Social Engineering | Think like an attacker, defend like a guardian

Over a near-black teal-blue background, a LinkedIn recruitment message dialog beside a malicious npm package structure diagram, an arrow tracing the encrypted payload exfiltrated via a C2 channel to a dark server, a developer terminal showing installation complete while keys leak in the backdrop — symbolizing the LinkedIn recruitment phishing attack targeting blockchain engineers

Security Research

LinkedIn Recruitment Phishing Analysis: A Targeted Attack Against Blockchain Engineers

In March 2025, attackers posed as recruiters on LinkedIn targeting blockchain engineers, sending them Bitbucket repositories containing malicious code. The malicious payload was hidden on line 46 of server.js behind an extremely long horizontal scrollbar, encrypted through multiple layers of base64, and ultimately connected to a C2 server to download an info-stealing trojan and a persistence backdoor.

2025-03-15 6 min #Web3 Security

Over a near-black teal-blue background, a hooded APT silhouette ascending a multi-stage arrow staircase, a PyYAML RCE backdoor glowing copper-orange at the entry point, lateral-movement arrows threading toward a wallet server, and a smoking trust-chain link — symbolizing the Lazarus Group's targeted APT attack on cryptocurrency exchanges

Security Research

Lazarus Group APT Attack on Cryptocurrency Exchanges: IOC & TTP Disclosure

After nearly a month of forensic investigation into multiple cryptocurrency exchange breaches, I and 23pds confirmed the attacker as Lazarus Group. This article discloses the complete set of IOCs and TTPs, including social engineering entry, PyYAML RCE backdoor deployment, and lateral movement to wallet servers.

2025-02-23 7 min #APT Analysis