A newly identified macOS malware called ‘KandyKorn’ has been discovered in a cyber campaign linked to the North Korean hacking group Lazarus. The targets of this attack are blockchain engineers associated with a cryptocurrency exchange platform.
The attackers are using Discord channels to pose as members of the cryptocurrency community and distribute Python-based modules. These modules initiate a complex KandyKorn infection process.
Elastic Security, the organization that uncovered the attack, has linked it to Lazarus based on similarities with their previous campaigns, including techniques used, network infrastructure, code-signing certificates, and custom detection methods for Lazarus activity.
The attack starts with social engineering on Discord, where victims are tricked into downloading a malicious ZIP archive named ‘Cross-platform Bridges.zip.’ This archive contains a Python script (‘Main.py’) that imports 13 modules, triggering the first payload, ‘Watcher.py.’
Watcher.py downloads and executes another Python script called ‘testSpeed.py’ and a file named ‘FinderTools’ from a Google Drive URL. FinderTools then fetches and runs an obfuscated binary named ‘SugarLoader,’ which appears as both .sld and .log Mach-O executables.
Content was cut in order to protect the source.Please visit the source for the rest of the article.
This article has been indexed from CySecurity News – Latest Information Security and Hacking Incidents
Read the original article: