Did North Korea’s Lazarus Group launch supply chain attack on crypto firms?

• Cybersecurity firm Kaspersky recently investigated a 3CX supply chain attack that targeted crypto firms.
• The investigation revealed that North Korea’s Lazarus Group may have been behind the attack.

Popular cybersecurity firm Kaspersky recently concluded an investigation into a supply chain attack on 3CX, a popular VoIP (Voice over Internet Protocol) software provider. The attack came to light on 29 March and reportedly affected cryptocurrency firms.

Kaspersky published its report on 3 April on the matter after analyzing available data and reviewing its own telemetry. 

Hackers target crypto firms with surgical precision

According to the report, Kaspersky experts found a suspicious Dynamic Link Library (DLL) that was loaded into the infected 3CXDesktopApp.exe process on one of the machines they were monitoring. This DLL was linked to a backdoor known as “Gopuram,” which Kaspersky had been tracking since 2020.

Kaspersky also opened a case linked to the Gopuram backdoor on 21 March. Interestingly, this was roughly a week before the 3CX supply chain attack was discovered. Kaspersky’s previous investigations shed further light on the origins of the Gopuram backdoor.

Three years ago, the cybersecurity firm investigated an infection of a cryptocurrency company located in Southeast Asia. During this investigation, they discovered that Gopuram coexisted on victim machines with AppleJeus, another backdoor that has been associated with the Lazarus Group, the notorious hacker group based in North Korea. 

Kaspersky’s telemetry revealed that installations of the infected 3CX software were located all over the world. Brazil, Germany, Italy, and France recorded the highest number of infestations.

However, the Gopuram backdoor was deployed to less than ten machines. This indicated that the attackers behind this campaign were very precise in their targeting.

Georgy Kucherin, a security expert at GReAT, Kaspersky, said:

“We believe that Gopuram is the main implant and the final payload in the attack chain. Our investigation of the 3CX campaign is ongoing and we will continue analyzing the deployed implants to find out more details about the toolset used in the supply chain attack.”

The specific interest in cryptocurrency companies suggests that the hackers may have been looking to steal valuable assets such as digital currencies or sensitive financial information.