Connect with us
Active Currencies 10014
Market Cap $1,082,975,278,667.96
Bitcoin Share 45.82%
24h Market Cap Change $-5.52

Did North Korea’s Lazarus Group launch supply chain attack on crypto firms?

2min Read
Did North Korea’s Lazarus Group launch supply chain attack on crypto firms?

Share this article

  • Cybersecurity firm Kaspersky recently investigated a 3CX supply chain attack that targeted crypto firms.
  • The investigation revealed that North Korea’s Lazarus Group may have been behind the attack.

Popular cybersecurity firm Kaspersky recently concluded an investigation into a supply chain attack on 3CX, a popular VoIP (Voice over Internet Protocol) software provider. The attack came to light on 29 March and reportedly affected cryptocurrency firms.

Kaspersky published its report on 3 April on the matter after analyzing available data and reviewing its own telemetry. 

Hackers target crypto firms with surgical precision

According to the report, Kaspersky experts found a suspicious Dynamic Link Library (DLL) that was loaded into the infected 3CXDesktopApp.exe process on one of the machines they were monitoring. This DLL was linked to a backdoor known as “Gopuram,” which Kaspersky had been tracking since 2020.

Kaspersky also opened a case linked to the Gopuram backdoor on 21 March. Interestingly, this was roughly a week before the 3CX supply chain attack was discovered. Kaspersky’s previous investigations shed further light on the origins of the Gopuram backdoor.

Three years ago, the cybersecurity firm investigated an infection of a cryptocurrency company located in Southeast Asia. During this investigation, they discovered that Gopuram coexisted on victim machines with AppleJeus, another backdoor that has been associated with the Lazarus Group, the notorious hacker group based in North Korea. 

Kaspersky’s telemetry revealed that installations of the infected 3CX software were located all over the world. Brazil, Germany, Italy, and France recorded the highest number of infestations.

However, the Gopuram backdoor was deployed to less than ten machines. This indicated that the attackers behind this campaign were very precise in their targeting.

Georgy Kucherin, a security expert at GReAT, Kaspersky, said:

“We believe that Gopuram is the main implant and the final payload in the attack chain. Our investigation of the 3CX campaign is ongoing and we will continue analyzing the deployed implants to find out more details about the toolset used in the supply chain attack.”

The specific interest in cryptocurrency companies suggests that the hackers may have been looking to steal valuable assets such as digital currencies or sensitive financial information.


Ser Suzuki Shillsalot has 8 years of experience working as a Senior Investigative journalist at The SpamBot Times. He completed a two-hour course in journalism from a popular YouTube video and was one of the few to give it a positive rating. Shillsalot's writings mainly focus on shilling his favourite cryptos and trolling anyone who disagrees with him. P.S - There is a slight possibility the profile pic is AI-generated. You see, this account is primarily used by our freelancer writers and they wish to remain anonymous. Wait, are they Satoshi? :/
Read the best crypto stories of the day in less than 5 minutes
Subscribe to get it daily in your inbox.