Slow Fog Cosine: Confirmed that the CEX theft incident was attacked by North Korean hacker Lazarus Group, their attack method has been revealed
The founder of SlowMist, Yu Cosine, posted on social media stating that through evidence analysis and associated tracking, we have confirmed that the attacker in the CEX theft incident is indeed the North Korean hacker organization Lazarus Group. This is a state-level APT attack targeting cryptocurrency trading platforms. We decided to share related IOCs (Indicators of Compromise), which include some cloud service providers and proxies whose IPs were exploited. It should be noted that this disclosure does not specify which platform or platforms are involved, nor does it mention CEX specifically; if there are similarities, it's not impossible.
The attackers used pyyaml for RCE (Remote Code Execution) to deliver malicious code and thus control target computers and servers. This method bypasses most antivirus software scans. After synchronizing intelligence with partners, multiple similar malicious samples were obtained. The main goal of the attackers is to gain control over wallets by invading the infrastructure of cryptocurrency trading platforms and then illegally transferring large amounts of encrypted assets from these wallets.
SlowMist published a summary article revealing Lazarus Group's attack methods and analyzed their use of tactics such as social engineering, vulnerability exploitation, privilege escalation, internal network penetration and fund transfer etc.. At the same time based on actual cases they summarized defensive suggestions against APT attacks hoping to provide references for industry helping more organizations enhance security protection capabilities reducing potential threat impacts.
Disclaimer: The content of this article solely reflects the author's opinion and does not represent the platform in any capacity. This article is not intended to serve as a reference for making investment decisions.
You may also like
US to lend $4.2 billion to Vistra to boost nuclear power output, source says
Saudi Arabia and UAE plan to cooperate with Asia to strengthen oil reserves
According to Nikkei News, Saudi Arabia and the United Arab Emirates will help Asia build up its oil reserves. Despite being dependent on imports, the region has not maintained adequate supplies. Led by Japan, the Asian Zero Emission Community, comprising 11 countries, will hold a ministerial meeting in the Philippines this Thursday. Senior government officials from Saudi Arabia and the UAE will participate in special consultations and are expected to express their intention to cooperate on oil reserves. On October 11, the International Energy Forum will be held in Saudi Arabia. This forum serves as a ministerial-level dialogue between oil-producing and importing countries. Japan is expected to participate and share a cooperation framework with Asia. The outcomes of the Asian Zero Emission Community meeting will be compiled into a joint statement, which will serve as the basis for discussions between member states and Middle Eastern oil-producing countries on strengthening oil reserves. Bilateral talks will follow to finalize the details and scale of such efforts. It is expected that Saudi Arabia and the UAE will expand exports to target countries and prioritize supply in emergencies.
Saudi Arabia and the UAE plan to expand their crude oil reserves in Asia
Market dynamics indicate that Saudi Arabia and the United Arab Emirates plan to expand their crude oil reserves in Asia. This move reflects the continued optimism of these two major oil-producing countries regarding the potential demand in the Asian energy market, and it will further strengthen the stability of oil supply in the region, thereby contributing to the improvement of the regional energy security system.
Four attacks occurred in the Strait of Hormuz from October 1 to 4
The UK Maritime Trade Operations office announced on Sunday that four attacks occurred in the Strait of Hormuz between October 1 and 4. All incidents took place on the Omani side of the strait, with each vessel hit by unidentified projectiles. The Strait of Hormuz, as one of the world's most vital oil transit routes, handles nearly one-third of the world's seaborne crude oil trade. Attacks in this area often have a direct impact on the stability of international energy markets. So far, no party has claimed responsibility for these attacks, and the subsequent developments remain to be observed.
Crypto prices
More
