Security News > 2021 > April > North Korean hackers adapt web skimming for stealing Bitcoin
Hackers linked with the North Korean government applied the web skimming technique to steal cryptocurrency in a previously undocumented campaign that started early last year, researchers say.
The attacks compromised customers of at least three online stores and relied on infrastructure used for web skimming activities and attributed in the past to Lazarus APT, also known as Hidden Cobra.
An investigation from researchers at Group-IB cybersecurity company that started from Sansec's discovery revealed that the North Korean hackers in 2020 also attacked online shops that accepted payments in cryptocurrency.
According to the research, the attackers started using the modified script in late February 2020 and used the same infrastructure that served previous web skimming activity.
Looking closer at the code, Group-IB found that it had been saved discovered another hint pointing to a Korean actor: the Korean text for Greenwich Mean Time in a comment created by SingleFiles when saving a web page, suggesting the use of a system with Korean locale.
Based on the evidence revealed through Sansec research and its own, Group-IB attributes these attacks to the North Korean group of hackers with a high level of confidence.
News URL
Related news
- North Korean govt hackers linked to Play ransomware attack (source)
- North Korean hackers pave the way for Play ransomware (source)
- North Korean hackers employ new tactics to compromise crypto-related businesses (source)
- North Korean Hackers Target Crypto Firms with Hidden Risk Malware on macOS (source)
- North Korean hackers use new macOS malware against crypto firms (source)
- North Korean Hackers Target macOS Using Flutter-Embedded Malware (source)
- North Korean hackers create Flutter apps to bypass macOS security (source)
- Bitfinex Hacker Sentenced to 5 Years, Guilty of Laundering $10.5 Billion in Bitcoin (source)
- Bitfinex hacker gets 5 years in prison for 120,000 bitcoin heist (source)
- North Korean Hackers Steal $10M with AI-Driven Scams and Malware on LinkedIn (source)