By Hackers from North Korean have reportedly attacked South Korean users of the crypto exchange UpBit with a smart phishing attack.
As per data released by East Security, the attacker attempted a cyber attack by sending an email containing the phishing virus on May 28th. The subject line of the email called for more information from UpBit for a customer’s sweepstakes payout. This payout was of course, fictional and the mail did not come from UpBit but from another server altogether.
The email also contained a file which claimed to provide documents needed for the payout. As per East Security, running this file displayed what seemed to be a standard document, but instead, it ran the malicious code. It then sent data about the user’s computer as well as private keys and logins to the attackers and lastly connected the machine to a command and control system for remote access at a later stage.
East Security has stated that it believes that the hack came from a North Korean cybercrime group dubbed Kim Soo-ki.
Mun Jong-hyun, head of the ESRC Center at East Security stated:
“In analyzing attack tools and malicious codes used by hacker groups, there are unique characteristics we saw.”
He cited similarities to another attack called Operation Fake Striker that targeted South Korean government agencies. In addition to these attacks, the hackers had also used these tactics in January to target reporters.
Mun Jong-hyun added:
“As bitcoin prices rise, more and more customers are using exchanges. This means that the number of victims has increased, which means that the possibility of stealing passwords stored in the exchange has increased.”
In a smart move on the hackers part, they password-protected the malicious file named “UPBIT” which ensured that anti-virus tools could not detect the malicious code.
Mun Jong-hyun stated:
“We have not heard of any reported damage. In order to avoid cyber attacks, you should not install or click suspicious files or documents.”
Comments