Are We One Step Closer to Shutting Down Lazarus?

TLDR

• BitMEX’s security team has been tracking the Lazarus Group.
• While the attacks are sophisticated, the group has gotten a little sloppy lately.
• The security team was able to find IP addresses and other information on how the group operates.

The Lazarus Group, a notorious North Korean government-backed hacking organization, is known for its extensive cybercrime operations targeting crypto platforms worldwide. Lazarus is infamous for a unique blend of low-tech phishing campaigns and sophisticated post-exploitation techniques. 

Recent findings by the BitMEX crypto exchange’s security team may have brought international authorities closer to unraveling the group’s operations, revealing patterns, vulnerabilities, and even a rare slip-up by a hacker.

What Did BitMEX Discover?

BitMEX security researchers conducted a counter-ops investigation following a LinkedIn phishing attempt targeting one of their employees. 

The probe uncovered lapses in the operational security (OpSec) of Lazarus, providing insights into their infrastructure and tactics. Their key findings included:

Unmasking IP Addresses

For years, Lazarus members have effectively masked their true locations using VPNs and proxies. However, during the probe, one hacker inadvertently revealed their real IP address. 

The address pointed to a residential China Mobile IP in Jiaxing, China, rather than the usual VPN or proxy servers Lazarus is known to use. This rare mistake provided valuable insight into one of the group’s physical locations.

Leveraging a Supabase Database

The investigation also unearthed an exposed Supabase database used by Lazarus. Supabase, a platform that simplifies database deployment for developers, routed sensitive tracking data such as the usernames, hostnames, operating system details, geolocation, and other metadata about victims’ devices. 

Due to a common error in configuring database permissions, researchers were able to access these logs and identify patterns that exposed Lazarus operations.

Insights Into the Inner Workings

The database logs revealed recurring usernames, such as “Victor” and “GHOST72,” which were associated with specific VPNs, including Touch VPN and Astrill VPN. 

This information, coupled with timestamps, enabled researchers to analyze Lazarus’s active hours, uncover schedules suggesting Pyongyang time-zone alignment, and even locate development activity, hinting at the hackers’ workflow.

A Deeper Look Into Lazarus Tactics

BitMEX’s findings reaffirm how Lazarus blends rudimentary phishing with advanced exploitation techniques. Here’s a breakdown of their approach:

1. Phishing for Initial Access

Lazarus frequently begins attacks with social engineering. The BitMEX employee targeted with phishing received a LinkedIn message about a supposed collaboration on an NFT project. A private GitHub repository was then shared, containing a Next.js/React website designed to lure the victim into running malicious code.

Researchers identified malicious JavaScript embedded within the project. Using analysis tools like Webcrack, they uncovered obfuscated scripts designed to steal credentials, execute commands, and inject malware into victim machines.

2. Advanced Post-Exploitation Techniques

Once access is gained, Lazarus transitions to advanced post-exploitation techniques. An example detailed in the discovery relates to an earlier Bybit breach, where attackers progressed from phishing to accessing AWS accounts, allowing them to compromise security systems fully. 

Such transitions indicate their technical expertise and operational segmentation, distinguishing entry-level operatives from post-exploitation specialists.

3. Use of Obfuscated Malware

The recovered JavaScript malware exhibited patterns similar to those seen in past Lazarus campaigns, such as the “BeaverTail” campaign documented by Palo Alto’s Unit 42. 

By analyzing their tools, BitMEX researchers confirmed Lazarus’s signature modus operandi, which involves tracking algorithms, malware execution layers, and deceptive JavaScript blocks.

Operational Security Gaps and Their Impact

The errors uncovered during this investigation offer a rare glimpse into the vulnerabilities of an otherwise cunning hacking group:

• Sloppy VPN Use: The accidental use of a residential IP address in Jiaxing, China, demonstrates lapses in adherence to proper VPN protocols, potentially exposing key actors.
• Database Misconfigurations: Leaving Supabase permissions improperly configured was a significant oversight, as it enabled external researchers to access the logs and track their activity.
• Poor Malware Deployment: Commented-out malicious code, as discovered in BitMEX’s investigation, suggests rushed or reused malware structures, further exemplifying disjointed OpSec.

These OpSec gaps could indicate overconfidence or lack of oversight within Lazarus’s increasingly decentralized layers.

The Lazarus Threat to Cryptocurrency

Lazarus has a long history of targeting cryptocurrency platforms, with high-profile breaches at ByBit, Coincheck, and KuCoin on its record, costing the industry billions of dollars. Their tactics pose considerable risks to the burgeoning decentralized finance (DeFi) space and compromise user trust.

• Economic Impact: Multi-million-dollar (sometimes billion) heists can cripple platforms and financially harm investors.
• Erosion of Trust: Frequent breaches harm consumer confidence in cryptocurrency services.
• Intelligence Risks: Sensitive data stolen in these attacks can be leveraged for broader geopolitical initiatives.

Can We Really Stop Lazarus?

Unfortunately…we don’t know. It’s not like the North Korean government has ever, or will ever, play nice with authorities. But now that users and security teams have more information on how they do things, it’s a step closer to preventing them from doing it in the future.

So, in the short term, probably not. But in the long term? It’s definitely possible.

Despite their vulnerabilities, Lazarus remains a dangerous adversary with significant resources and state backing. However, discoveries like BitMEX’s recent findings provide critical intelligence that could aid global efforts to curb their impact.

Shutting Down Lazarus One Mistake at a Time

The battle against Lazarus is far from over, but slip-ups like leaked IP addresses and unsecured databases offer rare opportunities to understand and combat their operations. BitMEX’s findings underscore the importance of vigilance, collaboration, and continuous threat monitoring in an industry plagued by cybercrime.

While Lazarus may continue their methods, their operational vulnerabilities remind us that even the most prolific groups are not invincible. Every mistake brings us closer to shutting them down for good.