Lazarus takes $534M in cryptocurrency in a single whoosh

World-renowned cybersecurity unit Group-IB is prepping to release its annual report on patterns in hi-tech cybercrime, during its CyberCrimeCon/2018 Singapore, on 12 November 2018. One of the most notorious groups mentioned is the North Korean hacker crew.

"Lazarus" seems to be the most rewarding cryptocurrency-hacker syndicate in the world. Reports sum up some impressive numbers. One, leading the charts is the January 2018 heist, taking from Coincheck, Japan $534M in cryptocurrency in a single whoosh.

Since 2017, "Lazarus" has actually taken an overall $882 million worth of cryptocurrency from the online exchanges.

A summary obtained by Hard Fork information from 14 different attacks on cryptocurrency exchanges since January in 2017, determines that the state-sponsored Lazarus group is responsible for $882 million of the ill-gotten gains. That's almost one billion dollars.

Hackers targeting cryptocurrency exchanges mainly utilize conventional methods and tools, such as spear phishing, social engineering, and malware.

“Spear phishing remains the major vector of attack on corporate networks. For instance, fraudsters deliver malware under the cover of CV spam [with an attachment] that has a malware embedded in the document,” noted by the in-depth report. “After the local network is successfully compromised, the hackers browse the local network to find workstations and servers used working with private cryptocurrency wallets.”

Group-IB expects the number of targeted attacks on cryptocurrency exchanges to rise, and not simply the ones from Lazarus. It cautions everybody as the most aggressive hacker groups, typically assaulting banks, will shift their attention to cryptocurrency exchanges, since now they know just how lucrative it can be.

Phishers accountable for 56% of taken ICO funds - The report also exposes 10% of the total funds raised by ICO platforms over the previous year and a more than a half have been stolen. A majority of the funds were lost to phishing.

Group-IB attributes much of the losses to baddies making the most of "crypto-fever," where financiers are so conquered with a worry of missing out they rush to add to new cryptocurrency projects as quickly as possible, without checking for a fake domain.

According to the report, big phishing groups can take roughly $1 million a month.

Cryptocurrency fraudsters are also getting more innovative. Group-IB found several instances of financier database theft, where hackers take the delicate financial info to re-sell on the dark internet or utilize to blackmail the cryptocurrencers.

Scammers are even building fake websites using taken cryptocurrency project descriptions and plagiarized whitepapers, vanishing with financier funds soon after introducing a phoney ICO.

51% attacks and increasing - Group-IB anticipate attacks on ICOs will remain a threat for almost every project seeking to draw in investors. “Fraudulent phishing-schemes involving crypto-brands will only get more complex as well as cybercriminals’ level of preparation for phishing attacks,” explained in the warning. “Automated phishing and the use of so-called ‘phishing-kits’ will become more widespread, including for the attacks on ICOs.”

Ominously, Group-IB likewise presents the possibility: if the world's biggest mining pools become a simple target for state-sponsored hackers, ‘51-percent attacks‘ to be increasingly common.

For 51% attacks to be successful, bad actors should control a bulk of the overall computing power utilized by a Proof-of-Work powered blockchain.

In 2018, 7 effective attacks were registered with direct monetary losses ranging from $5 million to $170 million, then a jump to $534 million," Group-IB reports.