Lazarus Group’s Crypto Shenanigans: 400 ETH, Malware, and Fake Zoom Calls

by

Oh, joy. North Korea’s favorite cyber troublemakers, the Lazarus Group, are back at it again. 🕵️‍♂️ This time, they’re laundering crypto like it’s a Black Friday sale and deploying malware that’s sneakier than a cat burglar in socks. 🐱‍💻

On Mar. 13, CertiK, the blockchain security firm that’s basically the Sherlock Holmes of crypto, spotted Lazarus moving 400 Ethereum (ETH) – a cool $750,000 – into Tornado Cash. 🌀 Because, of course, why not make your dirty money disappear like a magician’s assistant? The transaction was traced back to their Bitcoin (BTC) shenanigans, because apparently, they’re not picky about their blockchains. 🪙

After their latest hack (a casual $1.4 billion Bybit heist in February, no big deal), they’ve been busy playing hide-and-seek with the stolen funds. 🕵️‍♀️ Their go-to move? Decentralized exchanges like THORChain (RUNE), where you can trade crypto without anyone asking pesky questions like, “Who are you?” or “Is this money stolen?” In just five days, they moved a whopping $2.91 billion through THORChain, making it harder to track than a teenager’s Snapchat streak. 📱

But wait, there’s more! 🎉 Lazarus has also been busy cooking up six new malware packages on the Node Package Manager platform. Because why stop at stealing crypto when you can also ruin developers’ lives? On Mar. 11, security firm Socket exposed the malware, which is designed to steal credentials and crypto wallet data. One of the packages, BeaverTail, is so sneaky it disguises itself as legitimate JavaScript libraries using typosquatting. 🦫 Yes, that’s when hackers slightly misspell trusted software names to trick you into downloading their nonsense. It targets Chrome, Brave, Firefox, Solana, and Exodus wallets, because why not go for the whole buffet? 🍽️

And if that wasn’t enough, they’ve also been pulling the old “fake Zoom call” trick. 🎥 Hackers pose as venture capitalists, send fake meeting links, and claim there’s an audio issue. When you download the “fix,” surprise! It’s malware. 🎁 Several crypto founders have already fallen for this, because apparently, even tech geniuses can’t resist clicking on suspicious links. 🤦‍♂️

According to Chainalysis, North Korean hackers have stolen over $1.3 billion in crypto across 47 attacks in 2024. That’s more than double what they stole in 2023. 🚨 So, if you’re in crypto, maybe double-check that Zoom link and think twice before downloading anything called “BeaverTail.” Just saying. 🦫

Read More

2025-03-13 11:00