The malware report was originally published by the Jamf platform. It was later supplemented and analyzed by the Sekoia team.
Software called RustBucket uses a fake PDF program. When certain PDF files are opened in such a program, it triggers malicious activity, Sekoia analysts explain.
“Since 2017, BlueNoroff has been seen running campaigns targeting cryptocurrency exchanges and venture capital-related organizations in Europe, Asia, the United States and the UAE,” the Sekoia report said.
Since 2022, BlueNoroff has begun to pose a global threat to crypto startups from the U.S., India, U.K., Ukraine, Poland, Czech Republic, UAE, Singapore, Estonia, Vietnam, Malta, Germany and Hong Kong.
The group used to use Word to embed malware, but has since improved its approaches.
Earlier it was revealed that hacker groups affiliated with North Korea stole $721 million in cryptocurrency from Japanese businesses from 2017 to January 1, 2023.
At least half of the DPRK’s missile program is funded by cybercrime, Washington claims.