Ankura CTIX FLASH Update - November 3, 2023

Malware Activity

North Korean State Sponsored Threat Actors Target Blockchain Engineer Computers with KANDYKORN Malware

In what appears to be a continuation of the North Korean strategy to finance the nation using international organized crime rings, cybersecurity researchers established a link between a new malware targeting blockchain engineers and the North Korean state sponsored Lazarus group. Researchers noted that the new malware, which is being used to target the Apple devices of blockchain engineers, shares tactics, techniques, and procedures (TTPs) with the Lazarus group. Researchers stated that these engineers were targeted likely in order to steal cryptocurrency to finance the state's operations and avoid sanctions. Initial access to the systems was achieved through the use of a Python application that was sent to victims through a Discord server used by blockchain engineers. The Python application was supposedly to be used as a cryptocurrency bot that