##
Hot Topic Overview
Overview
The Lazarus Group, a North Korean hacking group, is targeting Web3 and cryptocurrency developers in a campaign dubbed “Operation 99.” The attackers masquerade as recruiters, luring developers through platforms like LinkedIn to participate in seemingly legitimate project testing and code reviews. They then trick developers into cloning GitLab repositories containing malicious code, implanting modular malware into the victims’ systems. These malicious programs can steal valuable data like passwords, API keys, cryptocurrency wallet information, and maintain connections through highly obfuscated command and control (C2) servers to maximize their stealth. SlowMist CISO 23pds has issued a warning, advising developers to be vigilant, cautious of recruitment offers from strangers, and wary of code review requests.
Ace Hot Topic Analysis
Analysis
The Lazarus Group, a North Korean hacking group, launched a cyberattack dubbed "Operation 99" targeting Web3 and cryptocurrency software developers. The attackers posed as recruiters, posting fake job openings on platforms like LinkedIn, to lure developers into participating in seemingly legitimate project testing and code reviews. Once a victim is hooked, they are directed to clone a GitLab repository containing malicious code, disguised as harmless. This code will then be embedded into the victim's environment, allowing the attackers to control the victim's computer. The malware is designed to be cross-platform compatible, stealing high-value data such as passwords, API keys, cryptocurrency wallet information, and maintaining a connection through highly obfuscated command and control (C2) servers to maximize stealth.