SnatchCrypto campaign carried out by North Korean APT 38 subsidiary BlueNoroff

Threat Advisories

SnatchCrypto campaign carried out by North Korean APT 38 subsidiary BlueNoroff


For a detailed advisory, download the pdf file here.

BlueNoroff, an advanced persistent threat (APT) group that’s part of the larger Lazarus Group associated with North Korea, is behind a series of attacks against small and medium-sized companies that have led to serious cryptocurrency losses.

The campaign, dubbed SnatchCrypto, is aimed at various companies that, by the nature of their work, deal with cryptocurrencies and smart contracts, DeFi, Blockchain, and the FinTech industry. An elaborate social engineering attack is carried out by Attackers. Actors send these startup employees a full-featured phishing email having Windows backdoor with surveillance functions, disguised as a contract or another business file. If the file is opened on a device connected to the Internet, another macro-enabled document would be obtained to deploy malware.

The malware is exploiting the vulnerability CVE-2017-0199 which initially allowed automatic execution of a remote script linked to a weaponized document. This malware sends the target’s general information and PowerShell agent to the attackers, creating a backdoor. From there, BlueNoroff deploys additional tools, including a keylogger and screenshot taker, to monitor victims. After weeks or months of tracking, the attackers find a prominent target and use the data they’ve collected to steal large amounts of cryptocurrency from them.

The TTPs used by BlueNoroff include:

  • T1192 – Spear phishing Link
  • T1059.005 – Visual Basic
  • T1059.001 – PowerShell
  • T1055.001 – Dynamic-link Library Injection
  • T1056.001 – Keylogging
  • T1113 – Screen Capture
  • T1132 – Data Encoding
  • T1027 – Obfuscated Files or Information
  • T1119 – Automated Collection
  • T1176 – Browser Extensions

Actor Details

Vulnerability Details

Indicators of Compromise (IoCs)


Patch Link


The BlueNoroff cryptocurrency hunt is still on – AlienVault – Open Threat Exchange