Cryptocurrency

The North Korean-aligned actor TraderTraitor (UNC4899) stole $6.43 billion from Binance using recruitment-themed social engineering and trojanized Terraform providers to deploy multi-stage cross-platform malware.

Russian-language traffer teams, including AtlasCore, PolyFucked, and Magnetic Team, are operating affiliate-fraud networks that deploy simulated prediction market websites to steal cryptocurrency and sensitive identity information.

OSX.Dummy is a new macOS malware targeting the cryptocurrency community, as reported by Objective-See.

The Lazarus Group is targeting AI models through supply chain attacks, contractor misuse, and fraudulent hiring to improve their ability to steal cryptocurrency and fund weapons programs.

BlueNoroff, a subgroup of the Lazarus Group, is targeting North American Web3 companies through spear-phishing campaigns, impersonating Fintech legal professionals.

NICKEL ALLEY, a North Korean threat group, is targeting technology professionals with fake job opportunities and malicious code repositories to deliver malware like PyLangGhost RAT and BeaverTail, aiming to steal cryptocurrency.

NICKEL ALLEY, a North Korean threat group, is targeting technology professionals with fake job opportunities and malicious code repositories to deliver malware like PyLangGhost RAT and BeaverTail, aiming to steal cryptocurrency.

The 'Calendar 2' application, available on the official Mac App Store, was found to surreptitiously mine cryptocurrency on users' Macs, utilizing the 'xmr-stak' miner to mine Monero (XMR) and report mining operations to calendar.qbix.com.

The Lazarus APT group is distributing a macOS backdoor named AppleJeus via a fake cryptocurrency trading application called JMT Trader, persisting through a launch daemon and communicating with the C&C server beastgoc.com.