lazarusholic

Everyday is lazarus.dayβ

New North Korean malware targets crypto startups

2025-07-11, Moonlock
https://moonlock.com/malware-fake-zoom-invites
#NimDoor

Contents

North Korean hackers have been behind a “fake interview” malware campaign over the past year. Now, the threat actors have made an interesting update. While the update does not change how the well-known job interview scam works, it takes cybersecurity researchers on a wild ride by using new programming languages. Let’s explore this development.
Sentinel One pulls back the curtain on North Korean use of new programming languages
On July 2, Sentinel One released a deep technical analysis of new updates used by North Korean hackers. As mentioned, the threat group has not changed its attack vector for its “fake interview” campaign.
As we have covered numerous times, the fake interview campaign used by North Korean hackers involves spear phishing individuals or businesses in the Web3, crypto, and blockchain industry. Luring them with the promise of a job, the black hatters set up fake interviews via Zoom.
Once a victim agrees to an interview, …

IoC

http://support.us05web-zoom.forum
http://support.us05web-zoom.pro
http://support.us05web-zoom.cloud
http://us05web.zoom.us
http://support.us06web-zoom.online