McAfee uncovers 'aggressive' Bitcoin-stealing phishing campaign by the Lazarus cyber crooks

Dubbed HaoBao, is said to be a 'sophisticated malware with long-term impact'

McAfee's Advanced Threat Research (ATR) analysts have uncovered an "aggressive" Bitcoin-stealing phishing campaign that it believes to be by the notorious Lazarus cyber crooks.

This new campaign, dubbed HaoBao, is said to be a "sophisticated malware with long-term impact", resuming Lazarus' work of phishing emails, posed as employee recruitment.

Advertisement - Article continues below

However, the new malware variant now targets Bitcoin users and global financial organisations, McAfee said, so when victims open malicious documents attached to the emails, the malware scans for Bitcoin activity and then establishes a "dropped implant" for long-term data-gathering.

"HaoBao targets and never-before-seen implants signal to McAfee ATR an ambitious campaign by Lazarus to establish cryptocurrency cybercrime at a sophisticated level," McAfee said.

The Lazarus group targeted individuals in early 2017 with a campaign of spear phishing emails impersonating job recruiters which contained malicious documents. It lasted from April to October and used job descriptions relevant to target organisations, in both English and Korean language, with the ultimate goal of gaining access to the target's environment and obtain key military program insight or steal money.

Security researchers thought that was the end of the Lazarus campaign, and it was. Until 15 January this year, when McAfee ATR discovered a malicious document distributed via a Dropbox account and masquerading as a job recruitment for a Business Development Executive located in Hong Kong for a big multi-national bank.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

McAfee said the discovery was the mark of a new Lazarus campaign, as it utilises techniques, tactics and procedures observed in 2017.

"This document had the last author Windows User' and was created 16 January, 2018 with Korean language resources," the security research team said. "Several additional malicious documents with the same author appeared between January 16 through January 24, 2018."

McAfee ATR analysis also noted that these dropped implants have never been seen before in the wild and have not been used in previous Lazarus campaigns from 2017. The campaign also deploys a one-time data gathering implant that relies upon downloading a second stage to gain persistence, the security experts said.

"The implants contain a hardcoded word "haobao" that is used as a switch when executing from the Visual Basic macro," McAfee added. "This campaign is tailored to identifying those who are running Bitcoin-related software through specific system scans."

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now
Advertisement

Recommended

Visit/security/ransomware/356292/university-of-california-gets-fleeced-by-hackers-for-114-million
ransomware

University of California gets fleeced by hackers for $1.14 million

30 Jun 2020
Visit/security/cyber-security/356289/australia-announces-135b-investment-in-cybersecurity
cyber security

Australia announces $1.35 billion investment in cyber security

30 Jun 2020
Visit/cloud/cloud-security/356288/csa-and-issa-form-cybersecurity-partnership
cloud security

CSA and ISSA form cyber security partnership

30 Jun 2020
Visit/business/policy-legislation/356215/senators-propose-a-bill-aimed-at-ending-warrant-proof-encryption
Policy & legislation

Senators propose a bill aimed at ending warrant-proof encryption

24 Jun 2020

Most Popular

Visit/business-strategy/careers-training/356422/ibm-job-ad-calls-for-12-year-experience-with-6-year-old
Careers & training

IBM job ad calls for 12-years of experience with six-year-old Kubernetes

13 Jul 2020
Visit/business/business-operations/356395/nvidia-overtakes-intel-as-most-valuable-us-chipmaker
Business operations

Nvidia overtakes Intel as most valuable US chipmaker

9 Jul 2020
Visit/security/cyber-attacks/356417/trump-confirms-cyber-attacks-on-russia-election-trolls
cyber attacks

Trump confirms US cyber attack on Russia election trolls

13 Jul 2020