Debridge Finance Suspects North Korean Hacking Syndicate Lazarus Group Attacked the Protocol"s Team
According to the co-founder of Debridge Finance, Alex Smirnov, the infamous North Korean hacking syndicate Lazarus Group subjected Debridge to an attempted cyberattack. Smirnov has warned Web3 teams that the campaign is likely widespread. Lazarus Group Suspected of Attacking Debridge Finance Team Members With a Malicious Group Email
There’s been a great number of attacks against decentralized finance (defi) protocols like cross-chain bridges in 2022. While most of the hackers are unknown, it’s been suspected that the North Korean hacking collective Lazarus Group has been behind a number of defi exploits.
In mid-April 2022, the Federal Bureau of Investigation (FBI), the U.S. Treasury Department, and the Cybersecurity and Infrastructure Security Agency (CISA) said Lazarus Group was a threat to the crypto industry and participants. A week after the FBI’s warning, the U.S. Treasury Department’s Office of Foreign Asset Control (OFAC) added three Ethereum-based addresses to the Specially Designated Nationals And Blocked Persons List (SDN).
OFAC alleged that the group of Ethereum addresses are maintained by members of the cybercrime syndicate Lazarus Group. Additionally, OFAC connected the flagged ethereum addresses with the Ronin bridge exploit (the $620M Axie Infinity hack) to the group of North Korean hackers. On Friday, Alex Smirnov, the co-founder of Debridge Finance, alerted the crypto and Web3 community about Lazarus Group allegedly attempting to attack the project.
“[Debridge Finance] has been the subject of an attempted cyberattack, apparently by the Lazarus group. PSA for all teams in Web3, this campaign is likely widespread,” Smirnov stressed in his tweet. “The attack vector was via email, with several of our team receiving a PDF file named “New Salary Adjustments” from an email address spoofing mine. We have strict internal security policies and continuously work on improving them as well as educating the team about possible attack vectors.” Smirnov continued, adding: Most of the team members immediately reported the suspicious email, but one colleague downloaded and opened the file. This made us investigate the attack vector to understand how exactly it was supposed to work and what the consequences would be.
Smirnov insisted that the attack would not infect macOS users but when Windows users open the password-protected pdf, they are asked to use the system password. “The attack vector is as follows: user opens [the] link from email -> downloads & opens archive -> tries to open PDF, but PDF asks for a password -> user opens password.txt.lnk and infects the whole system,” Smirnov tweeted.
Smirnov said that according to this Twitter thread the files contained in the attack against the Debridge Finance team were the same names and “attributed to Lazarus Group.” The Debridge Finance executive concluded: Never open email attachments without verifying the sender’s full email address, and have an internal protocol for how your team shares attachments. Please stay SAFU and share this thread to let everyone know about potential attacks.
Lazarus Group and hackers, in general, have made a killing by targeting defi projects and the cryptocurrency industry. Members of the crypto industry are considered targets because a number of firms deal with finances, an assortment of assets, and investments. Tags in this story Alex Smirnov, Attack, Crypto, Cryptocurrency, Debridge Finance, DeFi, Digital Assets, exploit infects the system, Hackers, Lazarus Group, Lazarus Group attack, Malicious Email, north korea, North Korea Lazarus Group, north korean hackers, Password, PSA, suspicious email, Team Attack, widespread attack
What do you think about Alex Smirnov’s account of the alleged Lazarus group email attack? Let us know your thoughts about this subject in the comments section below. Jamie Redman
Jamie Redman is the News Lead at Bitcoin.com News and a financial tech journalist living in Florida. Redman has been an active member of the cryptocurrency community since 2011. He has a passion for Bitcoin, open-source code, and decentralized applications. Since September 2015, Redman has written more than 5,700 articles for Bitcoin.com News about the disruptive protocols emerging today. Alleged BTC-e Operator Alexander Vinnik in US Custody After Immediate Extradition From Greece NEWS | 2 hours ago Voyager to Allow Cash Withdrawals for Customers With US Dollars Held in Accounts NEWS | 4 hours ago
Image Credits: Shutterstock, Pixabay, Wiki Commons Previous articleA Second Ethereum PoW Chain Idea Gains Traction, Poloniex to List ‘Potential Forked’ Token Markets Next articleVoyager to Allow Cash Withdrawals for Customers With US Dollars Held in Accounts Disclaimer: This article is for informational purposes only. It is not a direct offer or solicitation of an offer to buy or sell, or a recommendation or endorsement of any products, services, or companies. Bitcoin.com does not provide investment, tax, legal, or accounting advice. Neither the company nor the author is responsible, directly or indirectly, for any damage or loss caused or alleged to be caused by or in connection with the use of or reliance on any content, goods or services mentioned in this article. Read disclaimerShow comments More Popular NewsIn Case You Missed ItTony Hawk"s Latest NFTs to Come With Signed Physical Skateboards
Last December, the renowned professional skateboarder Tony Hawk released his “Last Trick” non-fungible token (NFT) collection via the NFT marketplace Autograph. Next week, Hawk will be auctioning the skateboards he used during his last tricks, and each of the NFTs ... read more.Following a Brief Fee Spike, Gas Prices to Move Ethereum Drop 76% in 12 Days UAE Airliner Emirates to Launch NFTs and Experiences in the Metaverse Australia to List Bitcoin ETF After 4 Clearinghouse Participants Commit to Meet Stringent Margin Terms Interest in Real Estate Investments in Spain Grew 400%, With Some Using Crypto and Stocks as Payment Method