Cyber Incident Victim: deBridge Finance
Date:
Aug 2022
Location:
United States of America
Summary
A cross-chain crypto platform was targeted by the North Korean Lazarus group in a phishing attack where employees received fraudulent emails posing as salary change notifications. The emails contained malicious PDF and text files that directed users to a cloud storage link hosting a password-protected archive, leading to malware deployment. The malware evaded detection by checking for antivirus processes, established persistence via the startup folder, harvested system information, and communicated with attacker-controlled servers to enable further malicious activities. This incident mirrored the group’s previous tactics against cryptocurrency entities, including high-value thefts like the Ronin bridge exploit, highlighting their continued focus on compromising crypto infrastructure through social engineering and multi-stage payloads.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On or around August 4, 2022, threat actors suspected to be affiliated with the North Korean Lazarus group targeted deBridge Finance, a cross-chain cryptocurrency protocol facilitating decentralized asset transfers across blockchains. The attackers initiated the compromise through a phishing email designed to impersonate legitimate salary change notifications. This email contained malicious attachments disguised as PDF and text files. When an employee opened the fake PDF, it redirected them to a cloud storage location hosting a password-protected archive. The accompanying text file contained instructions to extract the archive’s password, leading the victim to inadvertently execute the attack chain. The malware payload deployed from the archive performed reconnaissance on the compromised Windows system, checking for the presence of antivirus processes. If no security software was detected, the malware established persistence by copying itself to the system’s startup folder.
The malware collected system information, including host details and environment variables, and exfiltrated this data to a command-and-control server controlled by the attackers. This initial access was intended to enable follow-on stages of the attack, including potential secondary payload delivery. Analysis of the phishing lure, malware behavior, and infrastructure linked the campaign to previous Lazarus operations targeting cryptocurrency platforms. The group has historically employed similar social engineering tactics, such as weaponized documents masquerading as routine corporate communications. Lazarus is known for high-value crypto thefts, including the March 2022 theft of approximately $620 million from the Axie Infinity Ronin bridge. The deBridge incident demonstrated continued adversarial focus on cross-chain protocols as lucrative targets, though the article did not specify whether the attack resulted in asset theft or quantify operational disruptions.