According to Kaspersky, who analyzed the attacks carried out by the Lazarus over the past 18 months, it is confirmed that the North Korea-linked group primarily targets cryptocurrency transactions.
As security experts discovered in mid-2018, the group targeted cryptocurrency companies and exchanges through a campaign dubbed Operation AppleJeus, which aimed to spread an infected cryptocurrency trading app.
After the launch of Operation AppleJeus, the Lazarus group launched other attacks against cryptocurrency businesses using similar tactics. Researchers found more malware similar to that of Operation AppleJeus.
The three macOS installers analyzed by Kaspersky use a similar script after installation and when executing the second-stage payload. However, researchers also observed a different type of malware , MarkMakingBot.dmg (be37637d8f6c1fbe7f3ffc702afdfe1d), created on 12-03-2019.
The malware lacks an encryption/decryption routine for network communication, suggesting that it is still under development.
Experts pointed out that while the Windows malware used in the campaign had only minor changes, the macOS malware changed drastically.
Recently, Kaspersky detected a new macOS malware that used a malicious application called UnionCryptoTrader. The Windows version of the same malware runs from the Telegram.
Some of the payloads were executed in memory, with the backdoor payload being delivered in the final step of the attack chain.
Kaspersky identified several victims of AppleJeus, most of whom were located in the UK, Poland, Russia, and China, with experts noting that many of them are linked to cryptocurrency business entities.
