPix and URSA were observed to be actively targeting Brazilian crypto firms in malware attacks.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Trust Wallet, a crypto wallet provider, recently requested that Apple users disable iMessage. The company cited “credible intel” of a zero-day exploit that could enable hackers to take control of users' phones.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

A zero-day exploit is a type of cyberattack that exploits an unidentified or unaddressed security vulnerability in computer software<\/a>, hardware, or firmware.<\/p>\n\n\n\n

Kaspersky, a cybersecurity firm, recently discovered that Kimsuky, a North Korean hacking group, employed a “striking” new malware variant known as “Durian” to initiate attacks on South Korean crypto firms.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Kaspersky stated that Durian has a comprehensive backdoor functionality that allows for the implementation of commands, the downloading of additional files, and the exfiltration of files.<\/p>\n\n\n\n

Furthermore, Kaspersky observed that LazyLoad was also employed by Andariel, a sub-group within the Lazarus Group\r\n \r\n \r\n \r\n <\/g>\r\n \r\n \r\n \r\n <\/clipPath>\r\n <\/defs><\/svg><\/span><\/a>, a North Korean hacking consortium, which implies a “tenuous” connection between Kimsuky and the more notorious hacking group.<\/p>\n","protected":false},"excerpt":{"rendered":"

Google Cloud’s threat intelligence reveals North Korean-backed cyber attackers targeting Brazil’s cryptocurrency exchanges and fintech firms for hijacking, extortion, and fraud. The threat intelligence department of Google Cloud has identified that cyber assailants affiliated with the North Korean government are currently conducting an active campaign against Brazil’s fintech companies and cryptocurrency exchanges. The coordinated endeavors […]<\/p>\n","protected":false},"author":36,"featured_media":81187,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[21],"tags":[19979,19978],"class_list":["post-81174","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","tag-brazilian-fintech-firms","tag-north-korean-cyberattacks"],"jetpack_featured_media_url":"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2024\/06\/230324183106-north-korea-crypto-hacker.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/81174","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/users\/36"}],"replies":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/comments?post=81174"}],"version-history":[{"count":0,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/81174\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media\/81187"}],"wp:attachment":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media?parent=81174"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/categories?post=81174"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/tags?post=81174"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}