North Korean hackers deploy new Golang malware 'Durian' targeting cryptocurrency companies

According to recent observations, the North Korean threat group Kimsuky deployed a previously undocumented Golang-based malware called Durian as part of a highly targeted cyberattack against two South Korean cryptocurrency firms.

"Durian boasts comprehensive backdoor functionality, capable of executing delivered commands, downloading additional files, and exfiltrating files," Kaspersky stated in its Q1 2024 APT Trends Report.

These attacks occurred in August and November 2023, utilizing proprietary, legitimate South Korean software as an infection vector, though the exact mechanism of manipulating the program remains unclear.

What is known is that the software establishes a connection with the attacker's server, leading to the retrieval of the malicious payload, which initiates the infection sequence.

The first stage serves as an installer for additional malware and a method to establish persistence on the host. It also paves the way for the loader malware that ultimately executes Durian.

For its part, Durian is used to introduce further malware, including AppleSeed, Kimsuky's primary backdoor of choice, a custom proxy tool named LazyLoad, and other legitimate tools such as ngrok and Chrome Remote Desktop.

"Ultimately, the threat actors implanted malware to steal data stored in browsers, including cookies and login credentials," Kaspersky said.

Kimsuky is known to have been active since at least 2012, and has been given various aliases by analyst organizations during its malicious cyber campaigns over the years, such as: APT43, Black Banshee, Emerald Sleet (formerly Thallium), Springtail, TA427, and Velvet Chollima. The group is reportedly affiliated with the Reconnaissance General Bureau (RGB), North Korea's top military intelligence agency.

Successful intrusions further enable Kimsuky to craft more credible and effective spear-phishing emails, which can then be leveraged to target more sensitive, high-value objectives.

Symantec stated they have also linked the group to spear-phishing campaigns delivering a C#-based remote access trojan and information stealer named TutorialRAT (aka TutRAT), which exploits Dropbox as an "attack base to evade threat monitoring."

"The recent attacks appear to be an extension of APT43's BabyShark threat campaigns, employing typical spear-phishing techniques including the use of shortcut (LNK) files."

Meanwhile, AhnLab Security Intelligence Center (ASEC) detailed another campaign orchestrated by ScarCruft, another North Korean state-sponsored hacking group, which targeted South Korean users using Windows shortcut (LNK) files to ultimately deploy RokRAT.

Also known as APT37, InkySquid, RedEyes, Ricochet Chollima, and Ruby Sleet, this group is said to be aligned with North Korea's Ministry of State Security (MSS), responsible for covert intelligence gathering to support the nation's strategic military, political, and economic interests.

"The recently identified shortcut files (*.LNK) are targeted at South Korean users, particularly those with associations related to North Korea," ASEC stated.

Attack simulation rules targeting the tactics employed by the aforementioned threat groups have been added to the Sixsafe Security Metric Validation Platform. You can search for keywords like "Kimsuky", "APT43", "Durian", "APT37", "AppleSeed", "Ngrok", "RokRAT" in the platform to obtain the relevant attack simulation validation actions, thereby verifying whether your security defense system can effectively counter attacks from these threat groups. The platform ensures your validation process is safe and harmless in an industry-unique manner.