Saha Swatilakha
In a recent surge of cyber warfare targeting South Korean cryptocurrency firms, North Korean hackers have unleashed a new strain of malware dubbed “Durian,” designed to infiltrate and compromise the security of these companies.
This alarming development comes amid rising concerns over North Korea’s aggressive pursuit of illicit funds through cybercrime.
The cybersecurity firm Kaspersky issued a report detailing the deployment of Durian by a North Korean hacking group known as Kimsuky. The attacks leveraged legitimate security software used exclusively by South Korean crypto firms, underscoring the sophistication of the hackers’ tactics. Durian operates as a comprehensive backdoor, enabling the execution of commands, file downloads, and exfiltration of sensitive data, posing a severe threat to affected organizations.
Furthermore, Kaspersky’s findings hint at a potential connection between Kimsuky and the notorious Lazarus group, infamous for orchestrating large-scale cryptocurrency thefts globally. Lazarus, which emerged in 2009, is suspected of pilfering more than $3 billion in cryptocurrency assets over the last six years, with over $300 million stolen in 2023 alone.
The United Nations Security Council recently released a report highlighting North Korea’s increasing reliance on cyberattacks, which now contribute significantly to its foreign currency earnings.
In response to these illicit activities, a U.S. district court last week ordered the seizure of 279 crypto accounts linked to North Korean operatives. This legal action underscores ongoing efforts to combat cybercrime and disrupt the flow of illicit funds into North Korea. The ruling also targeted 134 virtual wallets associated with cryptocurrency exchange hacks in 2019, revealing the extent to which cybercriminals employ sophisticated techniques like “chain hopping” to obscure the origins of stolen funds.
Despite these measures, concerns remain high within the cryptocurrency community about the security vulnerabilities exposed by these attacks. Questions persist about the effectiveness of existing countermeasures and the broader implications for global cybersecurity.
