Did North Korea’s Lazarus Group launch supply chain attack on crypto firms?

ambcrypto.com:

Popular cybersecurity firm Kaspersky recently concluded an investigation into a supply chain attack on 3CX, a popular VoIP (Voice over Internet Protocol) software provider. The attack came to light on 29 March and reportedly affected cryptocurrency firms.

Kaspersky published its report on 3 April on the matter after analyzing available data and reviewing its own telemetry. 

According to the report, Kaspersky experts found a suspicious Dynamic Link Library (DLL) that was loaded into the infected 3CXDesktopApp.exe process on one of the machines they were monitoring. This DLL was linked to a backdoor known as “Gopuram,” which Kaspersky had been tracking since 2020.

Kaspersky also opened a case linked to the Gopuram backdoor on 21 March. Interestingly, this was roughly a week before the 3CX supply chain attack was discovered. Kaspersky’s previous investigations shed further light on the origins of the Gopuram backdoor.

Three years ago, the cybersecurity firm investigated an infection of a cryptocurrency company located in Southeast Asia. During this investigation, they discovered that Gopuram coexisted on victim machines with AppleJeus, another backdoor that has been associated with the Lazarus Group, the notorious hacker group based in North Korea. 

Kaspersky’s telemetry revealed that installations of the infected 3CX software were located all over the world. Brazil, Germany, Italy, and France recorded the highest number of infestations.

However, the Gopuram backdoor was deployed to less than ten machines. This indicated that the attackers behind this campaign were very precise in their targeting.

Georgy Kucherin, a security expert at GReAT, Kaspersky, said:

“We believe that Gopuram is the main implant and the final