SnatchCrypto campaign carried out by North Korean APT 38 subsidiary BlueNoroff

THREAT LEVEL: Red.

For a detailed advisory, download the pdf file here.

BlueNoroff, an advanced persistent threat (APT) group that’s part of the larger Lazarus Group associated with North Korea, is behind a series of attacks against small and medium-sized companies that have led to serious cryptocurrency losses.

The campaign, dubbed SnatchCrypto, is aimed at various companies that, by the nature of their work, deal with cryptocurrencies and smart contracts, DeFi, Blockchain, and the FinTech industry. An elaborate social engineering attack is carried out by Attackers. Actors send these startup employees a full-featured phishing email having Windows backdoor with surveillance functions, disguised as a contract or another business file. If the file is opened on a device connected to the Internet, another macro-enabled document would be obtained to deploy malware.

The malware is exploiting the vulnerability CVE-2017-0199 which initially allowed automatic execution of a remote script linked to a weaponized document. This malware sends the target’s general information and PowerShell agent to the attackers, creating a backdoor. From there, BlueNoroff deploys additional tools, including a keylogger and screenshot taker, to monitor victims. After weeks or months of tracking, the attackers find a prominent target and use the data they’ve collected to steal large amounts of cryptocurrency from them.

The TTPs used by BlueNoroff include: