In April 2025, Huntabil.IT observed a targeted attack on a Web3 startup, attributing the incident to a DPRK threat actor group. Several reports on social media at the time described similar incidents at other Web3 and Crypto organizations.
Analysis revealed an attack chain consisting of an eclectic mix of scripts and binaries written in AppleScript, C++ and Nim. Although the early stages of the attack follow a familiar DPRK pattern using social engineering, lure scripts and fake updates, the use of Nim-compiled binaries on macOS is a more unusual choice. A report by Huntress in mid-June described a similar initial attack chain as observed by Huntabil.IT, albeit using different later stage payloads.
Read more…
Source: SentinelLABS
Sign up for the Cyber Security Review Newsletter
The latest news and insights delivered right to your inbox.
Related:
- Hackers are scanning computers worldwide for open Bitcoin and Ethereum wallets…
November 27, 2017
Security researcher Didier Stevens setup a trap, or in digital security terms – a “honeypot”. Think of it as digital sting operation, where someone puts a server online open to attack – but nothing of value is really there, it’s only there to record the attacks as they happen. The logs of these honeypots revealed hackers ...
- New Mirai Variant Found Spreading like Wildfire
November 23, 2017
A security researcher reportedly discovered a new variant of Mirai (identified by Trend Micro as ELF_MIRAI family) that is quickly spreading. A notable increase in traffic on port 2323 and 23 was observed over the weekend, with around 100 thousand unique scanner IPs coming from Argentina. The release of the Proof-of-Concept (PoC) exploit code in a public vulnerabilities database was ...
- HP patches severe code execution bug in enterprise printers
November 23, 2017
HP has issued firmware patches to fix a security flaw which allowed attackers to perform remote code execution attacks on enterprise-grade printers. FoxGlove Security researchers issued an advisory disclosing the technical details of the bug, CVE-2017-2750, earlier this week. The team tested out HP’s PageWide Enterprise Color MFP 586 and the HP Color LaserJet Enterprise M553 models, and found they ...
- Google security report finds phishing to be biggest threat
November 14, 2017
In an effort to better understand how users accounts get ‘hijacked,’ Google collaborated with the University of California at Berkeley to investigate how the black markets responsible for obtaining and selling user credentials operate. The study took place from March 2016 to March 2017 and the research focused primarily on tracking several large black markets trading ...
- The nasty future of ransomware: Four ways the nightmare is about to get even worse
October 31, 2017
2017 has been the year of ransomware. While the file-encrypting malware has existed in one form or another for almost three decades, over the last few months it’s developed from a cybersecurity concern to a public menace. The term even made it into the dictionary in September. In particular, 2017 had its own summer of ransomware: while incidents ...
- Hackers Take Aim at SSH Keys in New Attacks
October 19, 2017
SSH private keys are being targeted by hackers who have stepped up their scanning of thousands of servers hosting WordPress websites in search of private keys. Since Monday, security researchers said they have observed a single entity scanning as many as 25,000 systems a day seeking vulnerable SSH keys to be used to compromise websites. “What ...