Internal Slack messages revealed that the North Korean operative worked on core MetaMask code for approximately one month before being terminated. Although Consensys confirmed that the infiltrator was stopped before any damage was done, the market remains skeptical of MetaMask’s ability to guarantee the safety of its users’ funds. According to the report, the North Korean software engineer worked under the alias “Tyler Knapp” and used the GitHub handle “imyugioh.” He was hired as a consultant through a third-party service provider with a long-standing relationship with Consensys.

Consensys says North Korean operative was terminated after one month

Consensys confirmed that the North Korean software engineer was not hired directly through its internal hiring pipeline, insisting that the third-party hiring agency may have been responsible for the breakdown in proper screening. Internal Slack messages reviewed show that Tyler Knapp worked on the core MetaMask platform code. He had access to the core MetaMask codebase that converts crypto to fiat currency via third-party payment providers and vice versa.

The North Korean also contributed to MetaMask’s mobile wallet codebase on GitHub. Those contributions began on March 9 and abruptly stopped in April, the same month Consensys cut off his access, meaning the operative had roughly a month of activity within the company’s systems. Consensys general counsel Matt Corva revealed that the company discovered the threat quickly after Tyler was hired. The company followed its security protocols and terminated access immediately upon identifying the threat.

Corva also said a subsequent investigation found no misappropriation of assets or data, no malicious code pushed into production, and no impact on user safety. In April, Corva sent a company-wide alert ordering all product releases suspended pending investigation and instructing staff not to interact with the individual. He also asked employees to keep the matter internal while the probe continued, a request that suggests Consensys was trying to control the narrative well before the story became public this week.

North Korean operatives posing as remote software engineers have repeatedly landed real jobs at American companies. These companies achieve this with the help of US-based facilitators running laptop farms that make it appear the worker is logging in from within the country. One Arizona woman was sentenced last year for running such an operation, which prosecutors say generated more than $17 million for North Korea-linked entities, according to reporting from The Guardian.

Earlier this year, two more American nationals were sentenced for facilitating similar schemes that the Department of Justice says touched close to 70 US companies. Crypto firms are an especially attractive target because a developer’s ordinary access can extend well beyond source code into transaction signing infrastructure, the layer where stolen funds actually move. Blockchain analytics firm TRM Labs has estimated that North Korea-linked actors were behind roughly two-thirds of all crypto stolen in hacks last year, a figure that includes the $1.5 billion Bybit theft widely attributed to Pyongyang.

The post North Korean operative busted after accessing MetaMask code first appeared on Coinfea.

A new frontier in cyber attacks

The North Korean Advanced Persistent Threat (APT) group known as Konni has made headlines by exploiting a recently disclosed WinRAR vulnerability (CVE-2023-38831) to target the cryptocurrency industry. This marks the first instance of an APT group leveraging this particular vulnerability for an attack.

The group used a malicious payload disguised as a wallet screenshot related to Qbao Network, a smart cryptocurrency wallet service. When the victim clicked on the HTML file within a compressed archive, the malicious payload was executed, exploiting the WinRAR vulnerability.

Technical insights and implications

The attack was meticulously planned, using a bug in the WinRAR software to execute a malicious payload. The payload was designed to detect the type of operating system on the victim’s computer and download additional payloads accordingly. The malware then performed various tasks, such as running system information commands and task lists, which were encrypted and sent back to a server controlled by the attackers. This level of sophistication indicates a well-coordinated effort and raises concerns about the vulnerability of cryptocurrency platforms to advanced cyber threats.

North Korea’s expanding cyber reach

While North Korean cyber activities targeting the cryptocurrency industry have generally been attributed to the Lazarus Group, this attack signifies a broader range of actors within the country focusing on this lucrative sector. The attack comes in the wake of other incidents involving cryptocurrency platforms like Stake and CoinEx, suggesting a concerted effort by North Korean hackers to target cryptocurrency exchanges. The use of a newly disclosed vulnerability also indicates that these groups are staying abreast of the latest developments in cybersecurity, ready to exploit any weaknesses they find.

The attack serves as a wake-up call for the cryptocurrency industry, which has been increasingly targeted by sophisticated cyber threats. The exploitation of a newly disclosed vulnerability highlights the need for constant vigilance and timely patching of software vulnerabilities. With North Korea expanding its cyber-operations to include more groups targeting the cryptocurrency sector, the industry must bolster its defenses to protect against a growing range of threats.

The post Cryptocurrency industry faces new threat as North Korean Konni group exploits WinRAR bug first appeared on Coinfea.