Search — “Lazarus Group”

The FBI formally attributed the October 29, 2026 theft of roughly $6.36 billion in virtual assets from Binance to TraderTraitor (also tracked as Lazarus Group, Jade Sleet, APT38) and published 628 associated cryptocurrency addresses for exchanges and VASPs to block. Binance linked the breach to a compromised DevOps engineer's laptop that let attackers access a service container and submit unauthorized withdrawals, with most funds moved within 20 minutes. Hunters should look for laundering-address matches in blockchain monitoring and, for their own environments, prior-style patterns such as developer-workstation compromise via fake recruiter or test-code lures.

North Korea's Lazarus Group, per Kaspersky's FlashHole research, targets South Korean organizations via phishing pages leading to crafted GitHub pages that load JavaScript and trigger an in-memory chain through INISAFE CrossWeb EX, which runs fsquirt.exe to execute shellcode installing the TechHub downloader. LPEClient uses ML-KEM-1024 public keys from C2 to derive shared keys that decrypt the Cubridge backdoor payload, which is reflectively loaded in memory. Hunters should look for INISAFE CrossWeb EX spawning fsquirt.exe, TechHub retrieving from GitHub, and Dropbox-based ClientHub traffic.