##
Hot Topic Overview
Overview
Recently, North Korean hacking group Lazarus Group has launched a cyberattack dubbed "Operation 99" targeting Web3 and cryptocurrency developers. The attackers, posing as recruiters, post fake job listings on platforms like LinkedIn to entice developers into participating in seemingly legitimate project testing and code reviews. Once developers are hooked, they are directed to clone a GitLab repository containing malicious code, which appears harmless but actually implants malware onto the victim's system. These malware are cross-platform compatible and can steal sensitive data such as passwords, API keys, cryptocurrency wallet information, and maintain connection through heavily obfuscated command and control (C2) servers, maximizing their stealth.
Ace Hot Topic Analysis
Analysis
The North Korean hacking group Lazarus Group has launched a cyberattack dubbed "Operation 99" targeting Web3 and cryptocurrency software developers. The attackers are posing as recruiters, posting fake job postings on platforms like LinkedIn, using the lure of project testing and code review to entice developers. Once a victim takes the bait, they are led to clone a seemingly innocuous GitLab repository, which actually contains malicious code. This cloned code connects to a command and control (C2) server, embedding malware into the victim's environment and allowing the attackers to control the victim's computer. These malicious software are cross-platform compatible and can steal high-value data such as passwords, API keys, cryptocurrency wallet information, and maintain connections through highly obfuscated C2 servers to minimize their exposure.