WOO X July security incident post-mortem: North Korean hackers launched a social engineering attack against the development team
-
最新报道：According to Bijie.com, WOO X released a post-mortem analysis of its July security incident. On July 24th, the company experienced a complex security incident that resulted in the theft of $14 million from nine user accounts. Evidence suggests the attack was carried out by UNC4899, a North Korean government-sponsored cyberespionage group colluding with the Reconnaissance General Bureau of North Korea, publicly known as Lazarus Group, TraderTraitor, and Jade Sleet. The attack began with a social engineering attack targeting the development team, seemingly through a legitimate open source collaboration request. A team member was invited on an open source software forum to help debug a development tool. After a brief discussion, the developer downloaded the file on a mobile device and opened it on a company-issued MacBook. Before opening the file, researchers tested it for malware, but the scan came back negative. After running, the program downloaded a hidden backdoor that resembled a common backend process. This allowed the attacker to maintain access to the development environment and, after a period of time, modify the database, gaining access to nine accounts that had initiated withdrawals. The unauthorized withdrawals were detected two hours later and immediately stopped, with all affected users fully compensated from WOO’s coffers.
下一篇
Bullish Makes History With First-Ever U.S. IPO Fully Settled in Stablecoins
- Bullish, a crypto exchange backed by Peter Thiel, settled its $1.15 billion IPO proceeds e...
24小时热点
热点专题
413635