Connect with us
Active Currencies 14909
Market Cap $2,239,019,814,284.20
Bitcoin Share 50.72%
24h Market Cap Change $0.46

Did North Korea’s Lazarus Group launch supply chain attack on crypto firms?

2min Read
Did North Korea’s Lazarus Group launch supply chain attack on crypto firms?

Share this article

  • Cybersecurity firm Kaspersky recently investigated a 3CX supply chain attack that targeted crypto firms.
  • The investigation revealed that North Korea’s Lazarus Group may have been behind the attack.

Popular cybersecurity firm Kaspersky recently concluded an investigation into a supply chain attack on 3CX, a popular VoIP (Voice over Internet Protocol) software provider. The attack came to light on 29 March and reportedly affected cryptocurrency firms.

Kaspersky published its report on 3 April on the matter after analyzing available data and reviewing its own telemetry. 

Hackers target crypto firms with surgical precision

According to the report, Kaspersky experts found a suspicious Dynamic Link Library (DLL) that was loaded into the infected 3CXDesktopApp.exe process on one of the machines they were monitoring. This DLL was linked to a backdoor known as “Gopuram,” which Kaspersky had been tracking since 2020.

Kaspersky also opened a case linked to the Gopuram backdoor on 21 March. Interestingly, this was roughly a week before the 3CX supply chain attack was discovered. Kaspersky’s previous investigations shed further light on the origins of the Gopuram backdoor.

Three years ago, the cybersecurity firm investigated an infection of a cryptocurrency company located in Southeast Asia. During this investigation, they discovered that Gopuram coexisted on victim machines with AppleJeus, another backdoor that has been associated with the Lazarus Group, the notorious hacker group based in North Korea. 

Kaspersky’s telemetry revealed that installations of the infected 3CX software were located all over the world. Brazil, Germany, Italy, and France recorded the highest number of infestations.

However, the Gopuram backdoor was deployed to less than ten machines. This indicated that the attackers behind this campaign were very precise in their targeting.

Georgy Kucherin, a security expert at GReAT, Kaspersky, said:

“We believe that Gopuram is the main implant and the final payload in the attack chain. Our investigation of the 3CX campaign is ongoing and we will continue analyzing the deployed implants to find out more details about the toolset used in the supply chain attack.”

The specific interest in cryptocurrency companies suggests that the hackers may have been looking to steal valuable assets such as digital currencies or sensitive financial information.


Saman Waris works as a News Editor at AMBCrypto. She has always been fascinated by how the tides of finance and technology shape communities across demographics. Cryptocurrencies are of particular interest to Saman, with much of her writing centered around understanding how ideas like Momentum and Greater Fool theories apply to altcoins, specifically, memecoins. A graduate in history, Saman worked the sports beat before diving into crypto. Prior to joining AMBCrypto 2 years ago, Saman was a News Editor at Sportskeeda. This was preceded by her stint as Editor-in-Chief at EssentiallySports.
Read the best crypto stories of the day in less than 5 minutes
Subscribe to get it daily in your inbox.
Please check the format of your first name and/or email address.

Thank you for subscribing to Unhashed.