The Largest Cryptocurrency Exchange Got Off Light: They Repelled the North Korean Attack

BitMEX, once one of the largest options trading platforms in the cryptocurrency world, announced that it successfully prevented a social engineering attack by the famous hacker group Lazarus, which has links to North Korea.

The company said in a statement regarding the attack that not only was the attempt unsuccessful, but also that important information was obtained by reverse engineering the mechanism behind the attack.

BitMEX reported that the attack began when one of its employees received a proposal for a Web3 project on LinkedIn with the theme of “NFT Marketplace.” The aim was to infiltrate the system by convincing the employee to run a code containing malware. However, when the employee reviewed the code repository, he noticed suspicious statements and reported the situation to the BitMEX security team.

The technical analysis revealed clues to the Lazarus Group’s tracking methods and operational vulnerabilities. BitMEX revealed that the attackers were attempting to reuse the malicious code called “BeaverTail”, which was previously attributed to Lazarus by Unit 42 of Palo Alto.

The BitMEX team stated that the attack scenario was based on the goal of collecting user IP addresses and passwords and saving them in a database, but the attackers made an operational error and revealed the original IP addresses. In light of this information, special software was created and regular queries were sent to the database, and at least 10 of the test or development accounts used by the attackers were detected.

BitMEX stated that they observed that the Lazarus Group was divided into subgroups with different technical competencies, and pointed out that although the basic phishing methods used in the campaign were weak, the subsequent attack processes were advanced.

This development comes after Coinbase suffered a massive data breach a few weeks ago that could have potentially cost it $400 million.

*This is not investment advice.

Source