Lazarus Group APT Attack on Cryptocurrency Exchanges: IOC & TTP Disclosure
Cybersecurity is a war of endurance. This article is co-authored by me (Thinking) and 23pds.
Background
Since June 2024, 23pds and I have been invited by multiple teams to conduct forensic investigations into a series of exchange breaches. After accumulating evidence over several months and an intensive 30-day deep-dive analysis, we pieced together the complete attack methodology and intrusion paths. The findings point to one conclusion: this is a nation-state APT campaign targeting cryptocurrency exchanges. Through forensic analysis and threat intelligence correlation, we confirmed the attacker as Lazarus Group.
After collecting the IOCs and TTPs, we immediately shared the intelligence with our partners. In the process, we discovered that other partners had faced the same attack methodology and intrusion techniques. However, they were comparatively luckier — the attackers triggered security alerts during the intrusion, and the security team’s timely response successfully blocked the attack.
Given the ongoing and intensifying nature of APT attacks against cryptocurrency exchanges, we decided — after consulting with the affected parties — to declassify and publicly release the attack IOCs and TTPs in a sanitized form, so the broader community can defend themselves and conduct self-audits. Due to NDAs, we cannot disclose further details about specific partners. Below we focus on the key IOCs and TTPs.
Attacker Profile
The attacker’s C2 domains include gossipsnare[.]com (51.38.145.49:443), showmanroast[.]com (213.252.232.171:443), getstockprice[.]info (131.226.2.120:443), eclairdomain[.]com (37.120.247.180:443), replaydreary[.]com (88.119.175.208:443), as well as coreladao[.]com and cdn.clubinfo[.]io.
Involved IPs include 193.233.171[.]58, 193.233.85[.]234, 208.95.112[.]1, 204.79.197[.]203, and 23.195.153[.]175.
The attacker’s GitHub accounts — mariaauijj, patriciauiokv, lauraengmp — along with the Telegram account @tanzimahmed88.
The backdoor payloads are distributed under names like StockInvestSimulator-main.zip and MonteCarloStockInvestSimulator-main.zip, disguised as legitimate quantitative trading projects.
The real project code originates from cristianleoo/montecarlo-portfolio-management:
Comparing with the attacker’s modified fake project reveals an extra data_fetcher.py file in the data directory, containing a suspicious Loader:
elif content_type.startswith("application/yaml"):
data = yaml.load(response.text, Loader=yaml.Loader)
#response.raise_for_status()
self.prices = data
Backdoor Technique
The attacker leverages PyYAML’s yaml.load() with an unsafe Loader to achieve RCE, enabling remote code delivery and taking control of the target’s machine and servers.
This approach evaded detection by the vast majority of antivirus products. After sharing intelligence with partners, we also obtained several similar malicious samples:
Key technical reference: PyYAML yaml.load() Deprecation.
Through in-depth sample analysis, 23pds and I successfully reproduced the attacker’s PyYAML RCE technique:
Attack Chain
Objectives and Motivation
The attacker’s primary goal is to gain control over the wallet infrastructure of cryptocurrency exchanges in order to illicitly transfer large volumes of crypto assets.
TTP Breakdown
Initial access: The attacker used social engineering to trick employees into executing seemingly benign code on their local machines or within Docker containers. StockInvestSimulator-main.zip and MonteCarloStockInvestSimulator-main.zip were disguised as legitimate Python quantitative trading projects but were in fact remote-access trojans that used PyYAML RCE as a payload delivery and execution mechanism — bypassing most antivirus detection.
Privilege escalation: After obtaining local control of the employee’s device through the malware, the attacker persuaded the employee to set privileged: true in the docker-compose.yaml, exploiting this condition to escalate privileges and take full control of the target device.
Internal reconnaissance and lateral movement: The attacker used the compromised employee machine to scan the internal network, exploiting internal service and application vulnerabilities to further breach enterprise servers. After stealing critical server SSH keys, they exploited whitelist-based trust relationships between servers to pivot laterally into the wallet servers.
Asset exfiltration: Once in control of the wallet infrastructure, the attacker transferred large amounts of crypto assets to addresses under their control.
Covering tracks: The attacker used legitimate enterprise tools, application services, and infrastructure as proxies to mask their true origin, and deleted or tampered with log data and sample artifacts.
Social Engineering Playbook
The attacker uses multiple social engineering vectors to compromise their targets:
- Impersonating a project developer, reaching out to key engineering targets and asking for help debugging code, while offering to pay upfront to build trust. Our trace of the associated IP and User-Agent data revealed that the payment was made through a third party, providing little attribution value.
- Posing as an automated trading or investment professional, offering trading analysis or quantitative trading code, and tricking key targets into executing the malicious program. Once the malware runs on the device, it establishes a persistent backdoor and grants the attacker remote access.
All attack traffic is routed through the compromised device’s VPN, allowing it to bypass most security appliances. The attacker also persuades employees to delete the debugged programs, using the debug payment as a pretext to erase attack traces. Furthermore, employees who fear personal accountability may proactively delete relevant information, delaying incident reporting and making forensic investigation significantly harder.
Defense Recommendations
APT attacks are characterized by their stealth, clear targeting, and long dwell times, making them extremely difficult to defend against. Traditional security measures often fail to detect their sophisticated intrusion patterns, so a layered defense approach is essential. 23pds and I have outlined 8 defense priorities:
1. Network proxy security: Deploy Zero Trust-based security policies. Recommended: Fortinet, Akamai, Cloudflare Zero Trust.
2. DNS traffic protection: Detect and block DNS resolution of known malicious domains at the DNS layer to prevent DNS spoofing and data exfiltration. Recommended: Cisco Umbrella.
3. Network traffic / host monitoring: Real-time anomaly behavior monitoring with IDS/IPS and HIDS. Recommended: SolarWinds, Palo Alto, Alibaba Cloud Security Center, GlassWire.
4. Network segmentation and isolation: Segment the network into mutually isolated zones to limit the blast radius of compromises. Recommended: Cisco ISE, cloud platform security group policies.
5. System hardening: Implement security hardening policies including configuration management, vulnerability scanning, and patch management. Recommended: Tenable, public.cyber.mil.
6. Endpoint visibility: Deploy EDR for real-time endpoint activity monitoring, implement application whitelisting. Recommended: CrowdStrike Falcon, Microsoft Defender for Endpoint, WDAC.
7. Centralized log management: Aggregate logs from disparate systems into a unified platform for tracing and analysis. Recommended: Splunk, Graylog, ELK.
8. Security awareness training: Build organizational security awareness so team members can identify most social engineering attacks and proactively report anomalies when incidents occur. Recommended: Blockchain Dark Forest Self-Rescue Handbook, Web3 Phishing Technique Analysis.
Additionally, we recommend conducting periodic red-team/blue-team exercises to identify weak points in both security process management and defensive deployments.
Closing Thoughts
Attacks often occur during weekends and holidays, creating significant challenges for incident response and resource coordination. Throughout this investigation, 23pds, Reborn, and the rest of the team remained vigilant, rotating on-call shifts during the holidays to sustain the investigation. Ultimately, we successfully reconstructed the attacker’s methodology and intrusion path.
In retrospect, this investigation not only uncovered Lazarus Group’s attack methodology but also mapped out their full tactical chain — social engineering, PyYAML RCE, privilege escalation, internal network penetration, and asset exfiltration. Cybersecurity is a war of endurance, and we will continue to track such attacks, helping the community collectively defend against these threats.