BlueNoroff

Elastic Security Labs published 'Elastic catches DPRK passing out KANDYKORN,' describing a Lazarus-cluster intrusion (tracked as REF7001) against blockchain engineers at a cryptocurrency exchange. Operators impersonated community members on Discord and delivered a Python 'arbitrage bot' that staged the SUGARLOADER and HLOADER components and ultimately deployed the KANDYKORN backdoor for remote command execution and file operations.

Jamf Threat Labs published analysis of RustBucket, a multi-stage macOS malware family attributed to BlueNoroff. The infection chain begins with a backdoored 'Internal PDF Viewer' application that only activates malicious behaviour when a specifically crafted decoy PDF is opened, then retrieves a Rust-based stage-three payload for reconnaissance and follow-on operations against finance-sector targets in Asia, Europe, and the United States.

FBI, CISA, and the U.S. Treasury issued joint advisory AA22-108A warning that a DPRK state-sponsored APT tracked as Lazarus, APT38, BlueNoroff, and Stardust Chollima was targeting blockchain firms with trojanised cryptocurrency trading applications collectively named TraderTraitor. The malware family is built on cross-platform Electron/Node.js code, delivered through spearphishing that mimics recruiter outreach to DevOps and IT staff at crypto exchanges and DeFi protocols.

Kaspersky published 'The BlueNoroff cryptocurrency hunt is still on,' detailing a multi-year campaign dubbed SnatchCrypto in which BlueNoroff impersonated venture capital firms to spearphish fintech, DeFi, and blockchain startups. The actor used weaponised Office documents and LNK files, surveilled victims for weeks, and in high-value cases swapped the MetaMask browser extension with a trojanised build to alter outgoing transactions at signing time.

Kaspersky's Global Research and Analysis Team published technical analysis tying the February 2016 fraudulent SWIFT transfers from Bangladesh Bank's New York Federal Reserve account — through which attackers moved roughly $81 million — to the Lazarus cluster's financial subgroup later widely tracked as BlueNoroff / APT38. The report documents shared tooling, infrastructure, and operator tradecraft across attacks on banks in multiple countries.