North Korean state-sponsored hackers have executed what security experts are calling the largest cryptocurrency theft operation to date, successfully stealing an estimated $625 million through an elaborate attack chain that compromised a high-profile macOS developer’s environment and leveraged Amazon Web Services (AWS) infrastructures as pivots.

The sophisticated campaign, which targeted multiple cryptocurrency exchanges simultaneously, demonstrated an unprecedented level of technical coordination and operational security.

The initial compromise occurred through a carefully crafted spear-phishing campaign targeting a senior developer with privileged access to a popular cryptocurrency trading application’s codebase.

The attackers deployed a previously undocumented malware variant specifically designed for macOS environments, which established persistence through a combination of launch agents and dylib hijacking techniques.

Once entrenched, the malicious actors gained complete visibility into the developer’s environment, including access credentials to critical repositories and cloud services.

From this strategic foothold, the attackers pivoted to multiple AWS instances that housed portions of the trading platform’s infrastructure.

By leveraging the developer’s legitimate AWS credentials, the attackers managed to deploy additional backdoors throughout the system while avoiding traditional detection mechanisms.

The campaign remained undetected for approximately 18 days before unusual transaction patterns triggered security alerts.

Elastic researchers identified the attack after observing anomalous network traffic patterns from several cryptocurrency exchanges.

Their analysis revealed a sophisticated command-and-control infrastructure utilizing multiple proxies and encrypted communications channels designed to obscure the attackers’ true location.

“This represents a significant evolution in DPRK’s cyber capabilities,” noted the Elastic research team in their comprehensive analysis.

Execution flow

The malware’s infection mechanism relied on a multi-stage approach, beginning with a seemingly benign application update that concealed the initial payload.

Upon execution, the malware would deploy the following shell script to establish persistence:-

#!/bin/bash
mkdir -p ~/Library/LaunchAgents/
cat > ~/Library/LaunchAgents/com.trading.updater.plist 



    Label
    com.trading.updater
    ProgramArguments

        /usr/bin/python3
        $HOME/.hidden/loader.py

    RunAtLoad

    KeepAlive



EOF
launchctl load ~/Library/LaunchAgents/com.trading.updater.plist

AWS cloud compromise execution flow (Source – Elastic)

This script would then execute a Python-based loader that retrieved the next-stage payloads from compromised AWS S3 buckets. The malware employed sophisticated anti-analysis techniques, including environment checks to detect virtualization and debugging attempts.

The AWS pivot techniques were particularly noteworthy, as they leveraged legitimate credentials to create temporary instances that served as relay points for exfiltrating cryptocurrency wallet data.

By routing traffic through these legitimate AWS resources, the attackers effectively masked their activities behind trusted cloud infrastructure.

Security researchers successfully emulated the complete attack chain in controlled environments, providing crucial insights into detection opportunities and potential mitigation strategies for similar attacks in the future.

This incident highlights the continuing threat posed by DPRK-affiliated groups to financial institutions and cryptocurrency platforms worldwide.

Are you from the SOC and DFIR Teams? – Analyse Real time Malware Incidents with ANY.RUN -> Start Now for Free.

The post DPRK’s Largest Cryptocurrency Heist via a Compromised macOS Developer and AWS Pivots – Researchers Emulated appeared first on Cyber Security News.