lazarusholic

Everyday is lazarus.dayβ

7 August 2024 Incident: Understanding the Malware Used

2024-08-10, Nexera
https://nexera.medium.com/240807-incident-understanding-the-malware-used-4d946ab20936
#InvisibleFerret #ITWorker #Nexera #BeaverTail

Contents

As part of our remediation work from the recent security incident, we wanted to share some details of the malware used and our findings from analyzing it.
This is a companion article to the post-mortem report published regarding the 7 August 2024 security incident.
Understanding what malware or attack techniques were used is critical in understanding the broader threat to the business and our information. It forms a key part of any incident response plan.
We have already published a post-mortem report regarding the 7 August 2024 incident, which can be read here.
In this write-up, we’ll share some context of the attack, details of the actual malware used, information on how it operates, and details on how to protect against these attacks.
So, let’s dive in.
The Attack Vector
The attackers approached a staff member via LinkedIn and offered part-time consulting work to review some smart contract code.
This isn’t a one-off — many members of our …